24 hours in handcuffs. The police are increasingly intercepting SIM boxes for fraudulent calls

https://streamable.com/e70j5p

One fine Wednesday, a 20-year-old Ukrainian woman living in Tallinn entered the AirBnB apartment rented for her. He set up the laptop and plugged it into the wall with an internet cable to make the internet connection as fast as possible. With another cable, he connected to the computer a box almost as big as the computer itself, with 32 small black antennas on it.

Next, he took out a bag of SIM cards, all freshly bought, still in their envelopes. The woman took the cards out of their packaging and inserted them into the SIM box. 32 slots, 32 SIM cards.

It took a few moments and the lights next to the SIM card slots started to glow one after the other – the cards were in use. Someone somewhere was making scam calls using these cards. Called people in Estonia to get their money.

The Ukrainian woman’s job was to change SIM cards according to the instructions received on the Internet, if some of them ran out of talk time or if the telecom company switched off a number.

He could not do this job for a long time. On Wednesday, the woman got the fraud center set up, by Friday her hands were already in irons.

He is the fifth person this year to be arrested for operating a SIM box. In 2025, only three SIM boxes were received throughout the year.

In February, Ekspress wrote how major communication companies have combined forces and information systems and are now able to block most of the so-called spoofed (see side story) calls. For example, Telia blocked 2.3 million such calls in February. In March, Telia made another change that slowed down fraudsters’ ability to make a new call. The result – in March there were only 858,000 fraudulent call attempts on the Telia network.

The fraudsters’ countermeasure to preventing spoofing is SIM boxes. The head of the North Prefecture’s Serious Crime Service presents the success story of fighting them Elari Haugas the capture of the Ukrainian woman described above. In a couple of days, the tip was followed.

“I think that they themselves will slowly realize that there is no point in coming to Estonia with SIM boxes, because we will find them. And each time faster and faster,” says Haugas.

Tip from the apartment owner

“Coming to Estonia” is important here. Only two of the five operators of SIM boxes arrested this year are Estonian citizens. The first detainee was a 19-year-old young man from Estonia, the next two were Latvian citizens. In doing so, a SIM box was found in Latvia, in which Estonian calling cards were used to make calls. The fourth SIM box was again operated by an Estonian citizen, the fifth by our unfortunate Ukrainian woman.

The police see a pattern in the use of foreigners – it is easier to get them to do such work, as it is possible to create the illusion that they are more anonymous and harder to catch in a foreign country.

The Latvians were also caught quickly, the SIM box was set up on March 10, the police were there the very next day.

Of course, the police will not disclose how the police find SIM boxes so quickly and collect evidence that links a specific SIM box to a specific victim.

Clues are definitely helpful and one of the first to notice something suspicious are the owners of the rental apartments. Haugas says that hosts should be attentive and inform the police if, for example, a large amount of SIM card cases are found in the rental apartment or if someone has moved the internet router. These things point to the possibility that the apartment has been used to broker fraudulent calls.

One recent case was solved with the help of an apartment owner who found SIM card cases and a moved router in the trash and reported it to the police. The police were just looking for the SIM box, and all signs indicated that this must be the right place. Already a few hours later, the intermediary of fraudulent calls was arrested.

The Ukrainian woman, who was arrested on March 18, had been living in Estonia for several years. All five detainees had found information about the job opportunity on social media, and as far as the police know, they did not know any of the other participants in the scheme by name.

Capturing SIM boxes is currently a priority for the police, Ekspres is assured. When there is a notification about the launch of a new SIM box, other work is put on hold and everything is done to catch the fraudsters. “Every minute is at stake, every minute someone can lose their money.”

It is not known exactly how many frauds have been carried out using a particular SIM box. However, telecom companies have calculated that if 300-400 calls are usually made through a telephone mast per day, for example, the number of calls suddenly increases four to ten times during the operation of the SIM box.

Here is also a clue as to how information reaches the police that another SIM box has been hacked somewhere.

The circle converges

In Estonia, SIM boxes with 32 cards have been used to make fraudulent calls, although larger models with up to 100 card slots are also available on the market.

However, larger SIM boxes require more callers and a better internet connection, and Haugas assumes that it is for these reasons that larger SIM boxes are not used in Estonia.

In order to set up SIM boxes, we are looking for guest apartments with decent cable internet, not 4G.

When catching fraudsters with quick action, the police want to send them a message that there is no point in coming to Estonia to make fraudulent calls. The risk of getting stuck is high and avoiding getting caught is troublesome: you need to find gas stations to sit next to the booths and exchange SIM cards, you have to look for and exchange AirBnB apartments, someone has to get a booth, hand it over, and deal with the training of card changers.

And of course, someone has to risk buying SIM cards in large quantities. “This [ostja ja juhendaja] is the next one to fall,” says Haugas in a firm tone.

The operators of the SIM box themselves usually tell the police that they work for some company, “monitor the network”, or something like that. Network load and SMS transmission testing is actually the area where SIM boxes are actually used legally.

“They haven’t been instructed to answer like that,” says Haugas and adds that aiding and abetting fraud is still a crime, which entails a criminal case and a prison sentence.

It is not known how long the sentence will be for the Ukrainian woman, Latvians and others. There is no case law yet.

What is what?

Spoofing or falsifying a number. Technology that allows displaying a wrong number on the screen of the receiving phone, and thus fraudsters calling Estonia from foreign call centers get an “Estonian number”.

This technology also has legitimate uses. For example, a courier company can register a spoofed number for itself, so that the phone does not show any unknown number as the caller, but shows, for example, “Selveri courier”.

SIM box. A device that connects a call from the Internet to a local SIM card, i.e. a truly local number. The call center employee calls from anywhere via the Internet, but the call goes to the mobile network via the SIM card and appears to be made from a local number. This allows you to hide the true location of the caller. SIM boxes also have legal uses, their possession or purchase is not restricted in any way. A quick google shows that the 32-SIM device can be bought online for $1,300.