Unmasking SIM farm scam centers with location intelligence

Scalability is a fundamental requirement for lucrative criminal phone and text scams. Perpetrators must often make thousands of calls for each single, successful engagement with a victim. SIM farms industrialize fraud capacity, enabling massive volumes of calls or texts. Individual sites commonly hold tens of thousands of SIM cards or eSIMs connected to the mobile network using specialized hardware. Potentially on portable racks for ease of movement, the equipment cycles through SIMs to evade filtering or detection, as portable infrastructure for covert scam call centers.

These scams routinely create financial distress for uncounted victims, as well as identity theft and psychological harm. They disproportionately target vulnerable populations such as the elderly with threats and intimidation, elevating the criminal justice issue to a broader public safety concern. Scam centers are often operated by organized crime groups, and many are sites for the atrocity of forced labor by human trafficking victims. Discovering a network of SIM farms in New York as world leaders met at the United Nations raises the specter of denial of service attacks that might overwhelm emergency communications, perhaps blended with a terrorist attack or other hostile crisis event.

Simplified SIM Farm Process

Defined countermeasures identify and locate SIM farms and the scam centers they make possible so they can be shut down. Because these facilities are designed to be hidden, mobile, and evasive, location intelligence is central to countering them, using a combination of strategic and tactical techniques. Tracking the presence of physical infrastructure gives law enforcement the geospatial context to move from digital traces such as IMSI numbers and call patterns to interdictions on physical operations.

Casting a wide, persistent net for location intelligence

The digital signatures of scam call centers tend to be masked by an ocean of surrounding communication traffic, hidden in noisy urban areas and multi-level high-rise buildings. SS8 LocationWise helps law enforcement overcome those obstacles with systematic detection mechanisms based on location intelligence that are designed to be automated and deployed over long periods. Monitoring an area to gather passive location data with associated IMSIs and IMEIs can automatically identify traffic patterns and anomalies that warrant the attention of human investigators, such as the following:

• Motionless SIMs. Unlike mobile users, large numbers of SIMs that remain in one place for long periods suggest installation in stationary equipment.
• SIM activation fingerprints. Plotting the distribution of IMEIs against IMSIs can reveal rapid, high-volume activation/deactivation patterns consistent with SIM cycling.
• Machine-like connection patterns. Large numbers of SMS messages or short-duration calls in a small area may be quite unlike human usage.

Plotting concentrations of these indicators using heatmaps can help reveal potential scam centers. Other paths to discovering those locations are firmly rooted in the physical world, such as impounding the mobile device of an apprehended suspected scammer. Extracting details such as the MSISDN, IMSI, and IMEI from the seized device makes it possible to track its historic movements using the SS8 location intelligence platform. Heatmaps built from that data show where the device spends large amounts of time.

Tactical location intelligence for scam center takedown

Location intelligence that reveals suspected scam centers is central to a strategic footing that makes proactive enforcement possible, often providing a starting point for investigations that otherwise lack a clear path forward.

The SS8 platform integrates that position data with the full spectrum of lawful intelligence sources, without siloes. For example, financial data may show large purchases of prepaid SIMs, intercepted communications may implicate subjects of interest, and their circles may be exposed using meeting and relationship analysis. Beyond recognizing suspected scam centers and identifying their suspected locations, developing an understanding of the organizations and people that run them is critical to shutting them down.

Investigations and underlying intelligence become more tactical as they move toward boots-on-the-ground interventions. Identifying ringleaders is a critical piece of the puzzle, to shut the scam center down decisively, charge the individuals responsible, and work upward into the most vital parts of the criminal organization. Central suspects may emerge from scrupulous assembly of digital breadcrumbs, or they may be revealed by accomplices under questioning or simple luck. However the ringleader is identified, their digital identity combined with the suspected scam site location tears down their cover and leaves them vulnerable to law enforcement.

An alarm geofence built using the SS8 location intelligence platform can be configured to notify authorities and activate a raid on the building when the ringleader’s device enters the geofenced zone. Active tactical location tools such as IMSI locators play a critical role in such raids by tracking the ringleader and other known subjects to a specific floor and room number. Using both active and passive measures, location intelligence guides the broader effort to overcome criminal obfuscation of SIM farms and interrupt the harm they bring to society.

To find out more about SS8’s leading lawful and location intelligence solutions, visit www.SS8.com