After a year-long investigation, Toronto police have arrested 10 people allegedly involved in a “SIM swap” fraud scheme, where criminals take over people’s phone numbers in order to access personal information and bank accounts.

Over 1,500 cellular accounts across Canada were compromised by the scam, police said at a news conference Thursday.

Police said 108 charges have been laid, including fraud over $5,000, intercepting private communications and possessing identity information for a fraudulent purpose. Police said two female suspects from Toronto remain outstanding.

The fraud cost victims, telecommunications companies and financial institutions over $1 million combined, police said. 

The joint investigation between Toronto police’s financial crimes unit and coordinated cyber centre unit (C3), dubbed Project Disrupt, began in June 2023 after multiple telecom companies reported suspicious activity, police said.

Det. David Coffey told reporters Thursday that collaboration with C3 will remain crucial in future investigations as “fraud has become so heavily reliant on the Internet.”

Coffey said SIM swap scams exploit weaknesses in two-step authentication processes for online accounts.

Criminals often use fraudulent identification to convince a telecommunications company they are one of its clients, Coffey said. They then take over the victim’s phone number on a different physical SIM card and phone, he said, and criminals are able to use the phone number to access banking, email and social media accounts through two-step authentication texts to that number.

In some instances, criminals gained access to SIM cards through phishing techniques, such as fake web links, Coffey said.

Police say investigators recovered more than 400 fraudulent pieces of identification.

Ways to protect against SIM swaps

Det. Const. Michael Gow told reporters SIM swap scams often aren’t even noticed by the victims, and as a result it’s an under-reported crime. Gow says police are trying to educate the public about SIM swaps so they are better reported.

When a SIM swap occurs, he says, victims lose cell service and see an “SOS” symbol instead of bars. If criminals switch the SIM card back to the victim’s phone, Gow says, they might not connect the temporary outage to any fraudulent activity they then discover on their accounts.

“When victims see what happens, they just see fraud happening to their bank account. They don’t actually see a SIM swap,” Gow said.

“If there’s cell towers around you and that’s happening,” Gow said of the SOS symbol, “that’s a red flag.”

To better protect themselves against this type of fraud, Gow says people should avoid using their phone number as part of two-step authentication online when possible, instead opting for authentication apps or other software. 

He says people should also be careful about what information they make public online.

“Everything I’m posting online, there’s a digital footprint attached, and I’m leaving a story behind it,” Gow said, adding that fraudsters research potential victims before they try to impersonate someone in a SIM swap.

Gow said police are also educating telecommunications companies and financial institutions about this type of fraud “so they can be well equipped to try and prevent it.”