VodafoneThree Tip-Off Helps NCA Recover Over 1m Stolen Card Details

Intelligence from VodafoneThree about suspected SIM farms has led to eight arrests and the recovery of more than one million compromised card details, the mobile operator said on 3 November. VodafoneThree spotted the suspicious activity on its network and passed it to the National Crime Agency (NCA) and the City of London Police, and the release says cash and equipment were also seized.

The operation is being presented as a model for how the UK now wants to fight text and call scams: by going after the hardware that sends them, not only the people who fall for them. It lands days after possessing or supplying SIM farms without a good reason became a criminal offence across the UK, on 29 October.

How a mobile network found the SIM farms

A SIM farm is a box that holds many SIM cards at once, sometimes hundreds or thousands, and uses them to push out automated calls and texts. Fraudsters use them to send phishing messages that trick people into handing over card and personal details, which can then be used for fraud or sold on as victim “profiles”, the release says.

VodafoneThree says it used “a new approach developed with law enforcement” to identify suspected SIM farm activity, then shared the intelligence with the NCA and the City of London Police’s Fraud Targeting Cell. The Dedicated Card and Payment Crime Unit (DCPCU), a police unit funded by the banking industry through UK Finance, investigated the people suspected of running the devices.

The result, according to the release, was the recovery of “what law enforcement has described as potentially the largest haul of compromised payment details ever recovered”. A footnote attributes that description to the NCA. Nick Sharp, the NCA’s Deputy Director of Fraud in the National Economic Crime Centre, said: “Intelligence shared by VodafoneThree enabled us to disrupt suspected criminal activity and recover more than one million compromised card details.”

VodafoneThree has not said how its detection works, and the release gives no locations or dates for the arrests. City of London Police has a record of pursuing phone-based fraud: TSN covered the jailing of a London SIM-swap fraudster in October.

What the new UK SIM farm offences cover

The Home Office guidance defines a SIM farm as a device that can use five or more physical SIM cards, at the same time or in turn, to make calls or send and receive texts. Under the Crime and Policing Act 2026, possessing one is an offence unless the owner has a good reason or lawful authority. The Act names broadcasting, public transport, running a communications network and tracking freight as examples of a good reason.

Supplying a SIM farm is also an offence unless the seller takes reasonable steps to check the buyer has a legitimate purpose and records the sale, including the date, the device and the buyer’s details. Both offences, and police powers of entry linked to them, came into force on 29 October under commencement regulations. Lord Hanson, the Minister for Fraud, said in the release: “The law we introduced to ban their use is now in force.”

Why the fight against SIM farms moves to the supply chain

The interesting part of this case is who found the SIM farms. Banks and police usually see fraud after the money has gone. A mobile operator can see the delivery system while it is still working: thousands of SIMs behaving like machines, not people. By acting on that signal, VodafoneThree and the investigators reached the card data itself, which is the stock that phishing gangs sell and reuse. Recovering more than a million card records can let banks block or reissue those cards before they are used.

The new law closes a gap the Home Office guidance spells out plainly. Sending scam texts was already a crime under the Fraud Act 2006, but simply owning the kit was not, unless police could prove it was meant for fraud. Now the burden shifts: a person found with a SIM farm has to show a good reason. That should make it easier to act on the kind of tip-off VodafoneThree provided, before the next wave of messages goes out.

There are limits. The offences are summary only and carry a fine, not prison, so the serious penalties still depend on proving fraud. The record-keeping duty on suppliers will only bite if police check it, and organised groups may shift to equipment that falls under the five-SIM threshold or to internet-based messaging. For people who work in fraud prevention, the model to watch is the data sharing: telecoms intelligence fed into a bank-funded police unit. It is the same push to make platforms carry part of the burden that drives the EU’s case against Booking.com over scams and browser features such as Chrome’s suspicious site warnings, and it echoes infrastructure takedowns such as the Virtualine bulletproof hosting seizure.

Spotting the texts SIM farms send

• Treat unexpected texts asking you to confirm card details, pay a small fee or follow a delivery link with suspicion, and contact the company through its own app or website.
• Report suspected scam texts to your mobile network instead of replying to them.
• If you entered card details after a text or call, contact your bank straight away using the number on your card.

VodafoneThree describes its work as part of the “Disrupt” pillar of the UK Government’s Fraud Strategy. The next test is whether the eight arrests lead to charges, and whether police start to use the new possession offence against the next SIM farm they find.

Sources

• VodafoneThree: VodafoneThree intelligence helps National Crime Agency bust criminal SIM farm networks (3 November 2026)
• Home Office: Crime and Policing Act 2026 guidance on offences relating to the possession and supply of SIM farms (gov.uk, 27 July 2026)
• Crime and Policing Act 2026, sections 151 to 153: SIM farms (legislation.gov.uk)
• The Crime and Policing Act 2026 (Commencement No. 3 and Saving Provisions) Regulations 2026, regulation 5 (legislation.gov.uk)

Related stories

• FBI Seizes Virtualine Domain as Dutch Police Take Servers Offline
• Chrome Adds ‘Suspicious Site’ Warnings and ClickFix Checks for Scams
• EU Opens DSA Case Into Whether Booking.com Does Enough to Stop Scams
• Crypto Crime Roundup: 15,000 BNB Returned, a Hacker Convicted and a SIM-Swapper Jailed