Stopping the usage of SIM farms for fraud: session (accessible)

About this session

To:

This session is open to the general public and is focused at victims and companies who’re victims of fraud, together with from rip-off texts and rip-off calls.

We’re significantly to listen to from those that could also be affected by the proposals, ought to they turn into laws, together with telecommunications operators, companies, legislation enforcement, shopper teams, in addition to non-governmental organisations with a concentrate on fraud sufferer, civil liberties and human rights teams.

Period:

6 weeks from 3 Might 2023 to 14 June 2023

Enquiries to:

Electronic mail: SIMfarmConsultation@homeoffice.gov.uk

The right way to reply:

Please ship your response by 17:00 on 14 June 2023 by way of e mail at SIMfarmConsultation@homeoffice.gov.uk

Extra methods to reply:

In case you are unable to reply by e mail, you’ll be able to obtain a PDF model of the web kind and submit it by e mail or put up.

In the event you require info in one other format, please e mail: SIMfarmConsultation@homeoffice.gov.uk. Please inform us what format you want. It would assist us in case you say what assistive expertise you employ.

We might not have the ability to analyse responses not submitted in these supplied codecs.

Response paper:

A response to this session and name for proof shall be printed on gov.uk after the session is full.

Ministerial Foreword

As Dwelling Secretary, defending the general public is my highest precedence and fraud is the most important crime within the UK. As we speak, I’ve printed a Fraud Technique setting out the federal government’s ambition to chop fraud by 10% from 2019 ranges, down to three.33 million frauds by the top of 2024. To do that, it’s essential we cease scams from reaching folks within the first place.

Fraudsters use expertise and communications which are ubiquitous in on a regular basis life, comparable to texts and cellphone calls, to contact folks to allow them to trick them into handing over their cash. To stop the devastating monetary and emotional hurt this causes, we should deny criminals entry to any device that enables them to ship bulk messages or make rip-off calls.

This is the reason I’m launching this session on banning the provision and use of SIM farms within the UK. To make the proposals future proof, we’re additionally asking what different applied sciences must be banned to stop criminals with the ability to use them for fraud.

These proposals pave the best way for future laws to enhance the response to telecommunications-enabled fraud, to make sure that our legislation enforcement businesses stay forward of the curve and to depart criminals with no place to cover.

Rt Hon Suella Braverman KC MP
Dwelling Secretary

Govt Abstract

SIM farms are units that may home lots of of SIM playing cards, which might ship out hundreds of rip-off texts to defraud the UK public of hundreds of thousands of kilos. Along with sending rip-off texts, these units are utilized by criminals to run rip-off name campaigns and to put up deceptive, false or phishing messages on social media in bulk. Criminals use them to masks communications knowledge when making calls or texts, making investigations considerably harder. SIM farms are incessantly utilized in abuse of telecommunications operators’ phrases of service to ship reliable site visitors at considerably cheaper charges than if this was performed by the correct routes.

While there are some probably reliable makes use of of the expertise, these are restricted and mustn’t require utilizing greater than 4 SIM playing cards, primarily based on the variety of cell operators within the UK. We have now very restricted proof that there are any reliable use instances for units that enable the usage of greater than 4 SIM playing cards, and for all such instances various choices exist.

This session units out proposals to ban the manufacture, import, sale, rent and possession of SIM farms (units for greater than 4 SIM playing cards) within the UK. As well as, we’re asking whether or not different applied sciences used virtually completely to commit fraud must be included. We’re additionally searching for enter on our definition of SIM farms to make sure it precisely captures the units presently in use, and views on our choice to use the measure solely to units with greater than 4 slots.

To make sure we will reply to new threats we determine sooner or later, the session can also be searching for views on whether or not the Authorities ought to have the ability to replace the record of banned applied sciences and articles by secondary laws.

To mitigate any prices arising from the proposals, we’re asking whether or not we must always set a time frame to permit organisations to guage the processes and expertise they use and transition to various strategies.

Alongside this, we’re launching a name for proof to gather info and knowledge that may enable extra correct estimates of the impacts on companies to be made. An in depth appraisal shall be accomplished, and a full Influence Evaluation supplied following the session.

Background

The risk to the UK public from fraud

As set out within the current Fraud Technique, fraud is rising as a proportion of crime and now accounts for over 40% of all estimated crime in England and Wales.^{[footnote 1]} Within the yr ending December 2022 there have been 3.7 million estimated fraud offences, and 1 in 15 adults have been a sufferer of fraud. Within the yr ending March 2022 18% have been victims of fraud on multiple event.^{[footnote 2]} The price of fraud is staggering. The full value to society of fraud in opposition to people in England and Wales was estimated to be at the very least £6.8 billion in 2019-20.^{[footnote 3]} This contains the cash misplaced by victims, the price of supporting victims, and the prices of restoration, investigation and prosecution of fraudsters.

One purpose for this fast enhance within the scale and hurt from fraud is rising complexity and technological sophistication of the instruments accessible to fraudsters each within the UK and abroad. Criminals typically abuse telecommunication networks to focus on folks and defraud victims at important scale. Within the interval June-August 2022, three quarters of individuals within the UK mentioned they’d acquired a suspicious message, within the type of both a textual content, a recorded message or a stay voice name to a cell. This represents over an estimated 40.8 million adults within the UK.^{[footnote 4]} An estimated 700,000 then adopted the scammer’s directions, risking monetary loss and important emotional misery.

Rip-off texts

Texts are the commonest type of suspicious message with greater than 6 in 10 folks reporting that they’d acquired suspicious texts. Reviews of suspicious calls are decrease however nonetheless important: 21% of respondents reported suspicious stay calls to their mobiles and 19% to their landlines.^{[footnote 5]} Rip-off texts are incessantly traced again to SIM farms and different applied sciences that enable criminals to ship out rip-off messages in bulk. The Authorities is dedicated to stopping criminals from exploiting applied sciences and gear, comparable to SIM farms, and to safe our telecommunications networks from these searching for to defraud the UK public.

Present authorized place

Present laws doesn’t stop criminals from acquiring and utilizing SIM farms, and different comparable applied sciences. The Fraud Act makes it unlawful to produce or possess articles, together with SIM farms, if they’re meant for use for fraud. Nonetheless, this can be very troublesome to determine that an individual who possesses, makes or provides SIM farms is intending to make use of them for fraud. Likewise, the Act doesn’t require importers, producers or sellers to undertake checks on the meant use of the system.

Underneath the Wi-fi Telegraphy Act 2006 (WTA), Ofcom and the Secretary of State have powers to impose restrictions if an article interferes with wi-fi telegraphy. These powers don’t apply to crime or nationwide safety (solely wi-fi interference), which means that isn’t doable to make use of them to stop abuse of wi-fi telegraphy to commit fraud, comparable to to deal with SIM farms.

Because of this criminals, already intent on breaking the legislation, don’t face any limitations by way of procuring SIM farms to conduct their felony actions. This is the reason we’re introducing new measures to make it as troublesome as doable for criminals to acquire and use SIM farms within the UK.

SIM farms may current within the type of a cell app which both affords to pay customers for his or her unused free SMS messages or installs malware that steals their SMS allocation each month. In December 2022 the Authorities printed a voluntary Code of Apply ^{[footnote 6]} which set out minimal safety and privateness necessities for app retailer operators and app builders. The Code of Apply for App Retailer Operators and App Builders goals to guard customers from malicious and poorly developed apps and can deal with the dangers from app variations of SIM farms. We’re monitoring the implementation of this and can think about what extra must be performed to disrupt the app model of SIM farms, together with by the usage of the related measures outlined on this session doc.

Session: The risk to the UK public from SIM farms and comparable applied sciences

Definition of SIM farms

There are numerous completely different names for SIM farms, together with SIM bins, SIM gateways, World System for Cell communication (GSM) gateways, Voice over Web Protocol (VoIP) gateways, and SMS gateways.

These are units that convert fixed-line (web or public switched phone community) communications into cell communications. Their major use is receiving calls or SMS messages despatched over the web and re-transmitting them over cell networks to have the ability to attain cellphones.^{[footnote 7]} Companies can use them to make sure continuity of connection when transferring by areas of inadequate sign protection; or meet short-term communication wants with out the necessity to set up a everlasting fastened line to short-term websites. A name or textual content despatched from these units seems to the cell community to have originated from a cell phone registered to that community.^{[footnote 8]}

There are substantively solely 4 cell operators within the UK, with all different suppliers piggybacking off their providers. Because of this units with 5 or extra SIM slots will not be required to make sure continuity of connectivity. They can be utilized otherwise, comparable to to repeatedly entry the community to ship mass texts, to make many calls, or to entry the web by many connections. On this session, we due to this fact outline SIM farms as units with greater than 4 slots.

We recognise the above definition refers primarily to bodily units and could also be lacking different iterations of the expertise, together with doable combos of bodily {hardware} and digital software program. Due to this fact, to make sure we now have precisely captured all iterations of a SIM farms, we invite views on this definition.

Inquiries to consultees:

The risk

Rip-off texts are incessantly traced again to SIM farms, which might typically home lots of or hundreds of SIM playing cards. SIM farms can be found on standard on-line marketplaces, at low costs, with restricted or no requirement to confirm the client’s identification. This makes them a horny, straightforward to entry, low-cost choice to criminals who ship out massive volumes of texts to phish^{[footnote 9]} for delicate knowledge, like financial institution particulars.

SIM farms enable criminals to make use of all capabilities of SIM playing cards in bulk and at low value. Along with sending big numbers of rip-off texts, this contains operating rip-off name campaigns and posting deceptive, false or phishing messages on social media in bulk. The expertise may enable criminals to hide communications by displaying inaccurate Caller Line Identification (CLI) knowledge and incorrect caller location.

SIM farms are overtly marketed on standard on-line marketplaces for buy and transport to the UK. The vast majority of marketplaces have very restricted to non-existent checks to confirm the identification of their clients. Because of this this can be very straightforward for criminals to acquire SIM farms, at a low-cost, and use them to focus on the UK public.

It isn’t doable to determine the precise variety of SIM farms getting used, however fraud statistics point out that the usage of SIM farms was amongst the highest 5 varieties of telecommunications fraud in 2021.^{[footnote 10]} For instance, one police investigation found that 5 SIMs had despatched over 900,000 messages in a single SIM farm between April and October in a single yr.

Rip-off messages proceed to get previous the cell community’s filters. It’s because, in response to detection efforts, SIM farm methods are evolving quickly. Some SIM farm suppliers explicitly provide strategies to counteract detection methods, comparable to specialist software program that imitates the best way people use SIM playing cards of their cellphones (Human Behaviour Simulation software program). For instance, SIM playing cards within the SIM farm might name or textual content different SIM playing cards within the field, rendering the SIM card’s behaviour seem as extra ‘regular’. Such strategies intention to bypass the controls in place by cell operators and make SIM farms a lot tougher to detect.

Software-to-person (A2P) messaging, comparable to automated appointment reminders, two- issue authentication prompts or sending bulk SMS as a part of advertising and marketing campaigns, are an more and more necessary a part of the general SMS market. While often in opposition to the

telecommunications supplier’s phrases of service, some unscrupulous actors additionally funnel A2P messaging by SIM farms in an effort to cut back their prices, inflicting losses to the reliable operation of the supplier.

To tell our proposals, we’re searching for views and proof on these and different threats posed by SIM farms.

Inquiries to consultees

Authentic makes use of

We have now recognized a restricted set of reliable use instances for units that home 4 or fewer SIM playing cards, comparable to to make sure continuity of connection when transferring by areas of inadequate sign protection or to fulfill short-term communication wants with out the necessity to set up a everlasting fastened line to short-term websites.

Nonetheless, we now have engaged extensively throughout trade and legislation enforcement and haven’t recognized any reliable use case for SIM farms (outlined as units with greater than 4 slots). Any of the above reliable use instances don’t require such a configuration and in all instances various choices possible exist.

It’s presently authorized within the UK for companies or shoppers to purchase, set up and use SIM farms for private use, in a set-up often known as Single-Use GSM Gateways. Nonetheless, as upheld by the Supreme Courtroom on 8 March 2023, their set-up in a business multi-user format (often known as COMUGs) requires an Ofcom licence. Ofcom have by no means issued a licence, which means that it’s not authorized to function a COMUG. Nonetheless, the sale of SIM farms, which might simply be arrange as COMUGs, stays unrestricted and they’re offered overtly on on-line marketplaces, which means criminals can proceed to simply acquire and function them.

The best way COMUGs are used permits their operators to hide communications knowledge ought to they select to. This makes it harder for legislation enforcement to research criminals and determine and find folks liable to hurt.

We invite views for info on any reliable makes use of for SIM farms that aren’t listed above.

Inquiries to consultees:

Criminals additionally use different applied sciences to focus on their victims

We’re acutely aware that there are different strategies accessible to criminals to contact their victims – and as expertise continues to develop extra will emerge sooner or later. The current iSpoof case reveals these can take many types and will not be restricted to bodily units. It additionally reveals that applied sciences accessible to fraudsters transcend SMS, extending to creating spoofed voice calls, sending recorded messages and intercepting one-time passwords.

Whereas iSpoof has now been shut down, it reveals the adaptability, and the tempo of innovation criminals are able to. This is the reason we’re searching for views on different applied sciences utilized by fraudsters.

Inquiries to consultees

Proposed new offence

We intend to create a felony offence to ban the manufacture, import, sale, let or rent, possession and/or use of applied sciences used for fraud within the UK. The laws will record the applied sciences recognized by this session, together with SIM farms.

We suggest that this is able to be a strict legal responsibility offence, which means it could not be essential to indicate that the accused knew, or had cheap grounds to suspect, that the SIM farm can be utilized in crime, together with fraud. We suggest that this offence would carry the penalty of a vast high-quality however that it could not carry the chance of custodial punishment. We invite views on whether or not that is proportionate.

The intention is that the offence applies to the entire of the UK. While, the detection, investigation and prosecution of fraud are devolved, telecommunications coverage and what communications units and providers are lawful are a reserved matter for the UK Parliament. Nonetheless, regulation of wider applied sciences is devolved in some components of the UK and we proceed to interact with devolved authorities on this.

We’re eager to listen to views on the proposed offence and whether or not there are various means to stop criminals abusing SIM farms that would higher shield the general public from mass rip-off texts.

Inquiries to consultees

Means so as to add additional articles to the record

Whereas we’re consulting with a variety of stakeholders, we don’t imagine it’s doable to compile an exhaustive record of things, past SIM farms, to record at introduction of the proposed ban.

Fraudsters could be fast to adapt and we need to be certain that these provisions could be adjusted accordingly. We due to this fact suggest the Secretary of State would have the ability to amend the record so as to add a brand new merchandise in future, if there’s proof that the expertise is utilized in fraud.

We suggest that the Secretary of State can add an merchandise to the record whether it is concerned in fraud and the next circumstances are met:

• There’s proof of felony use together with the finishing up of fraud

• Stakeholders and events affected by the change have been consulted, and

• Parliament approves the modification by way of affirmative process.^{[footnote 11]}

We invite views on these provisions and whether or not they guarantee proportionality.

Inquiries to consultees

Name for proof for extra info

We would not have a full image of the influence of the proposals on companies and the prices related to introducing and implementing the ban on account of lack of ample proof. Due to this fact, alongside the session, we’re issuing a name for proof to gather info and knowledge that may enable extra correct estimates of the impacts on companies.

We invite all events to supply suggestions and empirical proof on the advantages, unintended results, consistency and coherence of the framework underneath which SIM farms are made accessible and operated within the UK.

We’ll produce a full Influence Evaluation utilizing the data returned to this name for proof.

Questionnaire

About you

Please use this part to inform us about your self:

Full title

Job title or capability during which you’re responding to this session train (for instance, member of the general public, legislation enforcement company, authorized skilled, trade skilled and so forth.)

Date

Firm title/organisation (if relevant)

Electronic mail deal with

Deal with

Postcode

If you want us to acknowledge receipt of your response, please tick this field

Deal with to which the acknowledgement must be despatched, if completely different from above

In case you are a consultant of a gaggle, please inform us the title of the group and provides a abstract of the folks or organisations that you just characterize.

We might welcome responses to the next questions set out on this session paper.

A. Definition and makes use of of SIM farms

B. Different applied sciences used for fraud within the UK.

C. Proposal to ban the manufacture, import, sale, rent, possession and/or use of SIM farms within the UK:

D. Proposals to ban the manufacture, import, sale, rent, possession and/or use of (different) applied sciences used for fraud within the UK

E. Means so as to add additional objects to the record of banned applied sciences

F. Name for Proof

Equality Impacts

Q33. Do you might have any feedback concerning the proposals on this session doc in relation to impacts on folks on the idea of any of the next protected traits underneath the Equality Act 2010: age; incapacity; being pregnant and maternity; race; faith or perception; intercourse; sexual orientation and gender reassignment; marriage or civil partnership? How would possibly such impacts be mitigated? (Max. 500 phrases)

Thanks for taking part on this session.

Copies of this paper are being despatched to:

• Devolved Administrations

• Ofcom (Workplace for Communications)

• Nationwide Crime Company

• Nationwide Police Chiefs’ Council

• Metropolis of London Police

• Crown Prosecution Service

• Critical Fraud Workplace

• His Majesty’s Income and Customs

• His Majesty’s Inspectorate of Constabulary and Fireplace & Rescue Companies

• Affiliation of Police and Crime Commissioners Organisations representing the pursuits of enterprise and trade

• Signatories to the Telecommunication Fraud Sector Constitution

• Telecommunications commerce our bodies, comparable to Cell Ecosystem Discussion board, Cell UK and GSM Affiliation

• Non-Governmental Organisations (NGOs) with an curiosity in shopper rights and sufferer assist

• Lecturers with an curiosity in fraud

• Parliamentarians

Nonetheless, this record isn’t meant to be exhaustive or unique and responses are welcomed from anybody with an curiosity in or views on the topic lined by this paper.

Please ship your response by 14 June 2023 at 17:00 by way of e mail at SIMfarmConsultation@homeoffice.gov.uk

You probably have any complaints or feedback concerning the session course of it’s best to contact the Dwelling Workplace on the following deal with:

Electronic mail: SIMfarmConsultation@homeoffice.gov.uk

Additional paper copies of this session could be obtained from this deal with, and it’s also accessible on-line at gov.uk

Different format variations of this publication could be requested from the Dwelling Workplace on the above deal with.

Publication of response

A paper summarising the responses to this session shall be printed in following the top of the session. The response paper shall be accessible on-line at gov.uk

Consultant teams

Consultant teams are requested to present a abstract of the folks and organisations they characterize after they reply.

Privateness Discover

Confidentiality

Data supplied in response to this session, together with private info, could also be printed or disclosed in accordance with the entry to info regimes (these are primarily the Freedom of Data Act 2000 (FOIA), the Knowledge Safety Act 2018 (DPA), the Normal Knowledge Safety Regulation (GDPR) and the Environmental Data Rules 2004).

If you would like the data that you just present to be handled as confidential, please bear in mind that, underneath the FOIA, there’s a statutory Code of Apply with which public authorities should comply and which offers, amongst different issues, with obligations of confidence. In view of this it could be useful in case you might clarify to us why you regard the data you might have supplied as confidential. If we obtain a request for disclosure of the data we’ll take full account of your rationalization, however we can not give an assurance that confidentiality could be maintained in all circumstances. An automated confidentiality disclaimer generated by your IT system is not going to, of itself, be thought to be binding on the Dwelling Workplace.

The Dwelling Workplace will course of your private knowledge in accordance with the DPA and within the majority of circumstances, this may imply that your private knowledge is not going to be disclosed to 3rd events.

Privateness Discover

Your private info, provided for the needs of this session, shall be held and processed by the Dwelling Workplace:

The Dwelling Workplace is the controller of this info. This additionally contains when it’s collected or processed by third events on our behalf.

Particulars of the Division’s Knowledge Safety Officer could be discovered at dpo@homeoffice.gov.uk Phone: 020 7035 6999

Or write to:

How and why the Division makes use of your info

The Dwelling Workplace is simply allowed to course of your knowledge the place there’s a lawful foundation for doing so.

The Dwelling Workplace fraud coverage group will collate and analyse responses to higher perceive what SIM farms are, how they’re used within the UK, the potential influence of the proposals on UK companies and whether or not the proposals would assist cut back smishing (mass rip-off SMS campaigns). The coverage group will use the responses to kind its last coverage proposal and to develop laws if essential.

The Dwelling Workplace might share your info with different organisations in the midst of finishing up our capabilities, or to allow others to carry out theirs.

Extra details about the methods during which the Dwelling Workplace might use your private info, together with the needs for which we use it, the authorized foundation, and who your info could also be shared with could be discovered at Information rights privacy information notice – GOV.UK (www.gov.uk)

Storing your info

Your private info shall be held for so long as essential for the aim for which it’s being processed and in step with departmental retention coverage. Extra particulars of this coverage could be discovered at What to keep: Home Office retention and disposal standards – GOV.UK (www.gov.uk)

Requesting entry to your private knowledge

You could have the precise to request entry to the non-public info the Dwelling Workplace holds about you. Particulars of learn how to make the request could be discovered at Personal information charter – Home Office – GOV.UK (www.gov.uk)

Different rights

In sure circumstances you might have the precise to:

1. object to and prohibit the usage of your private info, or to ask to have your knowledge deleted, or corrected.
2. (the place you might have explicitly consented to the usage of your private knowledge and that’s the lawful foundation for processing) the precise to withdraw your consent to the processing of your knowledge and the precise to knowledge portability (the place processing is carried out by automated means)

Questions or issues about private knowledge

You probably have any questions or issues concerning the assortment, use or disclosure of your private info please contact the Dwelling Workplace by way of info.access@homeoffice.gov.uk

Or write to us at:

You could have the precise to complain to the Data Commissioner’s Workplace about the best way the Dwelling Workplace is dealing with your private info. Particulars on the way you do this may be discovered at Personal information charter – Home Office – GOV.UK (www.gov.uk)

Session rules

The rules that authorities departments and different public our bodies ought to undertake for participating stakeholders when creating coverage and laws are set out within the session rules.

https://www.gov.uk/government/publications/consultation-principles-guidance