TLDR
- The ring operated 49 million fake accounts using over 1,200 SIM box devices.
- At least $5.7 million was stolen in fraud cases across Austria and Latvia.
- Authorities seized $330,000 in crypto, luxury cars, and technical hardware.
- The operation was linked to 3,200 cyber fraud cases, mainly targeting Russians.
Europol has dismantled a large crypto phishing ring operating from Latvia in coordination with the Latvian police. The criminal group managed an elaborate setup that used fake online accounts and telecom devices to steal millions from victims across Europe. Authorities linked the operation to thousands of cyber fraud cases and seized assets, including cryptocurrencies and luxury items. Investigations remain active as international efforts to stop digital scams continue.
Massive Phishing Network Operated from Latvia
Europol reported that the group behind this phishing operation ran a complex network supported by five servers and 1,200 SIM box devices. These devices helped control over 40,000 active SIM cards. Using this system, the criminals operated 49 million fake online accounts to target people across various countries.
The ring was involved in at least 1,700 fraud cases in Austria and 1,500 in Latvia, with confirmed losses of $5.7 million. Many of the victims were Russian-speaking individuals, which suggests the true extent of the fraud could be much larger. Russia is not a member of Europol, which limits cross-border cooperation in these cases.
Authorities believe the group used digital platforms and social engineering to carry out the scams. Fake identities and impersonation were key tools in deceiving victims and gaining access to sensitive information or payments.
Variety of Scams and Criminal Tactics Used
The phishing ring used multiple tactics to defraud individuals and businesses. These included impersonating family members, law enforcement officers, and business representatives. In some cases, the group threatened victims with blackmail, including using child sexual abuse material.
This mix of cybercrime methods allowed the group to reach a wide range of targets. Some victims were tricked through fake business deals, while others were contacted using emotional manipulation or fear-based tactics.
Europol noted that this group also functioned as a “SIM farm-for-hire,” allowing other criminals to use their tools for illegal activities. The availability of such services increases the speed and scale at which phishing scams can spread across borders.
Asset Seizures and Ongoing Investigation
During the operation, police seized around $330,000 in cryptocurrencies held in various tokens. Authorities also took luxury vehicles and technical equipment used to operate the scam. However, the total amount of stolen funds is believed to be much higher and may never be fully recovered.
While the confiscated crypto reflects only part of the stolen assets, it shows the increasing use of digital currency in financial crimes. Europol did not state whether these funds were being used for laundering or if they were taken directly from victims.
The investigation remains open, and law enforcement agencies are working to trace more assets and identify additional suspects. Due to the size and complexity of the network, further arrests or seizures may follow.
Broader Efforts Against Crypto Phishing Crimes
This action is part of a wider campaign by Europol and its partners to stop rising crypto-related scams. According to data, phishing scams are growing, with reported thefts reaching $12 million in August 2025. This is more than double the amount reported just four months earlier.
Authorities are seeing more advanced tactics, often supported by new technologies such as AI-generated audio. These tools make impersonation and deception easier, which puts more people at risk of falling for phishing attacks.
Europol continues to work with other countries to stop similar networks. Law enforcement across Europe is focused on breaking down the tools and infrastructure that support these crimes. The fight against digital scams is ongoing, but this bust marks a major development in protecting online users and digital assets.
