Eight arrests, one million stolen card details: the SIM farm ban now has teeth

4 November 2026. Eight arrests and what law enforcement calls potentially the largest haul of compromised payment details ever recovered in the UK — more than one million phished card details, plus SIM farm equipment and cash seized. The operations were driven by a new intelligence-sharing approach in which VodafoneThree identified suspected SIM farm activity and passed it to the National Crime Agency and City of London Police's Fraud Targeting Cell, with the banking industry-funded Dedicated Card and Payment Crime Unit running the investigations. The announcement, made on 3 November, lands days after the new law itself took effect: the Crime and Policing Act 2026 offences covering possession and supply of SIM farms came into force on 29 October 2026, after a six-month transition from Royal Assent in April.

What the new offences actually cover

The statutory definition is technical: a SIM farm is a device capable of using five or more physical SIM cards simultaneously or interchangeably for mass calling or texting over telephone numbers. It is now an offence to possess one without a good reason or lawful authority, and to supply one unless defined conditions are met — with penalties on summary conviction from 29 October 2026. The carve-outs are written for legitimate users: broadcasting, transport and communications-sector uses of multi-SIM devices that don't make calls or send SMS to telephone numbers fall outside the definition. Fraud Minister Lord Hanson put the scale plainly: two-thirds of British adults say they have received a suspicious message on their phone, and fraud accounts for more than 40% of all reported crime in England and Wales.

Why this matters beyond the arrests

SIM farms are the engine room of scam texts and scam calls — the reason so many fraud messages look like they come from a plausible UK number. This enforcement push is one front of a wider clean-up that UK businesses should track: Ofcom fined telecoms provider Tismi £437,500 in October for failing to prevent misuse of around 366,000 sub-allocated numbers, and has probes running into cloud and VoIP providers Vonage Business and Voxbone (see our number-misuse investigation post). The direction of travel is clear: the chain from numbering allocation to the person who answers is being scrutinised end to end, and businesses that hold or send from UK numbers increasingly carry compliance expectations of their own.

Keep your number clean — and yours

Legitimate businesses sit on the safe side of the line but share the ecosystem. A number that has been caught in a fraud wave gets filtered and distrusted; a number under your own control, with a provider that runs know-your-customer checks and monitors misuse, is an asset you can defend. Moving your business identity to a UK virtual number you own — rather than a number borrowed from a supplier's platform — means caller ID, porting and compliance decisions stay with you. Add call forwarding and voicemail-to-email on plans from free pay-as-you-go to Pay Monthly at £9.97 a month, answer calls on a SIP phone or softphone, and if your outbound traffic is legitimate high-volume alerts or notifications, keep it clearly authorised and documented. Where alarms rather than messages are the traffic, the TAP to SMS gateway keeps panel signalling moving after the PSTN closes on 31 January 2027.

Related: Ofcom probes Vonage and Voxbone over number misuse · Ofcom moves to block spoofed UK mobile calls · BT's AI receptionist and the missed-call problem