Suspects in ‘Russian Coms’ spoofing service arrested in London, as NCA announces takedown

The two individuals suspected of developing and being the administrators of the “Russian Coms” caller ID spoofing service have been arrested in London, the National Crime Agency (NCA) announced on Thursday.

Russian Coms was established in 2021 and “is thought to be behind financial losses in the tens of millions,” said the NCA, with an estimated 170,000 victims in Britain alone. Despite its name, it is not believed to have any links to the Russian Federation.

The fraudsters who used the service — which was available initially through a converted Motorola smartphone and more recently as a web application — are known to have made calls to 107 different countries around the world, including the United States, New Zealand, Norway, France and the Bahamas.

Although the total losses facilitated by the platform aren’t yet known, police said that they have detected more than 1.3 million calls made by Russian Coms users to 500,000 unique phone numbers — with approximately 170,000 of these calls lasting longer than 5 minutes, indicating a successful fraud.

The NCA is currently working with international partners to identify other victims and affiliates of the service to bring them to justice.

“A typical scam involved offenders spoofing the number of a bank to gain the trust of a victim, before convincing them that their account had been subject to fraudulent activity. They would then be persuaded to transfer their money to another account in order to safeguard their savings,” stated the NCA.

The bespoke handset was marketed over social media platforms including Snapchat, Instagram and Telegram for up to £1,400 for a six-month contract. It provided a range of features, including using a VPN to mask the callers’ IP address while using the device, and a remote wiping feature.

Screenshot of pricing plans for the illegal Russian Coms caller ID spoofing service. Image: NCA

The two men believed to have developed and administered the platform were arrested in Newham, London, by NCA officers back in March, when the agency also dismantled the platform. The takedown and acquisition of the service’s backend have provided the NCA with “significant amounts of data,” it said on Thursday.

The two men arrested in March are aged 26 and 28, but biographical details will not be made public until they are formally charged. Another 28-year-old man from Newham, “a suspected close affiliate and handset courier,” was arrested in April. All have been released on conditional bail.

Further arrests have included an individual in Europe and others in the United Kingdom, the NCA said. The agency stated that its investigation into the fraudsters who used this platform is still ongoing.

In a statement, Adrian Searle, the director of the NCA’s national economic crime center, said: “Criminals are increasingly using technology to carry out fraud and other crimes on an industrial scale, causing very real harm to victims in the UK and across the world. 

“Whilst this use of technology, which can be called ‘crime as a service’, promises anonymity, unbeknown to the criminal users, the services also store the users’ data, so we can identify who they are and how they operate.”

Nik Adams, the temporary assistant commissioner at the City of London Police, said: “Fraud is a devastating crime which can have a huge impact on victims, both financially and psychologically, and can hugely impact people’s trust in others and services they rely on.

“If you have been a victim of fraud, know that it is not your fault and it is never too late to get help. Reports of fraud should be made to your bank immediately and to Action Fraud as soon as possible, either online at actionfraud.police.uk or by calling 0300 123 2040. Charity Victim Support also provided free and confidential advice.”