A text message arrives claiming that HM Revenue and Customs (HMRC) owes you money. It looks like an ordinary notification: a familiar name, a short explanation and perhaps a link inviting you to take action.
You might assume it came through the mobile network you use every day.
But criminals have used equipment that imitates mobile-network infrastructure to send fraudulent messages to nearby phones. In documented cases across the UK and Europe, investigators have linked this technique to fake tax messages, delivery notifications and bogus parking fines.
In one UK investigation, police traced an operation involving a vehicle equipped to send scam texts to people involved in organising the scheme. In June 2026, a jury found Di Li guilty of offences connected to the operation, and he was sentenced to prison. A separate sentencing announcement in September 2026 revealed details from another UK investigation, including thousands of compromised payment-card details found during an examination of a suspect’s phones.
Similar techniques have featured in investigations in Norway, Switzerland and France.
These cases show how a fraud operation can involve several people performing different roles. The person operating the equipment may be visible to police, while those arranging the technology, providing instructions or coordinating the activity remain elsewhere.
They also raise an important question: if a message appears to come from a familiar organisation, how can you tell whether it is genuine?
The cases at a glance
How the investigations unfolded
Authorities in several European countries have investigated fraud involving rogue mobile-network equipment.
-
2023–24
Norway
An investigation into fraudulent messages led to a four-and-a-half-year appeal sentence in 2024.
-
2024–26
United Kingdom
A device found in a vehicle in 2024 was linked to a fraud case that ended in sentencing in August 2026.
-
2025
Switzerland
Authorities warned about suspicious text messages posing as parking fines.
-
2025–26
United Kingdom
A separate North London investigation led to the conviction and sentencing of an organiser in 2026.
-
2026
France
A report described proceedings involving people accused of using IMSI-catcher equipment to send mass phishing texts.
The North London case that exposed the operation
The UK investigation involved an SMS blaster being operated from a vehicle in North London. During the incident, officers in the area received fraudulent text messages purporting to be from HMRC.
According to City of London Police, Ruichen Xiong was driving the vehicle while the equipment was operating. He was subsequently sentenced in July 2025.
Investigators later identified Di Li as a key organiser. Police said Li arranged access to the equipment, helped obtain a vehicle and supported Xiong’s living costs. According to the police account, Xiong had accumulated gambling debts and had been told he could repay them by driving prescribed routes and operating the equipment.
The operation involved more than simply switching on a device and leaving it to run. Police said the driver was given routes and timings to follow, while Li and others coordinated testing activity remotely.
On 20 August 2025, officers searched Li’s home and recovered digital evidence, including communications between Li and Xiong concerning the deployment of the equipment. Li was arrested on 1 September 2025.
At trial, Li argued that the device was intended for advertising and described himself as a middleman. A jury at Inner London Crown Court found him guilty on 27 March 2026. On 3 June 2026, he received a 48-month prison sentence for supplying articles for use in fraud and a concurrent 24-month sentence for conspiracy to commit fraud by false representation.
These details come from the City of London Police account of the investigation and conviction.
The case shows why investigators look beyond the person physically operating the equipment. Establishing how a fraud operation works can involve connecting the people, devices, instructions and communications behind it.
A second UK case: thousands of compromised card details
A separate sentencing announcement published by City of London Police on 1 September 2026 provides another example of the technique being used in a fraud operation.
Mohammed Faiyaz Iqbal was arrested in May 2024 while sitting in a van in the Trafford Shopping Centre car park. Officers found an SMS-blaster system concealed in the rear of the vehicle, with equipment installed to transmit messages to nearby phones.
The messages impersonated legitimate organisations, including Royal Mail, and were designed to persuade recipients to provide payment and personal details.
Police said an examination of Iqbal’s mobile phones revealed 7,859 compromised payment-card details. Searches of his home uncovered additional banking material and three counterfeit UK driving licences, which police said were being used to establish impersonation bank accounts to launder criminal proceeds.
Iqbal pleaded guilty at his first hearing on 9 March 2026. He was sentenced on 28 August 2026 to three years and eight months in prison.
The findings show why a fraudulent text should not be viewed as an isolated nuisance. A message may be the first step in a wider process involving the collection of financial information and attempts to move or disguise criminal proceeds.
This case is separate from the North London operation involving Xiong and Li. The investigations took place at different times and involved different circumstances.
Read the City of London Police sentencing announcement.
What exactly is an SMS blaster?
How the scam works
A familiar text. An unfamiliar route.
A rogue mobile base station can change how a fraudulent message reaches a nearby phone.
Fake mobile mast
Equipment imitates mobile-network infrastructure.
Nearby phone
A compatible device may receive a fraudulent message.
Fake request
The message tries to steal money or personal details.
An SMS blaster is equipment designed to imitate a mobile phone base station. Depending on the equipment and network conditions, it can cause compatible nearby phones to connect to a rogue station rather than their normal mobile network.
Once devices connect, the equipment can be used to transmit fraudulent messages. Criminals can then impersonate trusted organisations and direct recipients to fake websites.
The technology changes how a message is delivered, not what the criminal ultimately wants. The aim is still to persuade someone to reveal information, visit a fraudulent website or make a payment.
Some SMS-blaster attacks exploit weaknesses associated with older mobile-network technology. However, not every phone is vulnerable in the same way, and not every suspicious text has been sent using a rogue base station.
Understand the difference
Not every scam text uses a fake mast
The delivery method can differ, but both approaches may try to steal money or personal information.
SMS blaster
Uses rogue mobile-network equipment to transmit messages to nearby compatible phones.
Conventional phishing
Uses ordinary messaging channels, fraudulent accounts or other methods to send deceptive messages.
Both may impersonate a trusted organisation and direct the recipient to a fake website or payment request.
Many scams use ordinary messaging services, compromised accounts or fraudulent access to business-messaging services. Recipients generally cannot determine how a message was delivered simply by looking at it.
This distinction matters. A suspicious text does not, by itself, prove that a phone has connected to a rogue station or been compromised. The documented cases show that the technique has been used in real fraud operations, but they do not establish how frequently it occurs compared with conventional scams.
How the cases compare
The investigations in these countries illustrate related methods of mobile-message fraud, but the equipment, circumstances and legal outcomes differ.
SMS-blaster and mobile-message fraud cases
Reported investigations across Europe, with the legal status of each case kept separate from the allegations.
| Case | Messages impersonated | What investigators reported | Legal status |
|---|---|---|---|
| United Kingdom North London | HMRC | SMS-blaster equipment was operated from a vehicle. Police later traced evidence to people involved in organising the operation. | Convictions / sentences Di Li was convicted and sentenced in 2026. Ruichen Xiong had been sentenced in 2025. |
| United Kingdom Trafford | Royal Mail and other organisations | Police found equipment concealed in a van and reported 7,859 compromised payment-card details on a suspect’s phones. | Guilty plea / sentence Mohammed Faiyaz Iqbal pleaded guilty and was sentenced in 2026. |
| Switzerland Geneva | Parking-fine services | Authorities reported suspicious fine messages and circumstances consistent with possible SMS-blaster use. Equipment was reportedly found in vehicles. | Arrests reported Three people were reported arrested. Arrest does not establish guilt or amount to a conviction. |
| Norway Oslo and Bergen | DNB, Bank Norwegian and DHL | An IMSI catcher was used in an attempted large-scale digital fraud operation involving fraudulent messages. | Appeal sentence The Court of Appeal increased the sentence to four and a half years in 2024. |
| France Paris investigation | Parcel-delivery companies and other organisations | Reporting described an investigation into devices, drivers, equipment suppliers and business links. | Trial reported In February 2026, Le Monde reported that eight people were due to face trial. That report does not mean all had been convicted. |
Legal status reflects the cited reporting at the time of publication. An allegation, arrest or pending trial is not proof of guilt.
The comparison highlights a common pattern: criminals use messages that appear relevant to everyday situations, then try to persuade recipients to visit fraudulent websites or disclose sensitive information. It does not mean every case involved identical equipment or that all suspects had the same role.
Sources for the comparison include City of London Police, Switzerland’s National Cyber Security Centre, the Geneva Public Prosecutor, Økokrim and Le Monde.
Switzerland: fake parking fines sent to people in the area
In September 2025, Switzerland’s National Cyber Security Centre warned about suspicious text messages claiming that recipients owed parking fines.
The reports came from western Switzerland. Investigators noticed that people who received the messages had recently visited locations associated with the incidents. One person also reported that their phone briefly switched from 4G to 2G before the message arrived, then returned to 4G.
The authorities said the circumstances suggested the use of SMS blasters. The messages directed recipients to fraudulent payment pages designed to collect card details or other personal information.
The scam drew on something people might reasonably expect after visiting a town or parking area: a fine. That context could make a fraudulent request seem more believable.
In a separate announcement in September 2025, Geneva’s public prosecutor reported that three people had been arrested on suspicion of involvement in sending fake parking-fine messages. Two were arrested in vehicles containing SMS-blaster equipment, while the third was described as the owner of one of the vehicles.
According to the prosecutor, the messages directed recipients to fraudulent websites imitating an official parking-fine service. The announcement also described an alleged second stage in which a fake bank adviser contacted victims and tried to obtain the codes needed to withdraw money from their accounts.
At the time of the announcement, the suspects were under investigation and were presumed innocent. The arrests should not be presented as convictions.
The case shows how a seemingly small payment request can become the starting point for a more serious attempt to steal money. If you receive an unexpected fine, check it directly with the relevant authority rather than following the link in the message.
Sources: Switzerland’s National Cyber Security Centre warning and Geneva Public Prosecutor’s announcement.
Norway: a large-scale attempt to steal financial information
In October 2023, Norway’s National Authority for Investigation and Prosecution of Economic and Environmental Crime, known as Økokrim, warned about a case involving an IMSI catcher used to send fraudulent text messages.
The messages impersonated organisations including DNB, Bank Norwegian and DHL. Recipients were directed to fake websites requesting financial information.
In March 2024, Norway’s Borgarting Court of Appeal increased the sentence in the case to four and a half years in prison for attempted digital fraud.
Økokrim’s reporting described an attempt to target approximately 244,000 people in Oslo and Bergen. That figure should not be confused with the number of people who lost money. Reporting on the case said information belonging to 103 people had been obtained. Banks stopped most of the attempted payments described in the case, although some transactions went through.
The case provides a useful comparison, but the terminology matters. An IMSI catcher and an SMS blaster can both involve the imitation of mobile-network infrastructure, but the terms should not be used as though they always describe identical devices or capabilities.
The wider lesson is that criminals do not necessarily need to break into someone’s phone to target their finances. They may instead try to deliver a convincing message and lead the recipient to a fraudulent website.
Sources: Økokrim’s original warning and its account of the appeal sentence.
France: an investigation into the people behind the equipment
A French investigation reported by Le Monde in February 2026 offers another perspective on how the supply and use of these devices can involve several people and businesses.
The investigation followed complaints from mobile operator Orange after customers reported fraudulent messages that did not appear to have passed through the operator’s usual network systems. In late 2022, police arrested a driver and seized an IMSI catcher from a vehicle.
According to Le Monde, investigators examined links between drivers, people renting equipment, business operators and a supplier. The messages included attempts to impersonate a parcel-delivery company and other organisations. The investigation also examined claims that the equipment had been marketed as a way to send large volumes of messages.
The reporting described three devices seized during the investigation and outlined how people with different roles allegedly became involved. Some defendants argued that they believed the equipment was intended for legitimate marketing or that they had been misled about its use.
The legal status of the defendants is important. When Le Monde published its report on 13 February 2026, eight people were due to face trial in Paris. The report also described separate defendants who had already received suspended sentences and fines through plea-bargain proceedings. The ongoing proceedings should not be presented as though every accused person had been convicted.
This investigation highlights another part of the problem: the people sending messages may be only one part of a wider chain. Investigators may need to establish who supplied the equipment, who paid for it, who operated it and who was responsible for the websites or the collection of financial information.
Source: Le Monde’s report on the French case.
Why these messages can look genuine
Know the warning signs
What makes a scam text convincing?
Your account requires attention. Follow the link below to avoid a penalty.
example.invalid/paymentFictional example. This is not a real message from a bank or government department.
Unexpected pressureIt pushes you to act before you have checked the claim.
A link to followIt sends you to a page where you may be asked for money or personal details.
A familiar nameThe sender’s displayed name is not proof that the message is genuine.
The fraud relies on a familiar human reaction: trust.
A message might mention a tax refund, a parcel delivery, an account problem or a payment that supposedly needs attention. It may use a familiar organisation’s name and language designed to make the request seem routine.
Recipients are not expected to understand mobile-network technology. They are being encouraged to act before taking the time to verify the message.
A convincing sender name is not proof of identity. The name displayed on a screen does not, by itself, establish who sent the message or whether the request is genuine.
The same principle applies to conventional phishing texts. Even when no unusual equipment is involved, a fraudulent message can lead someone to a fake login page, where passwords, payment-card details or account credentials may be collected.
The delivery method may differ, but the criminal’s objective is familiar: to get the recipient to trust the message and take an action that benefits the scammer.
The wider problem is bigger than one device
The UK and European cases form part of a wider problem: criminals use mobile messages to reach people and direct them towards fraudulent payments or websites.
Ofcom reported in July 2026 that four in ten UK mobile users surveyed had received at least one suspicious message in the previous three months. It also cited £1.28 billion in losses to criminals from fraud in 2025.
That £1.28 billion figure relates to fraud overall. It is not a measure of money stolen through SMS blasters.
Ofcom also estimated that mobile providers were blocking more than 600 million scam messages a year. Despite those efforts, the regulator concluded that stronger and more consistent protections were needed.
In July 2026, Ofcom finalised new rules and guidance intended to strengthen how mobile providers and business-messaging services identify and disrupt scam messages. The measures include checks on organisations sending business messages, action against fake sender names, the blocking of malicious links and numbers, and volume limits for pay-as-you-go SIM cards.
These measures may help prevent some scams, but they cannot guarantee that every fraudulent message will be stopped. The cases described here also show why enforcement cannot depend solely on blocking messages. Investigators may need to identify the people supplying and coordinating the equipment behind an operation.
Read Ofcom’s announcement and explanation of the new measures.
How to protect yourself from a suspicious text
You do not need to identify the equipment behind a message to protect yourself. The safest approach is to verify unexpected requests independently and avoid opening links or files you do not trust.
Your quick safety guide
Received a suspicious text?
Pause before responding. Follow these seven steps to reduce the risk.
-
1
Stop and pause
Do not respond or act under pressure from an unexpected message.
-
2
Avoid links and QR codes
Do not follow unexpected payment, delivery or refund links.
-
3
Verify independently
Open the official app or type the organisation’s known website address yourself.
-
4
Be careful with attachments
Do not open unexpected files. Keep your phone and apps updated.
-
5
Protect your details
Never enter passwords, card details or banking codes on an unverified page.
-
6
Report the message
In the UK, forward suspicious SMS messages to 7726.
-
7
Act quickly if affected
Contact your bank if you shared financial information or authorised a payment.
Remember: a familiar sender name does not prove that a message is genuine.
1. Do not follow an unexpected link
If a message claims you owe money, have a parcel waiting or are entitled to a refund, do not use the link provided. Open the organisation’s official website or app yourself and check whether the request appears there.
For example, if a text claims that a parcel is being held until you pay a fee, visit the delivery company’s official website by entering its address yourself. Do not rely on the link or phone number supplied in the message.
2. Check the message against official guidance
HMRC publishes guidance to help people distinguish genuine communications from scams. HMRC may send genuine text messages, but it says a refund-related text will not include a link to claim a refund or ask for personal or financial information.
Check the current HMRC guidance on suspicious messages rather than relying on a sender name or the message’s appearance.
3. Do not let urgency make the decision for you
A message that threatens a penalty, claims your account will be closed or promises an unexpected payment may be designed to influence your behaviour. Pause before acting and check the claim using contact details obtained independently.
A genuine deadline may exist in some situations, but a message alone is not enough to establish that a demand is real.
4. Be careful with PDFs, images and other attachments
Scam messages do not always contain a web link. They may ask you to open a PDF, image or other file, or direct you to download an attachment.
A file is not automatically malicious simply because it arrives unexpectedly. However, attachments can be used to distribute malware, direct people to fraudulent websites or exploit weaknesses in outdated apps and software. Images and PDFs can also contain links or QR codes that lead to fake payment or login pages.
To reduce the risk:
- Do not open unexpected attachments from unknown or unverified senders.
- Be cautious if a message pressures you to download a file to claim a refund, pay a fine or resolve an account problem.
- Do not scan a QR code in a suspicious message or document without checking where it leads.
- Keep your phone, operating system, browser and PDF reader updated.
- If you need to check a document, contact the supposed sender through an official channel and ask whether they sent it.
Do not assume that a file is safe because it is labelled “PDF”, looks like an ordinary image or displays a familiar logo. Equally, simply receiving a file does not prove that your device has been compromised.
The UK government’s guidance on avoiding and reporting phishing advises people not to download attachments or click links when they are unsure that a message is genuine.
5. Never enter banking information on a website reached through a suspicious message
If a page asks for card details, banking credentials or personal information to release a supposed refund or resolve an unexpected problem, stop. Visit the organisation’s official website separately.
Look carefully at the web address, but remember that a professional-looking page or familiar logo does not prove that a website is genuine.
Never share a one-time passcode or banking authorisation code with someone who contacts you unexpectedly. If a supposed bank adviser asks you to disclose a code or approve a transaction, end the conversation and contact your bank using its official details.
6. Report suspicious messages
In the UK, you can forward suspicious text messages to 7726 free of charge. Your mobile provider can investigate the report and may block the sender or take other action.
If the message arrives through WhatsApp or another messaging app, use that app’s reporting and blocking features as well.
See Report Fraud’s guidance on reporting suspicious activity and the government’s phishing-reporting guidance.
7. If you have already responded, act quickly
If you may have been scammed
What should you do next?
Your next step depends on what happened. Act promptly, but do not panic.
You opened a link
Close the page. If you did not enter information, download a file or approve anything, opening the link alone does not prove your device has been compromised. Do not revisit the link.
You entered a password or personal details
Change the affected password through the genuine website or app. Change it anywhere else you reused it, and enable multifactor authentication where available.
You shared card or banking details
Contact your bank immediately using its official app, website or the number on your card. Follow its advice about blocking your card, securing your account or disputing transactions.
You authorised a payment or shared a banking code
Contact your bank immediately and explain exactly what you approved or disclosed. Do not assume that an authorised payment can no longer be challenged.
You downloaded or opened an attachment
Do not open it again or install anything it recommends. If you suspect malicious activity, use reputable security software and seek trusted technical assistance. Keep the device’s software updated.
You lost money or suspect identity theft
Report the incident through the appropriate official reporting service. Keep the message, website address, transaction records and other relevant evidence if safe to do so.
Do not use telephone numbers or links supplied in the suspicious message. Contact your bank or the organisation through an independently verified channel.
If you entered card details or banking information, contact your bank using its official contact details. If you reused a password, change it on the genuine service and on any other account where you used the same password.
If you downloaded an unexpected attachment, do not open it again. If you suspect it may have installed something malicious, avoid entering passwords or banking details on the affected device until you have checked it with reputable security software or obtained trusted technical assistance.
If you authorised a payment or lost money, report it through the appropriate fraud-reporting service. Do not assume that deleting the message resolves the problem if you have already shared information.
What these cases really tell us
The most revealing part of these investigations is not simply that criminals have found another way to send text messages. It is how the operations can be organised.
The UK cases show equipment being used from vehicles, fraudulent messages impersonating recognised organisations and investigators tracing evidence beyond the person operating the device. The Swiss reports describe fake parking-fine messages and circumstances consistent with SMS-blaster use. Norway provides an example of an attempted large-scale fraud, while the French investigation highlights alleged links between equipment suppliers, businesses and drivers.
The cases are not identical, and they do not prove that every scam text is generated by a rogue base station. They do show that authorities in several European countries have investigated the use of mobile-network equipment in fraud operations.
For readers, the most useful lesson is straightforward: a familiar-looking message is not proof that the sender is genuine.
Verify unexpected requests independently, be cautious with links and attachments, and report suspicious messages. You do not need to understand the technology behind a scam to take steps that make it harder for criminals to deceive you.
Community discussion
Join the conversation
0 comments
Be the first to join in
There are no comments yet. Sign in to start a thoughtful discussion.
Sign in to comment
Join the conversation with your Secritic account. Comments are available to signed-in readers.