India busts transnational SIM Farm Network with 320 SIMs in Karnataka; 4 Arrested for e-SIM Supply

Karnataka's Cyber Command Unit has dismantled an illegal SIM box network that ran from two apartments in the Whitefield area of Bengaluru, India's technology capital.

Police seized ten SIM box (GSM gateway) devices with a combined capacity of 320 SIM connections and arrested four people in Tiroda, Maharashtra, who are accused of supplying SIM cards and converting them into e-SIM profiles for the operation.

The unit announced the bust in a press note dated 22 October 2026, signed by Dr. Pronab Mohanty, IPS, Director General of Police, Cyber Command.

Investigators say the network is suspected to be linked to "digital arrest" scams, sextortion and other financial cyber fraud across India.

Preliminary leads point to possible financial exposure "potentially running into hundreds of crores of rupees across the wider network" (one crore is 10 million rupees).

The police say this figure is not yet verified.

Key Numbers

• Sites raided: 2 apartments, one at Kadugodi and one at Pattandur Agrahara, both within the limits of the Cyber Crime Police Station (CCPS), Whitefield Division
• SIM box (GSM gateway) devices seized: 10 in total
• Kadugodi: 6 SIM box devices with 32 SIM slots each, or 192 slots, configured with e-SIM provisioned connections from several telecom service providers
• Pattandur Agrahara: 4 SIM box devices with 32 SIM slots each, or 128 slots
• Combined capacity: 320 SIM connections
• Accused arrested so far: 4, all from Tiroda in Gondia District, Maharashtra
• Case reference: Crime No. 286/2026, registered at CCPS Whitefield on 26 August 2026
• Time from FIR to public disclosure: about eight weeks (26 August to 22 October 2026)
• Suspected financial exposure: "potentially running into hundreds of crores of rupees" across the wider network (preliminary and unverified)
• Number of victims and confirmed losses: not stated; the police say these "remain subject to verification"

How the Case Began

The case began with a complaint from the Chief Circle Nodal Officer of Bharti Airtel Limited, Bengaluru, one of India's largest mobile operators.

The complaint concerned the suspected unauthorised use of Airtel SIM cards in a SIM box setup operating in the Whitefield and Kadugodi areas.

On that basis, CCPS Whitefield registered Crime No. 286/2026 on 26 August 2026 and opened a detailed investigation.

The raids were carried out as a special operation with the Department of Telecommunications (DoT), Karnataka, the regional unit of India's federal telecom regulator.

What Police Found

The investigation found two SIM box installations in separate apartments.

According to the press note, both facilities "were set up and run by the same network of accused".

The press note includes two photographs of the seized equipment.

They show multi-antenna rack-mounted SIM gateways set up in residential rooms, along with Wi-Fi routers, network cables, power strips, and what appear to be two small dome-type cameras.

The note does not list these accessories or give their numbers, so this description is based on the photographs only.

The police say the seized items are being examined "to establish their precise operational role and their links to the suspected offenders."

The e-SIM Supply Chain and the Maharashtra Arrests

Investigators then followed leads to Tiroda, a town in Gondia District in eastern Maharashtra, about 1,000 km from Bengaluru.

The leads concerned the alleged sale of SIM cards and their conversion into e-SIM profiles for use in the network.

Four people have been arrested so far. It identifies them only as residents of Tiroda, Gondia District, Maharashtra.

Police allege that they were involved in the e-SIM supply chain and that the arrests help trace "the procurement, provisioning and facilitation of e-SIM resources allegedly used in the suspected cybercrime operation."

The e-SIM angle is significant - An e-SIM is a digital SIM profile downloaded onto a device rather than a physical card.

At Kadugodi, the 192 slots were configured with e-SIM provisioned connections, which suggests the operators did not depend only on physical SIM cards bought over the counter.

That remains under investigation.

How a SIM Box Operation Typically Works

A SIM box, also called a GSM gateway, is a device that holds dozens of SIM cards and connects them to the internet. These international calls will appear as calls with local/national CLI."

CLI is caller line identification, the number shown on the recipient's phone.

In practice, a call that starts overseas, for example from a scam call centre, reaches the victim looking like an ordinary local mobile call.

This makes impersonation of police, customs or regulators more convincing, and it bypasses licensed international gateways and the filters that flag international calls.

The note says only that the devices are "suspected to have formed part of a organized telecommunications setup used to facilitate fraudulent communications and related cybercrime activities."

The Link to "Digital Arrest" and Sextortion

Police say the operation shows "indications of a more extensive cybercrime network, with suspected links to digital-arrest scams, sextortion and other forms of financial cyber fraud."

A "digital arrest" scam is a fraud widespread in India in which callers pose as police, customs, central investigators or judges.

They tell victims that they are implicated in a crime and keep them under video-call "surveillance" until they transfer money to "verify" their funds.

Sextortion involves threats to release intimate images or video unless money is paid.

Both scams depend on calls that look local and believable, which SIM boxes can provide.

The press note does not link any specific complaint, victim or amount to the Whitefield equipment.

The police say "the actual number of victims, financial losses and extent of the network remain subject to verification through continuing investigation and inter-agency coordination."

The Legal Framework in India

India replaced its colonial-era telegraph laws with the Telecommunications Act, 2023, which contains provisions aimed directly at SIM box operations.

Under Section 42(3) of the Act, the following are offences:

• Section 42(3)(c): tampering with telecommunication identifiers
• Section 42(3)(d): possessing radio equipment, without authorisation or exemption, that can hold more than a specified number of SIM cards
• Section 42(3)(e): obtaining SIM cards or other telecommunication identifiers through fraud, cheating or personation
• Section 42(3)(f): wilfully possessing radio equipment while knowing it uses unauthorised or tampered telecommunication identifiers

These offences carry up to three years' imprisonment, a fine of up to ₹50 lakh (5 million rupees), or both.

Under Section 42(7) they are cognisable and non-bailable, and under Section 42(6) anyone who abets such an offence faces the same punishment.

DoT set out these provisions in a March 2025 advisory on misuse of telecom resources.

That advisory also noted that point-of-sale agents who help procure SIM cards fraudulently may be treated as abettors.

Separately, the Telecommunications (Telecom Cyber Security) Rules, 2024 were notified on 21 November 2024 under Section 22 of the Act.

They require telecom entities to report security incidents and allow telecom identifiers to be suspended or disconnected for cyber security reasons.

Why SIM Farms Matter Globally

SIM farms are not unique to India. The Bengaluru case is much smaller, with 320 SIM connections, but it shows a broader trend.

SIM boxes have long been tied to revenue fraud, and they are now part of the infrastructure of organised scams.

They let overseas call centres pose as local callers, help get around controls on international calls, and spread activity across many identities so that blocking individual numbers has little effect.

The e-SIM supply chain uncovered here adds a further concern for regulators everywhere.

If SIM profiles can be bought and moved remotely, controls focused on physical SIM cards at the point of sale may not be enough.

Know-your-customer checks need to extend to e-SIM issuance, conversion and re-provisioning.

For other countries, the lessons from this case are:

• Operator detection matters. This case started with a complaint from the operator's own nodal officer, not from a victim.
• Follow the SIM supply chain, not just the hardware. The arrests came from tracing where the SIM and e-SIM profiles came from, about 1,000 km away from the gateways.
• Treat high-density SIM equipment as a regulated item. India's 2023 Act makes possessing unauthorised multi-SIM radio equipment an offence in itself.

What Happens Next

The Cyber Command Unit says further investigation is underway to establish each person's role, identify anyone else involved, and determine possible links between the SIM and e-SIM supply chain and suspected digital-arrest, sextortion and financial cyber fraud.

The police say the scale of victim losses and the full size of the network are still being verified.

Financial cyber fraud can be reported on the National Cyber Crime Reporting Portal, cybercrime.gov.in, or by calling the helpline 1930.