10 suspects arrested in SIM swap scam, Toronto police say

Toronto police say 10 people are facing charges in connection with a major SIM swap fraud that allowed suspects to gain access to the cell phone and bank accounts of unsuspecting victims.

Police said 108 charges have been laid in connection with the case, dubbed Project Disrupt. 

Some of the charges the suspects face include fraud over $5,000, impersonation with intent, intercepting private communications, and possessing identity information for a fraudulent purpose.

Speaking at a news conference at Toronto police headquarters on Thursday, Det. David Coffey told reporters that the investigation was launched in June 2023 after police received reports of compromised accounts from multiple telecom companies.

Coffey explained that a SIM swap scam is a type of “account takeover” fraud that exploits a weakness in two-factor authentication.

“In this scheme, individuals compromise an unsuspecting victim’s cellphone by switching the SIM card associated with the account either by impersonating the customer at a cell phone store or otherwise gaining access to the account,” Coffey said.

“Once they have access, they can receive any emails or texts related to password recovery or changes and thus access and compromise any other accounts associated with the victim, such as online banking and social media accounts.”

He said in some cases, suspects were able to gain access to accounts using various “phishing techniques.”

Police allege that the suspects used “convincing” fraudulent identification that allowed them to impersonate victims at both cellphone stores and financial institutions.

In total, Coffey said, more than 400 pieces of fraudulent identification were seized as part of the investigation.

Police said through the investigation, officers discovered that more than 1,500 cellular accounts throughout Canada were compromised.

He said the total loss to victims, financial institutions, and telecom companies is believed to be more than $1 million.

Two female suspects, identified as Hervine Umutijima, 26, and Nadia Campitelli, 47, are still outstanding, police said. Two suspects still wanted by police in connection with Project Disrupt are shown. They are Nadia Campitelli (left) and Hervine Umutijima (right).

Nadia Campitelli (left) and Hervine Umutijima (right).

Det. Const. Michael Gow said Thursday that police believe the suspects used open-source data online to investigate their targets ahead of time.

“If people are sharing a lot of information about themselves online, that is all open source. What the bad guys are doing is we are finding they are doing their own open-source intelligence into their targets beforehand,” he said.

“They are looking at their targets, almost cyberstalking them beforehand, and then once they have enough information, then they will execute.”

Gow said often times victims are unaware that a SIM swap has occurred until after money goes missing from their bank accounts.

“From the victim’s perspective, all they see is SOS on the top right hand corner of their phone,” Gow said.

“Many of these go unreported just because strictly speaking when the victims see what happens they just see a fraud happening to their bank account. They don’t actually see that a SIM swap occurred.”

He said the victim may notice a temporary outage on their phone, but the SIM is switched back after the other accounts have been compromised.

“They’ve lost funds from the bank accounts, they’ve lost cryptocurrency from their crypto accounts, they’ve lost access to their social media, and they don’t know why.”