06/10/2026
πππ ππππππππππ πππ ππππ:
Unmasking the Criminal Modus Operandi
πππ ππππππππππ πππ ππππ:
Unmasking the Criminal Modus Operandi
1. Bulk Registration and Identity Exploitation
The journey begins far from the end-userβs device. Thousands of SIM cards are acquired in bulk by malicious actors or syndicate operators.
2. The Online Black Market
Once successfully registered and activated, the SIM cards enter the digital underground. They are packaged and advertised on various online marketplaces, including illicit Facebook groups, clandestine Telegram channels, and dark web forums.
3. The Text Blasting and Smishing
The initial buyer installs the SIM cards into specialized hardware known as "Text Blasting" machines. Capable of sending bulk text messages simultaneously, the SIM card is bombarded with malicious activity.
4. Downcycling to One-Time Password (OTP) Farms
After thousands of broadcasted messages, telecommunication providers flag the SIM card for suspicious spam activity, rendering its messaging capabilities largely burnt out or restricted. Instead of being discarded, the SIM enters its next phase of monetization: OTP farming.
5. Exploiting Promotions, Casinos, and E-Commerce
When the SIM card can no longer generate value through OTP sales, it is resold to low-tier cyber operators.
6. Mule Accounts and Financial Intermediaries
Now heavily flagged across standard platforms, the SIM card undergoes another resale to financial fraud syndicates. Here, it serves as the foundation for creating "mule" bank accounts and verified digital wallets.
7. The Final Stage, Vishing and Abandonment
In its final phase, the SIM card's digital reputation is entirely exhausted, and most automated services have blacklisted it. It is placed into a physical phone one last time for voice-based phishing known as "vishing."
PMGEN ANDRE P DIZON
Acting Director, Anti-Cybercrime Group