Two arrested in Britain over homemade mobile antenna used for SMS blasting

Two suspects have been arrested in the United Kingdom as part of an investigation into a criminal scheme using a “homemade mobile antenna” to send thousands of fraudulent text messages.

Huayong Xu, 32, of Alton Road, Croydon was charged on May 23 following an earlier arrest made on May 9 in Manchester, City of London Police announced on Friday.

The police said the case was believed to be the first of its kind in Britain where an illegal telephone mast was used to send phishing messages that were able to “bypass mobile phone networks’ systems” for blocking suspicious texts.

According to the police, the suspects sent thousands of messages posing as banks and other official organizations to members of the public in an attempt to trick the recipients into sharing their personal details.

These kinds of smishing messages are made possible due to long-known shortcomings in mobile communications standards, particularly the requirement for mobile devices to authenticate themselves to networks by sharing their International Mobile Subscriber Identity (IMSI) while not requiring the networks to authenticate themselves in return.

Mobile phones that connect to a fake base station can almost immediately receive a phishing text. While police described the device in this case as homemade, it is relatively simple to use consumer-grade radio equipment as a so-called IMSI-catcher, although the strength of the broadcast may be limited to the immediate vicinity.

David Vint, the head of City of London Police's payment card unit, said: “The criminals committing these types of crimes are only getting smarter, working in more complex ways to trick unknowing members of the public and steal whatever they can get their hands on. It is vital we work with partners to help prevent the public from falling victim to fraud.”

The case may be the first prosecuted in the United Kingdom, but this kind of criminal activity exploiting mobile phone technology has been widespread in East Asia for several years and appears to be expanding into Europe.

Vietnam’s Ministry of Information and Communications issued a warning last year about fake base stations following the arrests of two men using a mobile radio transceiver to similarly catch IMSI details from mobiles close by and then send out smishing messages.

Police in France discovered an IMSI-catcher being driven around Paris by a woman in December 2022 that was linked to messages encouraging Parisians to share their personal details with a fake health insurance site. The same gang has also been linked to another IMSI-catcher being driven around the city in an old ambulance.

Last year, Norway’s Police Security Service arrested a man from Malaysia who was initially suspected of espionage after an IMSI-catcher was detected being operated near several sensitive locations including the Prime Minister’s office and the Ministry of Defence. The man was sentenced to three years in prison this January.