Hacker News Reader

Comment by orf | Hacker News Reader

> SIM farms are devices that can house hundreds of SIM cards, which can send out thousands of scam texts to defraud the UK public of millions of pounds. In addition to sending scam texts, these devices are used by criminals to run scam call campaigns and to post misleading, false or phishing messages on social media in bulk.

> Whilst there are some potentially legitimate uses of the technology, these are limited and should not require using more than four SIM cards, based on the number of mobile operators in the UK. We have very limited evidence that there are any legitimate use cases for devices that allow the use of more than four SIM cards, and for all such cases alternative options exist.

The justification seems sound. What is the issue here?

View on HN

They propose a total ban that does not require fraudulent intent to criminalize possession, an unlimited fine, and ignore that most of the use is just bypassing rentseeking A2P SMS charges? Along with the fact that it’s unclear who is even asking for it. UK similarly banned GSM gateways in the early 2000s but recent court rulings said the way it was banned was illegal and is in the appeals process.

Most of the use case is spamming people. There are very few other uses for something like this[1].

A2P is also a US specific thing?

1. https://m.aliexpress.com/item/1005004866582019.html?spm=a2g0...

Sites like smspva.com would have dozens of those devices, should they be illegal? I can think of uses of these devices, yes most of them are “grey market” but they don’t involve stealing from people.

By “A2P fees” I’m referring to the fact that in most countries it costs more to send an SMS with Twilio than a 5000 message or unlimited message retail plan. I won’t deny that some SIM farms are used for scams but if you look at the countries that have banned them the reasoning is not because of fraud it’s because they have a monopoly phone provider and people effectively use these devices to convert international calls or SMS like verification code messages to domestic so that they don’t have to pay higher termination fees which costs the carrier some profits. They can also make tracing calls harder which is why India bans them. But given that there is VOIP I don’t see why banning this would prevent any fraud.

> Sites like smspva.com would have dozens of those devices, should they be illegal?

Your argument is that since this clearly sketchy service ran from Hong Kong that is dedicated to giving people the ability to automate signups on sites/apps and “earn money using our service” utilizes dozens of these devices, these devices are OK?

Plenty of civic minded people find services like these useful for registering Signal accounts not tied to their own number. Or for scraping sites like LinkedIn. There are companies like this run from other countries if you don’t trust Hong Kong. I don’t think arguing that some unknowable fraction of fraud traffic flows through these devices is persuasive when the legislative conversation in the countries that banned these devices is almost entirely about carriers losing some termination fees and national security fears.

I mean it literally advertises itself as a service that enables people to make money by bypassing restrictions that require phone numbers.

You might not make money using it and instead just use it to sign up for a single signal account, but you’re not really the target audience in that case.

The people making money from it wouldn’t exist without people buying the verification codes. If you Google smspva or services like it and read forum posts about it the majority of discussion is about people using it to automate account registration.

Yes, hello?? They often use those registered accounts for malicious purposes which generates income for them?

Sorry, I misread your previous comment. The site doesn’t advertise itself as a way to make money, its just incidental to how some people make money. Is scraping a malicious purpose? Maybe in some cases. Either way I don’t see why this use of sim boxes shouldn’t be a civil dispute between companies and needs to be something the government should criminalize. Fraud is already illegal.

> The smspva website has been operating since 2013. During this time, we have gathered a large audience of users who trust us and earn money using our service

And the use case they showcase involves mass creating Facebook pages. Come on. Are you really truly that naive?

It’s vaguely legitimate business that just happens to offer a service that’s super useful to a particular type of clientele. Just like bulletproof hosting.

Is that supposed to always be bad? Unless the pages are used to promote some kind of fraud I don't think that's illegal. It's "dual use" like any other kind of anonymity technology. Cloudflare says 90% of Tor traffic is malicious - does that mean hosting relays and using Tor should be criminalized?

Regardless, that was just a minor point about one potential use of SIM farms. The proposal says they intend to make possession a criminal offence and they don't even have data on whether these devices are used for fraud at scale in the UK.

If you go around selling micro sized mobile phones close to a prison then you can plead all you want that it’s not fraudulent, it’s just for people with tiny hands and it’s ridiculous to imply that it’s anything other than a legitimate business.

However, it’s not. It’s got one clear use case and one clear market.

We started this discussion on sim farms and your very first point here (and in other places in this post) linked directly to the kind of thing that should, and hopefully will, be criminalised in the UK.

Because it’s quite obvious what it really is, even if you apparently can’t see it?

I find that quite hilarious.

how is scraping related to sim farms?

Scraping services that require phone verified accounts but reject VOIP numbers. Someone (in house or a service like smspva) operating SIM farm would be required in order to do this economically.

that's the first time I heard about creating fake verified accounts to scrape. I wonder how profitable that is compared to the obvious malicious use cases like astroturfing/spamming

In the UK we can still get anonymous SIM cards for cash, if you want an anonymous Signal account.

Having recently looked at commercial SMS gateway pricing, I am inclined to the argument that these devices have a role in thwarting rent-seeking on the part of telcos.

Something like that provides for programatic sms and maybe voice calling. Most likely, using consumer market sims, so tarriff arbitrage is likely a large component.

You might use something like this to do bulk SMS, which could be spam or could be phone number confirmations (like it or not, it's a common activity). If voice works, it could be a backup outbound connection for an office PBX (although, unless you had fancy SIMs, you are going to get the sim's phone number as caller id which is undesirable).

Many countries have been making a2p messaging harder and harder; using a sim farm is a tempting way to opt-out of official restrictions, although it seems like a lot more operational work.

This is a backdoor way they are trying to introduce mandatory SIM registration.

Govt id is required to purchase a sim card in many EU countries. If the UK Govt decided to implement such a policy based on something like 'security' there wouldn't be a lot of push-back.

Let's overlook the fact that such policies just make stolen id a lot more valuable than it is already.

I'm all for it continuing, but it always struck me as wild how you can just pick a UK SIM up at the airport from a vending machine. I don't know of many countries where this is possible.

I've found that policy trivial to circumvent in most EU countries I've visited (which is most of them).

Its also a stupid fucking policy.

Reply on news.ycombinator.com