The arrest of two men in Mathura over the alleged activation and sale of more than 3,000 SIM cards reveals a critical vulnerability in India’s digital identity and telecom ecosystem: personal data collected at the village level can be converted into communications infrastructure for organised cybercrime. According to Delhi Police’s Intelligence Fusion and Strategic Operations unit, the accused used fake health camps to obtain Aadhaar details and fingerprints from rural residents, activated SIM cards in their names and supplied them to cybercrime groups.The case is significant not only because of the number of SIM cards involved, but also because it shows how a fraud operation can be assembled through ordinary-looking interactions. A health camp, a promise of inexpensive medicines or an offer linked to government schemes can create the trust needed to collect identity information. That information can then be moved into a telecom process, converted into physical SIM cards and e-SIM QR codes, and sold through online networks.The police said the two arrested men, identified as Jitendra Singh and Brajesh Kumar, were residents of Fatiha in Mathura. They were arrested from Kota village under Sadar police station on the night of 20-21 October, following a technical investigation into mobile numbers and device data. The arrests followed the investigation of a digital arrest complaint registered with the IFSO, according to the report.That sequence matters. The alleged SIM racket was not discovered through a routine check at a health camp or a telecom outlet. It emerged from the investigation of a separate cyber-fraud complaint. The police traced the communication infrastructure used in the fraud, analysed mobile numbers and device data, and then reached the suspected suppliers in Mathura-Vrindavan. This suggests that the SIM supply layer may remain invisible until investigators work backwards from a victim, a transaction or a device.## The rural data collection pointThe alleged operation depended on access to rural residents who were approached outside the formal setting of a hospital or government office. The report states that the accused organised fake health camps and collected Aadhaar cards and biometric details by offering cheap medicines and invoking government schemes. The central risk is therefore not limited to the misuse of a single document. It lies in the ability to combine identity information with biometric authentication and use that combination to activate telecom connections.The report says the accused activated 20 to 30 SIM cards each day. Over a year, that activity produced more than 3,000 SIM cards, according to the police investigation. The scale indicates a repeated operating process rather than an isolated act of impersonation. Residents were approached, their details were collected, physical SIM cards were obtained, those SIMs were converted into e-SIMs, and QR codes were generated for online sale.The alleged buyers were not described as ordinary consumers. Police said the e-SIMs and QR codes were sold on platforms including Telegram, Facebook and Instagram for around Rs 2,000 per SIM. Payment was allegedly made in cryptocurrency. The report also states that the accused were in contact with foreign cybercriminals and groups. These details show how a local collection network can feed a wider digital marketplace without the eventual users ever coming into contact with the people whose identities were used.For citizens, the immediate concern is that an identity-linked telecom connection may exist without their knowledge. The report does not state how many rural residents were affected, whether all the SIMs remained active, or whether the individuals whose biometric details were collected were notified. Those unanswered questions are important because the harm can continue after the original data collection: a number registered through stolen identity details may later be used in fraud, impersonation or other offences, while the person named in the telecom record may have no practical knowledge of the activity.## From SIM activation to digital arrestThe investigation began with a complaint from a man identified as Srinivas, who told the IFSO that fraudsters kept him under “digital arrest” for two weeks by threatening legal action and a case. He allegedly lost Rs 1.64 crore through six RTGS transactions. The report links the wider SIM network to complaints amounting to around Rs 2.64 crore recorded on the National Cyber Crime Reporting Portal.The case illustrates the operational relationship between social engineering and communications infrastructure. A digital arrest scam depends on sustained contact, repeated calls and the ability to present the fraud as an official process. A large pool of SIM cards registered using other people’s identities can make it harder for victims, telecom companies and investigators to connect the caller to the person organising the crime.The police also said the SIM cards were used in digital arrest fraud and SIM box systems. A SIM box can route calls through multiple connections, making the origin of communications more difficult to trace. The supplied report does not establish the precise configuration of the system allegedly used in this case, nor does it identify all the downstream cybercriminals who purchased the connections. It does, however, establish the police’s claim that the arrested men supplied communications tools to broader cybercrime networks.The alleged use of e-SIM QR codes adds another layer. A physical SIM can be transferred into an e-SIM format, and the resulting QR code can be shared digitally. In the reported operation, this meant that the accused did not need to physically hand over every active connection to its eventual user. Online platforms could be used to market and transfer the product, while cryptocurrency could be used for payment. The physical origin of the data and the digital destination of the SIM were therefore separated.## The institutional gap exposed by the caseThe report identifies several institutions and systems that intersect in this investigation: rural residents and local health outreach, Aadhaar-linked identity information, telecom activation, digital platforms, cryptocurrency payments, the National Cyber Crime Reporting Portal and the Delhi Police’s IFSO. Each system has a different responsibility, but the alleged fraud depended on movement across all of them.The police investigation was triggered by a victim complaint rather than by the initial collection of biometric data. That distinction points to a structural challenge in cybercrime enforcement. The first visible harm may occur months after an identity detail was collected, and it may occur in another city or state. In this case, a victim’s complaint in Delhi led investigators to suspects in Mathura. The alleged supply network was local in its collection method but wider in its reach.The report does not provide details of the telecom companies involved, the number of rural camps conducted, the procedures used to authenticate the biometric information, or whether any operator or intermediary has been questioned. It also does not say whether the police have recovered the devices allegedly used to generate e-SIM QR codes, although it states that the accused frequently changed mobile phones and destroyed old devices to evade detection.Those omissions do not undermine the reported arrests, but they define what remains to be established. The arrests identify two alleged suppliers. They do not, by themselves, establish the full chain of purchasers, the extent of the affected population, the involvement of any legitimate health or telecom intermediary, or the final disposition of the cases. Those questions would require further investigation and official disclosures.## What the numbers revealThe reported numbers indicate the scale of the alleged operation. The accused were said to activate 20 to 30 SIM cards a day and more than 3,000 over a year. At a reported sale price of Rs 2,000 per SIM, 3,000 connections would represent a gross transaction value of about Rs 60 lakh if every SIM was sold at that rate. The report does not say how much the accused actually earned, whether all SIMs were sold at the same price, or how many remained active.The financial loss linked to the wider complaints was reported at approximately Rs 2.64 crore. The individual complaint cited in the report involved an alleged loss of Rs 1.64 crore through six RTGS transfers. These figures should not be conflated: the first relates to complaints linked to the suspected SIM network, while the second concerns one victim’s allegation. Together, they show the potentially high economic cost of the downstream fraud, compared with the relatively small per-SIM price reported for the supply layer.The data also shows why cybercrime networks can distribute risk. The alleged SIM suppliers handled identity collection and activation, while other groups used the connections for calls and fraud. Online platforms enabled sales, cryptocurrency enabled payment, and disposable devices allegedly helped conceal activity. Each stage could be separated from the next, making the whole network more difficult to identify through a single investigation.## The larger urban governance questionAlthough the alleged collection took place in villages in Mathura, the consequences extended into urban systems. The victim complaint was investigated in Delhi, the alleged fraud used digital banking channels, and the telecommunications infrastructure served crimes that could target people anywhere. Cybercrime therefore does not fit neatly into the boundaries of a city, district or state. Urban policing increasingly depends on tracing digital networks that begin in one place and produce harm in another.The case also raises a public-trust question around identity-linked services. Health camps and government schemes are designed to bring services closer to residents, especially in areas where formal access may be limited. When a fake service provider uses the language of welfare to collect biometric information, the damage extends beyond individual victims. It can make residents more suspicious of legitimate outreach programmes and complicate the work of institutions that depend on public cooperation.The reported arrests confirm the existence of an alleged SIM supply operation connected by police to digital arrest and other cyber fraud complaints. They do not yet establish the complete network or answer how many people’s identity details were compromised. The next stages to monitor are the police investigation into the alleged buyers and foreign links, verification of the SIMs and e-SIMs connected to the case, identification of affected residents, and any action involving telecom or platform intermediaries.
Click Here For The Original Source.
——————————————————–
