Gujarat Police said they dismantled a SIM-box operation in Surat that blasted SMS links to spoofed income-tax refund pages, according to a statement released Saturday. Investigators attributed the network to four people detained for questioning and said officers seized hardware used to rotate thousands of mobile numbers through bulk messaging gateways.
How the spoof chain worked
According to police, victims received texts claiming a ₹18,420 refund was pending and were told to verify bank details on a site that mimicked the Income Tax Department’s e-filing portal. The URLs used Punycode domains designed to look like legitimate government hosts on small phone screens. Once card or UPI details were entered, money moved through mule accounts within minutes. Officers said the SIM boxes let the gang swap outbound numbers faster than telecom fraud filters could block them.
CERT-In had flagged a surge in similar hostnames last week; Gujarat’s cyber cell said it coordinated with the Income Tax Department’s reporting desk to take down 37 active domains before Saturday’s raid. Tax officials reiterated that refunds never require OTP sharing on third-party pages.
Equipment seized
Police displayed racks of GSM gateways, high-gain antennas, and laptop logging tools allegedly used to test message deliverability across carriers. Investigators said the setup could push more than 12,000 texts per hour when all channels were live. Officers did not release the exact street location, citing an ongoing probe into suppliers who sold the hardware without know-your-customer checks.
What taxpayers should do
Filers should log in only through the official incometax.gov.in address typed manually or via the government’s mobile app. Report suspicious texts to the national cybercrime helpline and forward the message to your carrier’s spam short code. Banks are required to hold suspicious UPI credits for review when merchants match known phishing patterns; if you already entered details, call your issuer’s fraud desk immediately and file a police complaint number for chargeback documentation.
Broader enforcement
The Home Ministry’s cyber cell has asked states to audit SIM sellers ahead of the final ITR filing rush. Telecom operators must re-verify bulk connections every ninety days under rules tightened after last year’s wallet-binding phishing wave. Gujarat police said Saturday’s operation is one of eight similar enforcement actions planned this month along the Mumbai–Ahmedabad industrial belt, where refund lures spike when salaried employees receive Form 16 copies.
Carrier cooperation
Major telecom operators said they blocked the seized SIM batches within hours of receiving police hashes. Industry groups urged handset makers to display government sender IDs more prominently in SMS threads, a UI change still rolling out on older Android builds.