Need a hand in getting some extra likes? A dollar gets you a dozen fake and 'verified' accounts on Facebook posting on your behalf, according to new research into the large international grey market in SIM mobile phone cards. — Peter Kneffel/dpa
LONDON: A massive international grey market in mobile phone SIM cards is fuelling large-scale manipulation and fraud online, a University of Cambridge study has found.
The researchers say physical and virtual SIMs from providers like SMSActivate, 5Sim, SMShub and SMSPVA are being used to verify fake accounts on social media platforms and e-commerce services.
"We find a thriving underground market through which inauthentic content, artificial popularity and political influence campaigns are readily and openly for sale," said Jon Roozenbeek, the study’s co-leader.
Many online platforms require SMS verification when a new account is created, a security measure intended to confirm authenticity and curb the mass creation of fake profiles.
In principle, the check is meant to ensure a human is setting up an account at a service like WhatsApp, Telegram, Facebook, X, Shopify or Amazon.
With grey-market SIMs, however, shady organisations are allowing armies of online bots to be verified so they can masquerade as humans.
Criminals and opaque political actors then use these fake accounts to make their online presence look larger than it is, inflating metrics such as likes, followers and shares to make accounts appear more popular.
Grey-market SIMs are also used to create accounts that post rage bait and provocative content designed to trigger strong reactions and comments. Illicit campaigns like these are often mounted to manufacture trends intended to influence voters and social media users.
WhatsApp and Telegram confirmations most expensive
The Cambridge team found that prices for fake SIM verifications vary widely by application and the purported origin country of the SIM. WhatsApp was the most expensive at an average of US$1.02 (RM4.17) per verification, followed by Telegram at US$0.89 (RM3.64).
Verifications for platforms where users’ phone numbers are not visible, unlike WhatsApp and Telegram, are cheaper. Facebook, Grindr and Shopify averaged US$0.08 (33sen) per verification. X and Instagram were US$0.10 (41sen), TikTok and LinkedIn US$0.11 (45sen), and Amazon US$0.12 (49sen).
To shed light on the trade, the researchers developed the Cambridge Online Trust and Safety Index (COTSI), which tracks daily prices for SMS verifications for 197 countries and more than 500 platforms.
Bot prices rise before national elections
Using COTSI data, available free at cotsi.org, the researchers examined whether and how the market responds to political events.
Analysing price data for eight platforms (Google/YouTube/Gmail, Facebook, Instagram, Twitter/X, WhatsApp, TikTok, LinkedIn and Telegram) ahead of 61 national elections, they found SMS verification prices for Telegram and WhatsApp rise noticeably in the 30 days before a national vote.
Telegram verifications increased by an average of 12% and WhatsApp by 15%. Prices for the other six platforms remained stable.
Costs also depend on SIM origin country. Verifications using SIMs from Japan averaged US$4.93 (RM20.16), followed by Australia at US$3.24 (RM13.25), Turkey at US$2.54 (RM10.39) and Malta at US$2.18 (RM8.92).
Cheaper sources included the United States at US$0.26 (RM1.06), Britain at US$0.10 (41sen) and Russia at US$0.08 (33sen) per verification. Germany sat in the middle at an average of US$0.63 (RM2.58).
Curb mass SIM procurement?
The study calls for debate on whether mass acquisition and use of SIM cards should be made more difficult. It notes that since April in Britain the operation of so-called SIM farms without a legitimate reason has been banned.
These devices can hold dozens to hundreds of SIMs at once, enabling mass SMS sending, rapid number switching and large-scale verification to create many online accounts or blast out phishing messages.
The Cambridge team also urged platforms to make the origin country of the SIM used in verification more transparent.
At services such as Google/YouTube/Gmail, Facebook, Instagram, Twitter/X, TikTok and LinkedIn, the country where an account is registered is generally not visible to other users, whereas for messaging apps it is easy to see where an account originates. – dpa
