A London man who helped run a SIM-swap fraud operation that drained nearly £200,000 ($264,200) in cryptocurrency from four BT customers has been jailed for two and a half years, the City of London Police said on Thursday. The case began with unauthorized activity detected on BT's systems in 2021.

Stolen funds spent on Dubai holidays, Canary Wharf flat and gold grills

Ajay Shinjin, 25, also known as AJ Marley Cruz, pocketed more than £44,000 ($58,124) of the stolen funds, investigators said. According to police, he spent the money on holidays in Dubai, a luxury flat in Canary Wharf, and gold-plated teeth grills.

Shinjin, of Marsh Wall in Canary Wharf, pled guilty on September 28 to conspiracy to commit fraud by false representation and transferring criminal property. The sentence was passed at Inner London Crown Court.

A SIM swap is an attack in which a victim's phone number is transferred onto a SIM card controlled by a criminal. Once in control of the number, criminals can intercept the one-time passcodes that banks and crypto exchanges send by text message, using them to break into victim accounts. Because those SMS codes are a common security layer for banking and exchange logins, a successful swap can strip that protection away, and crypto transfers, once completed, are generally irreversible. US law enforcement, including the FBI, has advised consumers to protect high-value accounts with app- or hardware-based authentication rather than text-message codes.

In early November 2021, BT detected unauthorized activity on its systems after criminals transferred customer phone numbers onto SIM cards in their possession. The telecom operator traced the devices receiving those numbers — eSIM-enabled handsets, each carrying two IMEI numbers. BT's data pointed police to several suspects, and Shinjin was connected to four of the devices.

Four victims targeted in November 2021

Police identified four victims of stolen crypto in November 2021:

• The first lost about £40,000 ($52,840) on November 2, and roughly £27,000 of that was traced into Shinjin's personal crypto account.
• The second victim's entire loss of about £17,000 ($22,457), taken between November 5 and 7, was later found in Shinjin's wallet.
• A third victim had about £8,000 ($10,568) taken from a Coinbase account on November 3. Police said Shinjin facilitated that theft before the money was passed on.
• The heaviest hit fell on a fourth victim, who lost some £130,000 ($171,730) in crypto between November 6 and 7. Police said Shinjin also facilitated that theft.

Shinjin was arrested for the first time at his flat in 2021. After new evidence surfaced, police arrested him again in October 2023 as he landed at Heathrow Airport on a flight from Dubai. He made no comment in interviews.

"SIM-swap fraud is a sophisticated and increasingly concerning form of offending, and this case demonstrates the devastating consequences it can have for victims," said Detective Constable Simon Ardeman of the City of London Police. Ardeman added that the conviction demonstrates that technology-assisted fraud can be investigated and prosecuted.

The conviction came more than four years after the thefts were reported, a span that illustrates how long technology-assisted fraud cases can run from initial detection to a courtroom outcome. In May, Cryptopolitan reported that ten people in England were charged in connection with a phone scam in which callers allegedly posed as police officers and employees of a crypto company to obtain wallet seed phrases, with at least one victim losing £300,000.

Separately, the FBI and Homeland Security Investigations assisted cybercrime police in arresting four suspects in Poland on June 25. The quartet are accused of conducting SIM-swap attacks to drain cryptocurrency exchange accounts. Alongside Shinjin's sentencing, the cases show SIM-swap and phone-based fraud against crypto holders drawing enforcement attention across jurisdictions, with the ten charged in England and the four detained in Poland still at earlier stages of the legal process.