Project Disrupt: SIM Swap Ring Arrests in Toronto

Your phone number is not just a way to be reached. It is a key that opens your bank, your email and your social media. This Toronto investigation shows what happens when someone else holds it.

By Siddharth ShankarUpdated October 12, 2026

A SIM swap sounds technical, but the idea is simple. A criminal convinces a phone company that they are you, and the company moves your number to a SIM card the criminal controls. From that moment, the calls and text messages meant for you arrive on their phone.

What happened

CBC reported that Toronto police, under an investigation called Project Disrupt, arrested 10 people and laid 108 charges. The charges included fraud over $5,000, intercepting private communications and possessing identity information for a fraudulent purpose. Two suspects remained at large.

Police said the investigation began in June 2023. They said the activity compromised more than 1,500 cellular accounts across Canada and caused combined losses of more than $1 million to victims, telecommunications companies and financial institutions. Officers recovered more than 400 fraudulent identification documents.

How it worked

According to the report, the criminals used fraudulent identification to persuade telecommunications companies that they were the account holders. They then had victims' numbers moved to SIM cards in their possession. In some cases they gained access through phishing links, which are messages that trick a person into entering details on a fake page.

The reason this matters is two-step authentication by text message. Many banks, email providers and social networks send a six-digit code to your phone number when you sign in or reset a password. Whoever receives that text can complete the sign-in.

What was exposed

The thing taken over was control of the phone number. With it, the report says, criminals could receive authentication texts and reach banking, email and social media accounts. The report does not describe the specific data held in those accounts, and we do not guess.

The more than 400 fraudulent IDs recovered by police suggest identity documents were being produced or collected in volume, but the report does not explain where the underlying identity information came from.

How it ended

This case is unfinished in the sources we reviewed. Arrests and charges are the end of the investigative stage, not the end of the court process. Police announced the charges at a news conference on August 1, 2024, according to Global News. We found no document confirming convictions.

What the charges do show is that police and telecommunications companies can trace this activity. For victims, recovery usually means regaining the number, changing every password that used it and checking each affected account.

Key facts at a glance

• People arrested: 10, with two more suspects at large
• Charges laid: 108
• Accounts compromised: more than 1,500 cellular accounts
• Reported losses: more than $1 million across victims, carriers and financial institutions
• Fraudulent IDs recovered: more than 400
• Status: charges only, according to the sources we reviewed

How to protect your number

What the report does not say

The CBC report does not say how the criminals chose their targets or whether the telecommunications companies have changed their checks. It also does not say whether the accused have been convicted. For a SIM swap case that did end in a sentence, see the Massachusetts case.

Related reading that helps with cases like this: what to do if your phone number was in a breach, what an exposed phone number means and how scammers find your phone number and email. You can also try our free phone number exposure check.