The "CBI Officer" Was Calling From Saidapet: Inside the SIM Box Racket Behind India's Digital Arrest Scams

On Wednesday, 11 November 2026, officers of the Tamil Nadu Cyber Crime Wing and the Department of Telecommunications walked into the offices of a debt-collection firm in a commercial complex in Saidapet, Chennai. The company, Forte Management Services, describes itself as a vendor that recovers bad loans for major banks in south India. In its premises the team found 18 SIM boxes, 182 SIM cards, two servers and two CPUs, wired into an amplifier setup and running without any licence from the telecom department.

The SIM cards in those boxes had been linked, through the National Cyber Crime Reporting Portal, to 301 fraud complaints from across India since the end of 2024, 52 of them from Tamil Nadu. The complaints cover investment fraud, "digital arrest" extortion and, in one case, child sexual abuse material. Two men, a manager named Srinivasan and an IT technician named Sanjay, were arrested; the firm's telecallers and senior management are being questioned, and police have not yet established whether staff knew what the equipment was doing. Some of the SIMs, investigators say, were bought in the names of employees by a local agent.

If you have ever received a call from an ordinary-looking Indian mobile number in which a man claiming to be from the CBI, the Enforcement Directorate or TRAI told you a parcel in your name contained drugs, or that your Aadhaar had been used in money laundering, there is a fair chance the call passed through a box like the ones in Saidapet. This is what that box is, how the racket around it works, and why Tamil Nadu has become one of its main battlegrounds.

What a SIM box actually is

A SIM box, also called a GSM gateway, is a piece of hardware roughly the size of a home router with slots for 32 or 64 SIM cards. One side connects to the internet; the other side connects to the mobile network through those SIMs. A call arrives over the internet as a voice-over-IP call, from anywhere in the world, and the box re-dials it on one of its SIMs as a normal mobile call. The person who answers sees a ten-digit Indian number. Nothing on the screen says the call began in a compound in Cambodia.

The device has legitimate uses in call centres and large offices, but only with authorisation from the Department of Telecommunications. Used without it, a SIM box commits two offences before a single scam is spoken. It bypasses the international gateway, so the telecom operator and the exchequer lose the fees on every foreign call that is passed off as local; the industry calls this interconnect bypass or grey-route traffic. And it depends on SIM cards obtained on false or borrowed identities. Under Section 42(3) of the Telecommunications Act, 2023, obtaining SIMs by deceit or tampering with telecom identifiers carries up to three years in prison, a fine of up to ₹50 lakh, or both; the offences are cognizable and non-bailable, and anyone who assists faces the same penalty.

The chain, from a compound abroad to your phone

The scam compounds are not in India. The Indian Cybercrime Coordination Centre, I4C, has estimated that nearly 46 per cent of digital arrest operations originate in Myanmar, Cambodia and Laos, where trafficked workers, many of them Indian, sit in guarded buildings making calls from scripts. Between 2022 and 2025, 6,998 Indian nationals were rescued from such compounds; in November 2025 alone, 270 were flown home from Myawaddy in Myanmar on two Air Force aircraft.

A call from one of those buildings needs an Indian face, and that is the SIM box's job. The chain, as it has emerged in Tamil Nadu's cases, runs like this.

The hardware comes from China. The 14 boxes seized in Chennai and Madurai in August 2025 were Quectel units that police traced to Chinese suppliers, and the men controlling the network were described by investigators as a Chinese mastermind and his handlers.

The SIM cards come from inside the system, not from a black market. In the 2025 case, the cards were issued by a staffer at a regular Airtel point-of-sale store in Madurai, who was booked. In a CBI case in Meerut in March 2026, a company incorporated in January 2025 took 108 SIMs in its own name, supposedly for employees, and fed them to SIM boxes. In Bengaluru in October 2026, cards bought in Gondia district, Maharashtra, were converted into e-SIM profiles, so the plastic never had to travel at all. In Saidapet this week, cards were bought in staff members' names.

The hosts are ordinary people paid a commission to keep a box running in a flat. The 2025 boxes sat in gated communities in Kanathur and Kelambakkam on Chennai's East Coast Road and in Madurai; a 41-year-old from Ramanathapuram and a 31-year-old from Thanjavur were among those found operating them. When the promised payments from abroad were irregular, the devices were simply redirected to another operator. Five boxes were destroyed in Ramanathapuram district by people trying to avoid arrest.

The money moves through mule accounts. One Chennai man opened multiple bank and trust accounts on instructions from the overseas handler, so that when one account was frozen the rest kept working. A relationship manager at a private bank in Chennai was arrested for allegedly taking bribes to move the money without questions.

The call then lands on a phone in Tirunelveli or Tiruppur, from a local number, with a voice that says it is the police.

Tamil Nadu's year of SIM box raids

The state's Cyber Crime Wing, under Additional Director General of Police Sandeep Mittal, has treated the boxes rather than the callers as the target, on the logic that a compound in Cambodia cannot be raided but its Indian plumbing can.

The 2025 operation was run from the State Cyber Command Centre, whose technical team found the boxes by analysing telecom traffic patterns, and the field teams were led by Superintendent of Police I. Shahnaz of Cyber Crime Division-I. The Saidapet raid followed a tip from I4C and a formal complaint from the Department of Telecommunications' security wing; Superintendent of Police S. Selva Nagarathinam confirmed the arrests. An investigating officer put the difficulty plainly: a SIM box is hard to trace, and even I4C goes through a laborious process to locate one.

The same picture across the country

Tamil Nadu is not alone. In Bengaluru, the Karnataka Cyber Command announced on 22 October 2026 that it had seized ten SIM boxes with 320 slots from two apartments in Whitefield, after a complaint from Airtel's nodal officer; four men from Gondia in Maharashtra were arrested for supplying the e-SIM profiles, and police put the potential financial exposure in the hundreds of crores. In Lucknow on 1 November 2026, the Crime Branch's Operation Digital Kavach found six boxes with 192 slots, three VPN gateways, 21 smart switches, four UPS units and 18 batteries across four flats, a setup designed to keep running through power cuts and to hide its own internet address. The CBI's Meerut and Noida searches in March 2026 showed the corporate-SIM route.

The common thread is a shift in method. In October 2024 the Department of Telecommunications switched on a system to block international calls that spoof Indian numbers at the gateway; by July 2025 the government said such calls had fallen from 1.35 crore a day to about 3 lakh, and a separate AI tool had disconnected 82 lakh fraudulent connections. A call that is born on a real Indian SIM inside India does not pass through that gateway at all. The growth of SIM box networks since then is the obvious way around the filter.

What the scam costs

The figures are large and, depending on who is counting, inconsistent. I4C data reported in 2026 put digital arrest and related scam cases at 2.41 lakh between 2022 and 2025, with losses of ₹3,012 crore. The National Human Rights Commission has cited ₹52,976 crore lost to all cyber fraud over six years. In 2025, 55,484 FIRs were registered against roughly 28 lakh complaints, which says as much about underreporting and police capacity as about the crime.

The response has been escalating. I4C and the Home Ministry have blocked 83,668 WhatsApp accounts, 3,962 Skype IDs, about 7.81 lakh SIM cards and over 2 lakh IMEI numbers. In 2025 about 12 lakh SIMs were deactivated, 13.3 lakh mule accounts frozen and ₹5,489 crore recovered. In December 2025 the Supreme Court directed the CBI to lead a nationwide investigation into digital arrest fraud, with power to pursue complicit bankers and seek Interpol help. Against that, the central budget for cybersecurity capital projects fell from ₹1,900 crore in 2025-26 to ₹790 crore in 2026-27.

Why Chennai, why a collection agency

The Saidapet case is the most uncomfortable one so far, because the boxes were not in a rented flat but in a registered company that already made thousands of calls a day for banks. A debt-recovery BPO has telecallers, bulk SIMs and a business reason to own call-routing equipment, which is exactly the cover an illegal gateway needs. Whether the firm's management knew is the question police are now asking. Either answer is bad: a company that rented out its telecom capacity to fraudsters, or a company whose IT room was used without its knowledge for two years while it collected loans for banks.

It also explains why the earlier raids kept finding boxes in gated communities on the East Coast Road. Those flats offered high-speed internet, a steady power supply, strong mobile coverage and neighbours who do not ask questions, the same things a legitimate call centre wants.

What this means for you

The Tamil Nadu police advisory issued after the 2025 raids is worth repeating in plain terms.

A local number proves nothing. The call may show a Chennai or Madurai mobile number and still come from a compound abroad. No police force, court, CBI, ED, TRAI or telecom department conducts an "arrest" over a video call, asks you to stay on the line, or asks for money to close a case. Government agencies do not take payment to redress a grievance. Do not share Aadhaar, PAN, bank details or OTPs on a call you did not initiate, and do not install remote-access apps such as AnyDesk or TeamViewer because a caller asks you to. Video calls from people claiming to be officials can be faked with AI.

Check what is in your name. The Sanchar Saathi portal lists every mobile connection registered against your identity; the Department of Telecommunications has said subscribers can be held liable for misuse of SIMs issued in their name, so disconnect any you do not recognise.

Do not become a host. The men arrested in Ramanathapuram and Thanjavur were promised commissions to keep a small device running. Offers to earn money by housing equipment, lending your name for SIMs or opening bank accounts for someone else are recruitment into the chain described above, and the law treats those who assist the same as those who run it. Landlords should know who their tenants are and what runs in the flat.

Report quickly. The national cyber crime helpline is 1930 and the portal is cybercrime.gov.in. The 301 complaints that led police to Saidapet were filed by people who reported rather than stayed silent; each one was a data point that eventually pointed at one building in Chennai.

FAQ

What is a SIM box scam?

A SIM box is a device holding 32 or more SIM cards that converts internet calls from abroad into local mobile calls. Scam syndicates use it so that calls from compounds in Cambodia, Laos or Myanmar appear on Indian phones as ordinary Indian numbers, and so that the trail leads to a SIM bought on someone else's identity.

What happened in Chennai this week?

On 11 November 2026 the Tamil Nadu Cyber Crime Wing and the Department of Telecommunications seized 18 SIM boxes, 182 SIM cards and two servers from a debt-collection firm in Saidapet. The equipment was linked to 301 cybercrime complaints across India, 52 of them from Tamil Nadu. Two employees were arrested.

Is owning a SIM box illegal in India?

Operating one without authorisation from the Department of Telecommunications is. Obtaining SIMs by deceit or tampering with telecom identifiers is punishable under Section 42(3) of the Telecommunications Act, 2023, with up to three years' imprisonment and a fine of up to ₹50 lakh, and the offences are non-bailable.

How does a digital arrest scam work?

A caller posing as a police, CBI, ED or customs officer claims you or a relative are linked to a crime, keeps you on a call or video call, and pressures you to transfer money to "clear" your name. No agency in India does this.

How do I check if a SIM has been taken in my name?

Use the Sanchar Saathi portal of the Department of Telecommunications, which lists all mobile connections registered against your identity and lets you report ones you do not recognise.

Where do I report a suspicious call?

Call 1930, the national cyber crime helpline, or file a complaint at the National Cyber Crime Reporting Portal, cybercrime.gov.in.