Law enforcement SMASH illegal website used by cyber criminals to defraud thousands of UK victims

The operation marks a deeply alarming new development in online fraud, where sophisticated digital ‘enablers’ are training less tech-savvy criminals in how to set up fake sites.

Those sites are designed to scam victims into believing they are legitimate businesses, like banks and retailers, so they hand over sensitive personal details.

The UK-founded website defrauded victims on an "industrial scale" according to the Metropolitan police.

The criminals who were tutored by the LabHost site went on to obtain 480,000 card numbers and 64,000 PINs globally.

Law enforcement agencies have now arrested 37 suspects across the UK and around the globe.

More than 70 separate addresses were raided and searched in London, Essex and internationally.

Some of the suspects were arrested as they came off, or boarded flights at Manchester and Luton airports.

LabHost was set up in 2021, and allowed criminal subscribers to log on and choose from existing sites, or request bespoke pages replicating those of trusted brands including banks, healthcare agencies and postal services.

LabHost even provided templates and an easy to follow tutorial allowing would-be fraudsters with limited IT knowledge to use the service.

LATEST DEVELOPMENTS:

• Britons issued travel scam warning as victims swindled out of almost £800 - holidaymakers told to beware of 'fake' flights
  
• Elderly drivers and Blue Badge holders warned of parking scam at Tesco stores as police issue statement
  
• Facebook, Instagram, and YouTube littered with scam adverts, Which? warns as UK suffers ‘epidemic of fraud’
  

At the end of the tutorial, a robotic voice told fraudsters: “Stay safe and good spamming.”

By the beginning of 2024, more than 40,000 fraudulent sites had been created and 2,000 users were registered and paying a monthly subscription fee.

LabHost provided its subscribers with fake profiles for 170 companies to trick victims, including 47 businesses based in the UK.

Those subscribing to the “worldwide membership”, meaning they could target victims internationally, paid between £200 and £300 a month.

Since its creation, the site has received just under £1 million in payments from criminal users.

Shortly after the platform was seized and disrupted, 800 criminal users received a message telling them that police “know who they are and what they’ve been doing”.

Police hope they can dissuade former LabHost subscribers from continuing to offend, by creating the same level of fear about their information as their victims.

As part of the Metropolitan police led operation, detectives have contacted up to 25,000 victims in the UK to tell them their data has been compromised.

Work began in June 2022 after detectives received crucial intelligence about LabHost’s activity from the Cyber Defence Alliance – a group of British-based banks and law enforcement agencies which work together to share intelligence.

Met police Deputy Commissioner, Dame Owens said: “You are more likely to be a victim of fraud than any other crime.

“In addition to the financial impact, it undermines the public’s confidence in the tools and technology they need to use in daily life.

"Our collective approach should ensure suspects feel that same level of distrust in their own criminal environment.

“Online fraudsters think they can act with impunity. They believe they can hide behind digital identities and platforms such as LabHost and have absolute confidence these sites are impenetrable by policing.

“But this operation and others over the last year show how law enforcement worldwide can, and will, come together with one another and private sector partners to dismantle international fraud networks at source."