Fraud-as-a-Service turns scams into a modular supply chain: SIMCARTEL, FATF, and what gambling PSPs need to watch

Fraud used to require a team. Now it can be assembled from rented pieces: stolen data from one vendor, infrastructure from another, cash-out from a third. That matters for high-risk PSPs because the first visible signal is often not a single bad actor, but a coordinated stream of accounts, devices, payment tools, and withdrawal routes.

1. Fraud-as-a-Service (FaaS) now works like a normal online service: subscriptions, pricing tiers, support, and step-by-step instructions. The operator does not need to build the whole stack themselves; they can buy stolen data, rent infrastructure, and outsource cash-out.
2. The scale is visible in the SIMCARTEL case. In October 2025, Europol, together with police in Latvia, Austria, Estonia, and Finland, shut down a phone-number rental service. Authorities seized 1,200 SIM boxes, 40,000 active SIM cards, numbers from 80+ countries, and said the setup was used to register about 49 million fake accounts on 160+ online platforms.
3. The basic trick is simple: a phone number can pass SMS verification without belonging to a real person. That means SMS confirmation is no longer proof that an account is tied to a genuine user, which is a direct problem for onboarding, KYC, and fraud controls in gambling and betting.
4. In February 2026, FATF published a report on digital fraud. According to FATF, 156 jurisdictions treat fraud as one of the main sources of dirty money. Its suggested responses were payment transparency, the ability for banks and payment companies to quickly suspend and freeze suspicious transfers, disclosure of beneficial ownership, and broader use of machine learning in transaction analysis.
5. For gambling operators and their PSPs, the laundering pattern is familiar: a deposit from a stolen card or wallet, minimal betting to create a thin activity trail, then a withdrawal to another payment instrument. In practice, that account functions as a money mule, a transit point for someone else’s funds.

The operational takeaway is not that registration checks are useless. They are just not enough. Fraud networks tend to show up through combinations of signals: the same devices, repeated payment instruments, characteristic betting behavior, and suspicious withdrawal routes. If anti-fraud and AML monitoring live in separate systems and do not share signals, each team sees only a fragment of the picture.