Dozens arrested and thousands of victims contacted after scam site taken offline
As many as 70,000 UK victims were tricked by LabHost's scams
LabHost's scams, which obtained 480,000 card numbers and 64,000 PINs globally.
Set up in 2021 by a criminal network, LabHost enabled users to set up phishing websites designed to trick victims into revealing personal information such as email addresses, passwords, and bank details.
Work began in June 2022 after detectives received crucial intelligence about LabHost’s activity from the Cyber Defence Alliance – a group of British-based banks and law enforcement agencies which work together to share intelligence.
In November 2022, the Met arrested more than 130 suspects as part of Operation Elaborate. An estimated 200,000 victims were targeted by a scam stealing millions from the public via fake bank phone calls.
LabHost even provided templates and an easy to follow tutorial allowing would-be fraudsters with limited IT knowledge to use the service. At the end of the tutorial, a robotic voice told fraudsters: “Stay safe and good spamming.”
law enforcement agencies arresting 37 suspects across the UK and around the world, including at Manchester and Luton airports, as well as in Essex and London.
By the beginning of 2024, more than 40,000 fraudulent sites had been created with the help of LabHost, and 2,000 users were registered and paying a monthly subscription fee.
LabHost provided its subscribers with fake profiles for 170 companies to trick victims, including 47 based in the UK.
Those subscribing to the “worldwide membership”, meaning they could target victims internationally, paid between £200 and £300 a month.
Since creation, the site has received just under £1 million in payments from criminal users
Shortly after the platform was seized and disrupted, 800 users received a message telling them that police “know who they are and what they’ve been doing”.
Set up in 2021 by a criminal network, LabHost enabled users to set up phishing websites designed to trick victims into revealing personal information such as email addresses, passwords, and bank details.
Criminal subscribers were able to log on and choose from existing sites or request bespoke pages replicating those of trusted brands including banks, healthcare agencies and postal services.