Microsoft and Japanese Police Dismantle Scam SMS Network: Over 1 Billion Phishing Messages Blocked

Many people receive text messages like "You have an unclaimed package" or "Your parking ticket is overdue" every day, and behind these scam messages there is often not a scattered individual actor but an organized, division-of-labor industrial chain. Microsoft recently disclosed that it conducted a joint investigation with Japan's National Police Agency (NPA), successfully dismantling a criminal marketplace platform that provided SMS-sending services to scammers. According to Microsoft, the network involved more than 1 billion scam messages in total, spanning multiple countries and regions around the world.

A Dark Market of "Scam-as-a-Service"

The core target of this operation was not a single gang sending scam text messages, but the "infrastructure provider" behind them. During its investigation, Microsoft found that the sending of scam SMS has evolved into a business model similar to SaaS (Software as a Service) — dedicated organizations build platforms and provide tools and technical support, while downstream scammers simply pay a fee to send phishing messages in bulk.

This division of labor dramatically lowers the barrier to entry for scams. A person with no technical knowledge at all can, as long as they are willing to pay, obtain a complete SMS mass-sending capability, including target number lists, message templates, and sending channels. The platform tracked by Microsoft and Japanese police played exactly this role.

SaaS (Software as a Service) is a cloud computing business model in which vendors deploy software in the cloud, and users can use it through a paid subscription without installing or maintaining servers themselves. This model has been hugely successful in legitimate business because it packages complex technical capabilities into out-of-the-box products, allowing customers without specialized knowledge to get up and running quickly.

"Scam-as-a-Service" (also often called Crime-as-a-Service) transplants the same logic into the criminal domain. In these underground markets, infrastructure providers are responsible for building SMS gateways, maintaining number libraries, writing message templates, and handling payments, while downstream scammers pay by usage just as they would for an ordinary cloud service. The direct consequence of this layered structure is a sharp reduction in the barrier to crime: attack capabilities are commoditized, and perpetrators no longer need to master any technical details. Security researchers widely believe that it is precisely this specialized division of labor that has led to order-of-magnitude growth in the scale of cybercrime such as phishing and ransomware in recent years.

Typical Scam SMS Tactics

Most of the scam messages involved in the dismantled network used two common social engineering methods:

Fake delivery notifications. The text messages claim that the user has a package waiting to be collected or that delivery failed, guiding them to click a link to fill in personal information or pay a "redelivery fee." This type of message exploits people's everyday attention to online shopping logistics and is especially effective in markets where e-commerce is widespread.

Fake traffic tickets. The text messages impersonate traffic authorities, claiming that the user has an unpaid parking ticket, creating a sense of urgency that pushes victims to click the link and pay as soon as possible.

What these two tactics have in common is that both impersonate some kind of authority or service provider and both are designed around a scenario that requires "immediate action." This sense of urgency is one of the oldest and most effective psychological levers in phishing attacks.

Social Engineering refers to inducing targets to disclose information or perform certain actions through psychological manipulation rather than technical vulnerabilities. It exploits human cognitive habits and emotional responses — trusting authority, fearing loss, worrying about missing a deadline — rather than flaws in systems. Scam SMS is a typical vehicle for social engineering: the character limit of text messages forces highly simplified information, while their inherent immediacy reinforces the sense of urgency.

A related term is Phishing, which specifically refers to attackers impersonating trusted entities and using forged communication channels to trick people into giving up account credentials, passwords, or payment information. When the medium is SMS, the industry usually calls it "Smishing." Key signals for identifying this type of attack typically include: an abnormal sender number, a link domain that does not match the claimed organization, a demand for "immediate" action, and requests for personal information or payment. It should be emphasized that technological advances have made domain spoofing and brand impersonation extremely convincing, and visually inspecting links alone is no longer enough to judge authenticity; verifying independently through official apps or websites remains the most reliable approach.

Why Cross-Border Collaboration Matters

A notable feature of this operation was cross-border collaboration. The infrastructure used to send scam SMS is often distributed across multiple jurisdictions, and law enforcement agencies in a single country find it very difficult to independently complete the entire chain from platform identification to evidence preservation. Microsoft provided technical-side data analysis and threat intelligence capabilities, while Japan's National Police Agency provided law enforcement authority and local operational capability. The combination of the two made it possible to go from technical tracking to actual takedown.

Microsoft has continued to increase its investment in cybersecurity in recent years, and its Digital Crimes Unit has previously participated in multiple operations against botnets and ransomware infrastructure. This collaboration with Japanese police continues that model: technology companies provide technical location, and law enforcement agencies handle on-the-ground execution.

The Digital Crimes Unit (DCU) is Microsoft's dedicated internal team responsible for combating cybercrime, founded around 2008, whose members include lawyers, investigators, data analysts, and security engineers. Its approach is not direct law enforcement — as a private company, Microsoft has no power to arrest or search — but rather to lock onto criminal infrastructure through technical tracking and then push for takedown through civil litigation, domain seizure applications, or intelligence sharing with law enforcement agencies.

Well-known operations in which the DCU has participated in the past include infrastructure crackdowns against botnets (such as Waledac, Zeus, and Trickbot) and ransomware groups. Such operations usually follow a similar path: first, the technical team maps the topology of the criminal network and identifies key nodes (such as command servers, payment channels, and registered domains), and then law enforcement agencies take seizure or shutdown measures under local law. The reason cross-border cases require this division of labor is that criminal infrastructure is often registered in one country, hosted in another, and has victims distributed in a third; no single jurisdiction's agency can independently cover the entire chain. Technology companies provide cross-border visibility, and law enforcement agencies provide legally effective operational authority — neither can be absent.

Why Scam SMS Persists Despite Repeated Crackdowns

Dismantling one platform is certainly a milestone victory, but the governance of scam SMS is far from over. From the perspective of industrial structure, as long as there are enough potential victims downstream, the "market demand" for sending scam messages will continue to exist, and new platforms will fill the gap left by those that are dismantled.

From a technical perspective, SMS, as an old communication protocol, has its openness and interoperability become precisely the reason it is abused. Unlike closed instant messaging apps, SMS has low sending costs, broad coverage, and does not depend on a specific application ecosystem. For scammers, this remains a highly attractive channel in terms of return on investment.

For ordinary users, the most effective line of defense is still basic security habits: do not click links in text messages from unknown sources, do not submit personal information or make payments through links in text messages, remain cautious about notifications claiming to come from delivery, traffic management, or similar organizations, and verify independently through official channels.

This joint operation by Microsoft and Japanese police provides a noteworthy sample — when technology companies' data analysis capabilities and law enforcement agencies' operational authority combine forces, the infrastructure of cross-border cybercrime is not untouchable. But to truly bring down that number of "more than 1 billion," what is needed is sustained, systematic collaboration, not a one-off crackdown.

One-line Summary

Microsoft and Japanese police jointly dismantled a criminal platform that sent over 1 billion scam text messages, revealing its "Scam-as-a-Service" supply chain.

Paragraph Summary

Microsoft and Japan's National Police Agency conducted a joint investigation and successfully dismantled a criminal marketplace platform that provided SMS-sending services to scammers, involving more than 1 billion scam messages and spanning multiple countries worldwide. The platform used a SaaS-like "Scam-as-a-Service" model, providing downstream scammers with number lists, message templates, and sending channels, greatly lowering the barrier to fraud. Common tactics include fake delivery notifications and fake traffic tickets, both of which impersonate authoritative institutions and create urgency to lure victims into clicking links. The article points out that cross-border collaboration is crucial in such operations: technology companies provide technical tracking and threat intelligence, while law enforcement agencies handle on-the-ground execution. However, dismantling a single platform cannot cure the problem at its root; the openness and low barrier of the SMS protocol continue to make it a scam channel, and maintaining basic security habits remains the most effective line of defense for users.