Toronto’s fake cell tower case looks absurd at first: spend tens of thousands of dollars building a mobile SMS blaster to send people $3 parking ticket scams. The economics only make sense once you read the charges, which involve credit card data, stolen identities, and trafficking in identity information. The tiny payment was never the product. It was the lure to pull you onto a phishing site that harvests your financial credentials, and the fake tower was valuable because it pushed that funnel to tens of thousands of phones while bypassing the carrier protections meant to stop it.
When I first read about Toronto Police arresting three men for driving around the GTA with fake cellular towers in their vehicles, one part of the story didn’t make sense to me.
The technology was fascinating. The economics weren’t.
Toronto Police’s Project Lighthouse uncovered what they call Canada’s first known criminal use of an SMS blaster: equipment that impersonates legitimate cellular infrastructure and tricks nearby phones into connecting to it.
Instead of sending a phishing text through Bell, Rogers, or Telus, the criminals brought their own miniature cell tower.
Police say tens of thousands of phones connected to the equipment over several months. More than 13 million network disruptions.
And the equipment was mobile. Driven around Toronto and elsewhere in the GTA.
But here’s what confused me. Why go to all that trouble to send someone a fake parking ticket text for $3.75?
The more I looked at the charges, the more I realized I was thinking about this wrong. The small payment isn’t the product. Your identity and financial credentials are.
A Cell Tower in the Back Seat
An SMS blaster is a rogue cellular base station. It presents itself to nearby phones as legitimate infrastructure. Phones connect to it, and fraudulent messages reach users while bypassing the carrier protections we assume sit between scammers and our phones.
Toronto Police began Project Lighthouse in November 2025 after a cybersecurity partner detected a suspected SMS blaster operating downtown. Investigators eventually determined the equipment was mobile, operating from vehicles throughout the GTA.
On March 31, police executed search warrants in Markham and Hamilton. They seized several SMS-blasting devices and a large quantity of electronic evidence. Three men were arrested. Between them, 44 charges.
Police haven’t disclosed exactly how many vehicles were involved, though their language repeatedly uses the plural. With several devices seized, it’s reasonable to conclude this was more than one mobile setup, but the exact number isn’t public.
The $3 Parking Ticket Problem
A lot of SMS phishing looks almost comically cheap. An unpaid parking ticket. Canada Post needs $2.99 to release your package. Your 407 account needs a small payment. Your bank wants you to verify something.
If the objective were simply collecting those tiny payments, the economics of buying sophisticated cellular equipment would be questionable.
Say you spend $25,000 building a mobile SMS-blasting rig and drive around Toronto convincing people to pay fake $4 parking tickets. You’d need more than 6,000 successful victims just to recover the cost of the equipment. That’s before the vehicle, the people, the servers, the phishing infrastructure, and the very real risk of getting arrested.
That’s probably not the business model.
The Charges Tell a Different Story
The charges laid in Project Lighthouse are revealing. According to Toronto Police and subsequent reporting, the three accused face offences including fraud, possession of proceeds of crime, personation, fraudulent interception of computer functions, mischief to data, unauthorized use of computer systems, possession of forgery instruments, trafficking in identity information, possession of identity documents, unauthorized possession of credit card data, interception of private communications, and conspiracy.
These are allegations. Nothing has been proven in court.
But look at what’s in that list. Credit card data. Identity documents. Trafficking identity information. Proceeds of crime. That sounds nothing like an operation built to collect $3 parking ticket payments.
It suggests a much more valuable funnel. Fake cell tower, convincing text, phishing website, financial or identity information, account or card fraud.
The $3 parking ticket is the lure.
The $3 Payment Could Be Worth Thousands
Imagine you get a text saying you have an outstanding Toronto parking ticket for $3.75. You click. The website looks like the City of Toronto. You enter your name and address. Then your credit card number. Expiry date. CVV. Maybe the site says the transaction failed and asks you to verify your bank account.
The criminal hasn’t made $3.75. They’ve potentially acquired an identity and a set of financial credentials.
Toronto Police specifically say the fraudulent websites used in this operation were designed to collect personal information, financial information, and login credentials.
That makes the economics radically different.
How Much Does an SMS Blaster Cost?
Toronto Police haven’t disclosed what the seized equipment cost, and they’ve said the devices used here were unusually or uniquely constructed.
But there’s a good comparison from France. French authorities prosecuted a remarkably similar operation, with IMSI-catcher-style equipment placed in vehicles and driven around Paris while sending phishing messages impersonating organizations including BNP Paribas and the delivery company Chronopost. Investigators said the equipment had been purchased from a Chinese supplier for €18,500. Roughly C$30,000.
So what might a Toronto mobile rig cost? There’s no public bill of materials for the Project Lighthouse equipment, so what follows is an order-of-magnitude estimate, not a police figure.
| Component | Estimated cost |
|---|---|
| False-base-station / SMS-blasting equipment | $15,000 to $30,000 |
| RF equipment, antennas and amplifiers | $2,000 to $7,500 |
| Computer / control hardware | $1,000 to $3,000 |
| Power equipment and vehicle installation | $1,000 to $4,000 |
| Phishing domains, hosting and servers | $500 to $2,000 |
| Miscellaneous equipment | $1,000 to $3,000 |
| Estimated technical cost per vehicle | ~$20,500 to $49,500 |
The vehicle itself is additional, though criminals obviously don’t need to buy a new SUV for the job.
A reasonable working estimate is $25,000 to $50,000 per mobile rig. If there were three independently equipped vehicles, the technical investment could easily approach $75,000 to $150,000.
Again, we don’t know that there were three. Toronto Police have confirmed multiple vehicles and several devices but haven’t given a public count.
Now the Economics Start Working
Suppose a mobile rig costs $30,000. Toronto Police say tens of thousands of phones connected to the devices. For illustration, let’s use 50,000 people.
If the objective is stealing $4 from each successful victim, even an impressive 1% conversion rate gets you 500 victims times $4. Two thousand dollars. Terrible business.
But suppose the objective is acquiring financial credentials that ultimately produce an average of $2,000 from a monetized victim. Now assume only 0.2% of those 50,000 people become financial victims. That’s 100 people. 100 times $2,000 is $200,000.
Suddenly a $30,000 piece of equipment looks very different.
Because the marginal cost of exposing another phone is close to zero, scale becomes enormously valuable. The criminals don’t need most people to fall for it. They need a tiny fraction.
We Don’t Know How Much They Actually Made
This is where it matters not to turn speculation into fact.
Toronto Police have not disclosed total victim losses associated with Project Lighthouse, or how many people clicked the links, entered credentials, or later suffered financial losses.
The 13 million figure is also frequently misread. Police reported more than 13 million network disruptions. That does not mean 13 million people were targeted or that 13 million scam messages were sent. Police separately say tens of thousands of devices connected to the equipment.
We can model the economics. We can’t calculate the operation’s revenue.
The charges give us a much better idea of what police allege the operation was actually doing.
The Charges Change the Story
Initially, I thought this was a story about an incredibly sophisticated way of running a very unsophisticated scam. Spend tens of thousands of dollars building a fake cellular network. Put it in a car. Drive around Toronto. Steal $3 parking payments. That never quite added up.
But look at charges involving credit card data, identity documents, trafficking identity information, and proceeds of crime, and a different business model emerges.
The text message isn’t the scam. It’s customer acquisition.
The phishing website isn’t trying to collect a $3 payment. It’s harvesting data.
And the SMS blaster isn’t valuable because it makes a parking scam more convincing. It’s valuable because it puts a phishing funnel in front of tens of thousands of phones while going around the telecom infrastructure built to stop it.
That’s a much more valuable operation.
The Real Lesson
There’s another reason this case matters.
We’ve spent years teaching people to watch for suspicious phone numbers, strange sender IDs, messages that somehow slipped past a spam filter. SMS blasters undermine some of those assumptions. A sophisticated attacker can manipulate the communications infrastructure itself.
But there’s one part of phishing they still can’t eliminate. The ask.
Eventually the attacker needs you to do something. Click. Log in. Enter your credit card. Provide a password. Verify an account.
That’s why the safest response to an unexpected financial message is still remarkably low-tech. Don’t use the link. Open the organization’s app yourself. Type its website yourself. Or call the number printed on your card.
Toronto’s fake cell towers are an extraordinarily sophisticated way of delivering a scam. But the scam still depends on getting you to hand something valuable over.
Sources: Toronto Police Service’s Project Lighthouse reporting provides the figures for the 44 charges, tens of thousands of connected devices, 13+ million network disruptions, and the operation of the equipment from vehicles throughout the GTA. The €18,500 equipment comparison comes from reporting by Le Monde on the French mobile IMSI-catcher phishing prosecution. The per-vehicle cost estimates above are modelling based on those known equipment costs, not figures released by Toronto Police.
Frequently Asked Questions
What is an SMS blaster?
An SMS blaster is a rogue cellular base station. It impersonates legitimate network infrastructure so nearby phones connect to it, which lets an attacker push text messages straight to those phones while bypassing the carrier filters that normally sit between scammers and your device.
What was Toronto’s Project Lighthouse?
Project Lighthouse was a Toronto Police investigation that began in November 2025 after a cybersecurity partner detected a suspected SMS blaster downtown. Police determined the equipment was mobile, operating from vehicles across the GTA, and in March they arrested three men and laid 44 charges. The charges are allegations that have not been proven in court.
Did 13 million people get scammed?
No. Police reported more than 13 million network disruptions, which is not the same as 13 million victims or 13 million messages. They separately said tens of thousands of phones connected to the equipment. Total victim losses have not been disclosed.
Why spend so much money to send $3 parking ticket scams?
Because the payment is not the goal. The charges include credit card data, identity documents, and trafficking in identity information, which suggests the small parking ticket text is bait to pull people onto a phishing site that harvests financial and identity credentials worth far more than a few dollars.
How can I protect myself from these text scams?
Do not tap links in unexpected messages about payments, packages, or accounts. Open the organization’s official app yourself, type its website address yourself, or call the number printed on your card. The attacker still needs you to act, so refusing to use their link breaks the whole scheme.