UK Charges Five Suspects Linked to Russian Coms Call Spoofing Platform

We track caller ID spoofing platforms in the Adversary Operations Group. Russian Coms was one of the biggest. On July 13, 2026, the National Crime Agency charged five people across London for their roles in supplying and operating the platform.

Five individuals will appear at Westminster Magistrates’ Court on August 14, 2026:

• Ayoub Sehailia (28)

• Zakkaria Sehailia (30)

• Usman Din (30)

• Denis Ozmus (29)

• Fadila Salem (53) 

All face charges including conspiracy to supply articles for use in connection with fraud and transferring criminal property. Salem is also charged with failing to comply with a notice to provide phone passcodes. 

The Platform 

Russian Coms launched in 2020 as a handset sold on Telegram, Snapchat, and Instagram. It later moved to a web-based application. Despite the name, the NCA found no evidence of links to the Russian Federation. The platform was marketed as a bespoke communication tool with encrypted calls, voice-changing, remote handset wiping, VPN masking, and 24/7 support. Hundreds of criminals paid between GBP 1,200 and GBP 1,400 per six-month contract in cryptocurrency. 

The playbook was simple. Scammers spoofed bank phone numbers to display on the victim’s caller ID. The victim trusted the caller. The scammer persuaded the victim to transfer money to attacker-controlled accounts. The NCA estimates the platform was linked to tens of millions in financial losses affecting approximately 170,000 victims. 

The Takedown 

The NCA dismantled Russian Coms in March 2024 under Operation Henhouse. Two men believed to have developed and administered the platform were arrested in Newham, London, and the NCA acquired significant amounts of platform data. Before shutdown, criminals used the platform to make over 1.3 million calls to 500,000 unique phone numbers across 107 countries. Approximately 170,000 of those calls lasted longer than five minutes, indicating successful fraud. The average loss per victim exceeded GBP 9,400. 

Operation Henhouse has now led to 290 arrests across the UK. 

What This Means 

A platform that sold itself as a serious criminal tool with encrypting handsets, no-logs infrastructure, and cryptocurrency payments was infiltrated, dismantled, and its operator networks are now being charged. The charging decision five people across two years of investigation signals the NCA is building cases methodically through the supply chain. Anyone who bought a Russian Coms contract is a potential next target. 

Sources 

Bleeping Computer: UK Charges 5 Suspects Linked to Russian Call Spoofing Platform That Made 1.8M Scam Calls, 13 Jul 2026 – https://www.bleepingcomputer.com/news/security/uk-charges-suspects-linked-to-russian-coms-call-spoofing-platform/ 

NCA: NCA Takes Down Russian Coms Call Spoofing Platform, 1 Aug 2024 – https://www.nationalcrimeagency.gov.uk/news/five-charged-in-nca-investigation-into-fraud-platform-responsible-for-millions-of-scam-calls