Pretexting & Impersonation Documented incident

iSpoof Caller-ID Spoofing (2022): How a £150-a-Month Website Fueled £43 Million in UK Fraud

iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed in. In the UK alone, prosecutors traced £43 million in fraud to the site. The judge put the worldwide figure nearer £100 million. Police took the server down on November 8, 2022. Six months later its administrator, Tejay Fletcher, got 13 years and 4 months.

Social Engineering Examples·17 sources

Key takeaways

For £150 to £5,000 a month, paid in Bitcoin, a subscriber could borrow a bank's caller ID. Add-on tools grabbed whatever codes the victim then typed into their own phone.
Prosecutors identified £43 million of UK frauds, treated as a floor. The sentencing judge called the global estimate of about £100 million conservative.
The figure of 200,000 often quoted as "victims" counts people reached by calls lasting over a minute, not confirmed losses.
Calling the bank back only works on a number taken from the card or the bank's app, because iSpoof could divert calls to numbers the fraudsters ran.

What iSpoof sold to its 59,000 registered users

iSpoof.cc was a subscription website that sold fraud tools as a service. The Metropolitan Police date its creation to December 2020. Subscribers paid in Bitcoin, from £150 a month up to £5,000 for power users, and the site held 59,000 registered user accounts when it closed.

The Court of Appeal listed what the software did. It made calls appear to come from trusted sources such as a bank or HMRC, the UK tax authority. It also recorded calls, captured data entered on the victim's keypad, and diverted call recipients to numbers or websites the fraudsters ran.

In court, prosecuting counsel John Ojakovoh described an interactive voice response (IVR) feature, meaning automated phone prompts, and a PIN-capture facility. He said one tool let subscribers "intercept OTP (one-time password) which banks ironically introduced to try and improve security." A second tool claimed the victim's card details were out of date and asked them to key in new ones.

The site carried tutorials, and a Telegram channel called "iSpoof club" handled marketing and technical support. Tejay Fletcher co-founded the site with another man and ran it alone once that co-founder was removed in mid-2021. The Court of Appeal records that registered users then grew from 6,433 to 44,459.

How iSpoof's caller-ID spoofing emptied bank accounts

The frauds ran to a script, and it had five steps. iSpoof handled steps 2 and 3. Everything else, from the script to moving the money, was down to the subscriber. The pattern is vishing (voice phishing) built on bank-impersonation pretexting.

Targeting: subscribers dialed at volume, calling people at random rather than researching them, according to the BBC.
Pretext: the call showed the real name and number of a bank such as Barclays or HSBC. The caller then claimed to be from the bank's fraud team, with an alert that supposedly could not wait.
Capture: while the caller talked the victim through a bogus security check, automated prompts logged every PIN and one-time passcode they keyed in.
Access: the subscriber used those codes at once to log in to the victim's real online banking.
Cash-out: money left the account, usually before the victim realized the call was fake. The end result was account takeover.

The capture step is the detail most write-ups miss. The platform did not intercept a text message from the bank. It recorded what victims typed into their own handsets during the call.

Around 10 million calls went through iSpoof worldwide in the 12 months to August 2022, and 3.5 million of them were in the UK. Those are Metropolitan Police figures, as quoted by Sophos. The police described almost 20 people a minute being contacted.

iSpoof fraud investigation timeline, 2020 to 2026

Date	Event	Source
Nov 30, 2020	Start of the indictment period Fletcher was charged over	BBC News
Dec 2020	iSpoof.cc created, per the Metropolitan Police	Police Professional
Jun 2021	The Met's Cyber Crime Unit opens Operation Elaborate	Computer Weekly
Mid-2021	Co-founder removed; Fletcher runs the site alone	Court of Appeal
Oct 2021	Case opened at Eurojust at the request of UK authorities	Eurojust
Aug 2021 to Aug 2022	About 10 million calls made through iSpoof worldwide	Eurojust
Nov 6, 2022	Fletcher arrested at an address in east London	Eurojust
Nov 8, 2022	US and Ukrainian authorities seize the server, by then hosted in Kyiv, and take the site offline	Eurojust
Nov 24, 2022	142 arrests announced worldwide, 120 of them in the UK	Police Professional
Apr 20, 2023	Fletcher pleads guilty to four offenses, about a month before trial	Court of Appeal
May 19, 2023	Sentenced to 13 years and 4 months at Southwark Crown Court; arrests reach 169	CPS, Sky News
Aug 4, 2023	Court of Appeal dismisses the appeal against sentence	Court of Appeal
May 18, 2026	Confiscation order of £404,331 made against Fletcher	Daily Mail court report

What each iSpoof loss figure measures

iSpoof's figures measure different things, so they should not be added together. The table separates losses to victims, income to the platform, and money recovered.

Figure	Meaning	Basis
£43 million	UK frauds the prosecution identified as carried out through iSpoof	Measured; a floor
About £100 million	Global losses to victims	Judge's estimate, called conservative
£10,000	Average loss among the 4,785 people who reported being targeted to Action Fraud	Reported
112.6 BTC	Subscription income over about 16 months, approximately £3.2 million per the CPS	CPS figure; the Court of Appeal says over £3 million
£1.7 million to £1.9 million	Fletcher's own share, the figure the sentence was built on	Court finding; the CPS gives at least £1.3 million
Over £360,000	A Lamborghini, two Range Rovers, and a Rolex found by police	Combined value, against no known legitimate income
£404,331	Confiscation order, the amount investigators could trace	Court order; not money returned to victims

Eurojust gives the platform's income as over EUR 3.7 million. That is its own figure, not a conversion of the sterling total, so the two should not be compared. Sources: Court of Appeal, CPS, BBC News, and Daily Mail.

Three iSpoof facts that are often misreported

200,000 people were contacted, not confirmed as victims

Several pages, including Wikipedia's entry, describe 200,000 UK victims. The Metropolitan Police figure came from the 350,000 UK calls that lasted longer than a minute, which reached about 200,000 people, as iNews reported.

That number measures contact, not loss. Action Fraud received reports from 4,785 people who said they had been targeted.

Fletcher was sentenced on May 19, 2023

Eurojust's press release says May 18, 2023, and a few later reports copied that date. The CPS, the BBC, and the Court of Appeal judgment all say May 19.

The guilty plea came late

The CPS press release says Fletcher pleaded guilty early. The Court of Appeal records that he first pleaded not guilty. He changed his plea about a month before the trial date, which earned him credit of 18 percent.

Why calling the bank back was not enough

The control that failed was trust in caller ID. A displayed number proved nothing, because iSpoof let any subscriber rent a bank's real number.

The usual advice to hang up and call back needed a qualification. iSpoof could divert call recipients to numbers the fraudsters operated. Hitting redial from the call log, or ringing a number the scammer read out, could put the victim straight back through to the fraudsters.

Calling back works only if you take the number from the back of the card, a statement, or the bank's app.

Stage	Control that would have broken it
Pretext: spoofed bank number	Carrier-level caller authentication (the STIR/SHAKEN approach), so a borrowed bank number fails the check
Capture: keyed-in PINs and passcodes	A bank rule, stated plainly to customers, that it never asks for a full PIN or passcode on a call it placed
Access: immediate login	In-app approval instead of codes read out or keyed in over the phone
Cash-out: fast transfer	Step-up checks on new payees, plus monitoring that flags a login followed at once by a large transfer
Supply: the platform itself	Takedown of the service and arrests of its users, which is what ended iSpoof

The same caller-ID trust failure drives the Phantom Hacker bank impersonation case, where the caller's number matched the one printed on the victim's card. For a step-by-step guide, see how to prevent vishing.

What banks, carriers, and fraud teams can learn from iSpoof

Banks: move verification out of the phone call and into the app, so there is no code for a caller to collect.
Phone carriers: authenticate inbound calls that display a bank's number before they reach the customer.
Fraud and security teams: watch for fraud-as-a-service storefronts, since iSpoof marketed itself openly on Telegram.
Trainers: teach caller ID as a display, not an identity check, and teach the callback rule with its qualification.
Investigators: pursuing the user base as well as the operator produced 169 arrests by May 2023.

Other bank fraud-team impersonation calls in this library include the RBS impersonation against Hamilton Academical FC and the Barclays impersonation of a UK jeweller.

What remains unknown

Police and prosecutors have published arrest counts for iSpoof's users, but no conviction count was found in the sources reviewed. An arrest count is not a conviction count.

Reports of the May 2026 confiscation hearing also disagree on how much Fletcher benefited. This page therefore uses the Court of Appeal's finding of £1.7 million to £1.9 million.

iSpoof: common questions

What was iSpoof?

iSpoof was a caller-ID spoofing website, run from the UK, that fraudsters paid to use from December 2020 until police shut it down in November 2022. It also sold tools for capturing codes. Subscribers used it to call people while displaying a real bank's number. UK authorities described the investigation behind its takedown, Operation Elaborate, as the country's largest-ever fraud investigation.

Who ran iSpoof, and what sentence did he get?

Tejay Fletcher, the site's main administrator, pleaded guilty in April 2023 to four offenses, including making or supplying articles for use in fraud. Southwark Crown Court jailed him for 13 years and 4 months on May 19, 2023. The judge started from 16 years and 6 months before the reduction for his plea, and the Court of Appeal upheld the sentence.

How many iSpoof users were arrested?

The coordinated action announced on November 24, 2022, produced 142 arrests worldwide, 120 of them in the UK and 103 in London. By May 2023 the Met's Cyber Crime Unit put the total at 169. Police first focused on UK users who had paid at least £100 in Bitcoin, working from 70 million rows of data on the seized server.

Is iSpoof the same as iSpoofer?

No source connects them: this case concerns iSpoof.cc, the caller-ID spoofing website that sold bank-impersonation tools to fraudsters and was taken offline on November 8, 2022. Searches for "iSpoof" also return unrelated location-spoofing apps used with mobile games. None of the court, police, or prosecutor sources for this case mention those apps.

Can a scammer make a call show my bank's real number?

Yes. iSpoof subscribers made calls that showed the genuine names and numbers of banks including Barclays, HSBC, NatWest, Santander, Lloyds, Halifax, First Direct, Nationwide, and TSB. A matching number is not proof of identity. End the call and dial the number printed on your card or shown in your bank's app, never one the caller gives you.

Did iSpoof victims get their money back?

Not through the criminal case against Fletcher. The confiscation order of £404,331, made on May 18, 2026, is the amount investigators could trace, payable within three months with 12 months' imprisonment in default. A confiscation order recovers money from the offender; it is not compensation paid to the victims of the frauds.

Sources

R v Cooper; R v Park; R v Fletcher. [2023] EWCA Crim 945, Court of Appeal (Criminal Division), heard 25 July 2023, handed down 4 August 2023, before Lord Justice Edis, Mr Justice Johnson and His Honour Judge Lickley KC (primary). The authoritative account of the tooling (paragraph 43), the loss figures (44), the assets (45), the subscription and personal-share amounts (46 to 47), the plea and 18 per cent credit (48), the user growth after the co-founder was removed (49), and the dismissal of the appeal (65).
SENTENCE UPDATE: Man jailed for role in running website involved in multi-million-pound fraud. Crown Prosecution Service (CPS) (primary). Official UK prosecutor press release with case details, financial figures, and sentencing outcome. Note that its "guilty early" characterization is contradicted by the Court of Appeal's record of 18 per cent credit.
Main administrator of iSpoof website sentenced to 13 years. Eurojust (EU Agency for Criminal Justice Cooperation) (primary). EU judicial cooperation agency press release confirming dates, arrest, sentence, and cross-border investigation details. Its sentencing date of 18 May 2023 is an error; the CPS, the BBC and the Court of Appeal all give 19 May 2023.
Action against criminal website that offered 'spoofing' services to fraudsters: 142 arrests. Europol (primary). Law-enforcement press release on the international coordinated takedown action.
iSpoof fraudster guilty of £100m scam sentenced to 13 years. BBC News (secondary). Reports quoted sentencing remarks by Judge Sally Cahill KC and Met Commissioner Sir Mark Rowley.
Mastermind Behind iSpoof Scam Site Jailed for 13 Years. The Epoch Times (secondary). Court report from Southwark Crown Court carrying prosecuting counsel's description of the tooling, the interactive voice response and PIN-capture facilities, the card-details tool, and the three counts ordered to lie on file.
Tejay Fletcher jailed for running multimillion-pound criminal website iSpoof. Sky News (secondary). Source for Detective Superintendent Helen Rance's figure of 169 arrests as at May 2023, and for the CPS statement outside court.
Fraudster jailed for running multimillion-pound website iSpoof. The Guardian (secondary). Detail on Fletcher's spending and case background, and the prosecutor's "lion's share" of about £2 million.
More than 140 arrests in biggest ever UK-led fraud operation. Police Professional (secondary). Reports the Metropolitan Police statement of 24 November 2022: the bank list, the site's creation in December 2020, 59,000 user accounts, the £100 Bitcoin triage threshold, the 70 million rows of data and Bitcoin records, and around £48 million reported to Action Fraud.
Police to text 70,000 victims of 'UK's biggest fraud' after criminals steal millions through scam phone calls. iNews (secondary). Source for the derivation of the 200,000 figure from 350,000 calls lasting over a minute, the 59,000 potential suspects framing, and the initial charge list including the organised crime group count.
UK police arrest 120 in largest-ever cyber fraud crackdown. Computer Weekly (secondary). Detail on the Operation Elaborate timeline, the server relocation from the Netherlands to Kyiv, the arrest breakdown, and the bank list attributed to the Met's Helen Rance.
100 people arrested in UK's biggest fraud investigation. The Guardian (secondary). Contemporaneous November 2022 takedown reporting with victim and user scale figures.
Voice-scamming site "iSpoof" seized, 100s arrested in massive crackdown. Sophos (secondary). Quotes the Metropolitan Police statement on call volumes at length: 10 million calls globally in the 12 months to August 2022, 3.5 million in the UK, 350,000 over a minute, 200,000 individuals.
Inside the iSpoof Blockchain Investigation: This Fraud Tool Helped Scammers Steal Over £100 Million. Chainalysis (secondary). Subscription pricing of £150 per month rising to £5,000 for power users, and an alternative June 2021 to July 2022 window for the 10 million calls.
Bank scam fraudster whose victims lost £100m to repay just £400,000. The Times, 18 May 2026 (secondary). Reports the confiscation order and the £150,000 Lamborghini. Headline and standfirst read; the body is paywalled.
Mastermind behind scam call website iSpoof which helped con artists fleece victims out of £100million is ordered to pay back just a fifth of his £2million fortune. Daily Mail (secondary). Court report of the 18 May 2026 confiscation hearing: the order of £404,331, three months to pay, 12 months in default, and prosecuting counsel's figures of £3.175 million total iSpoof profits with about £2 million traced to Fletcher.
Fraudster ordered to pay back just £400k after bank scamming victims out of £100 MILLION. GB News (secondary). Corroborates the confiscation hearing, naming Judge Alexander Milne, the £70,000 in concealed assets still outstanding, and the sale of the Lamborghini Urus and three minibuses as tainted gifts. Note that its £3.5 million benefit figure conflicts with the roughly £2 million prosecuting counsel is quoted as giving at the same hearing; the conflict is unresolved, so neither is used as the benefit figure here.

Cite this case

Social Engineering Examples. “iSpoof Caller-ID Spoofing (2022): How a £150-a-Month Website Fueled £43 Million in UK Fraud”. Accessed 3 November 2026. https://socialengineeringexamples.com/ispoof-caller-id-spoofing-fletcher-2022

Attack Chain & Defense

1Platform build and tooling development

What happened

Fletcher co-founded iSpoof.cc with another man in December 2020 and ran it alone once that co-founder was removed in mid-2021, building it as a self-service website. Per the Court of Appeal the software let subscribers make calls that appeared to come from trusted sources such as a bank or HMRC, record calls, intercept passwords and other sensitive data entered via the keypad of the victim's phone, and divert call recipients to fraudulent websites or telephone numbers operated by the fraudsters; the site also carried tutorials on getting the most out of the tools. All of it was packaged as a monthly Bitcoin-paid subscription, a pattern consistent with a commercial crime-as-a-service model rather than a one-off tool built for personal use.