In a stark reminder of the vulnerabilities inherent in modern digital identity, a 25-year-old man has been sentenced to two and a half years in prison for his central role in a sophisticated SIM-swapping operation. Ajay Shinjin, who operated under the alias "AJ Marley Cruz," was brought to justice after a protracted investigation by the City of London Police into a series of high-stakes cryptocurrency thefts that left four victims reeling from combined losses of £200,000.
The case, which underscores the escalating threat of telecommunications-based financial crime, highlights how easily personal data can be weaponized. Shinjin’s guilty plea on September 28—entered just ten days before his sentencing—marked the end of a high-living spree fueled by illicit gains, including luxury vacations to Dubai, high-end real estate, and extravagant personal acquisitions such as gold-plated dental grills.
The Mechanics of the Breach: How SIM-Swapping Works
The operation, which first came to the attention of authorities in November 2021, utilized a method known as "SIM swapping." This technique exploits the reliance that many financial institutions—including cryptocurrency exchanges—place on SMS-based two-factor authentication (2FA).
By manipulating telecommunications systems, the perpetrators successfully convinced service providers to port victims’ mobile phone numbers onto SIM cards under the criminals’ direct control. Once the phone number was "swapped," the fraudsters gained the ability to intercept one-time passcodes and security alerts. With these codes in hand, they bypassed the security layers protecting the victims’ bank accounts and cryptocurrency wallets, effectively locking the legitimate owners out while draining their assets.
The breach was initially detected by BT in early November 2021, when the company identified anomalous, unauthorized activity within its infrastructure. Internal investigations revealed that the hijacked phone numbers were being ported to specific eSIM-enabled handsets. Each of these devices possessed two IMEI numbers—the unique hardware identifiers used to track handsets globally. By tracking these serial codes, law enforcement was able to link Shinjin to four distinct devices used in the spree.
Chronology of the Fraud: A Week of Plunder
The rapid-fire nature of the thefts in November 2021 reflects a calculated and coordinated effort. Within the first week of that month, four victims reported significant financial losses, exposing a clear pattern of exploitation:
- November 2: The campaign began with the theft of approximately £40,000 in cryptocurrency from the first victim. Forensic analysis later revealed that roughly £27,000 of those funds were funneled directly into Shinjin’s personal crypto account.
- November 3: A third victim suffered a loss of £8,000, which was siphoned from their Coinbase account. In this instance, while Shinjin played an instrumental role in executing the fraud, the proceeds were diverted to other participants in the criminal network.
- November 5–7: A second victim was targeted, losing approximately £17,000. In a repeat of the first theft, the entire sum was traced to Shinjin’s personal digital wallet.
- November 6–7: The largest single theft occurred, with £130,000 stolen from a fourth victim. As with the third case, Shinjin acted as a facilitator, though the bulk of the funds moved through different channels within the criminal organization.
In total, Shinjin directly received £44,000 of the stolen proceeds, which he promptly converted into a lifestyle of opulence, far removed from the digital anonymity he sought to maintain.
The Long Arm of the Law: Investigation and Arrest
The pursuit of Shinjin spanned nearly two years. After identifying him as a key figure in the scheme, the City of London Police launched a comprehensive digital forensic investigation. The breakthrough came in October 2023, when Shinjin was apprehended at Heathrow Airport upon returning from a luxury trip to Dubai.
Following his arrest, the Crown Prosecution Service (CPS) charged him with one count of conspiracy to commit fraud by false representation and one count of transferring criminal property. As the trial proceedings loomed in late 2026, Shinjin eventually entered a guilty plea, acknowledging his role in the criminal enterprise.
Detective Constable Simon Ardeman, representing the City of London Police, did not mince words regarding the severity of the offense. "This was a complex and calculated fraud that caused significant financial harm to a number of victims," Ardeman stated. He further characterized SIM-swap fraud as a "sophisticated and increasingly concerning form of offending" that demands both institutional vigilance and public awareness.
Ardeman emphasized that the conviction serves as a deterrent, warning, "This conviction sends a clear message that those who use technology to commit fraud will be brought to justice, no matter how much they attempt to obscure their tracks."
Broader Implications: The UK’s Crypto Crime Landscape
The case of Ajay Shinjin, while significant, is part of a much larger, more menacing landscape of cryptocurrency-related crime in the United Kingdom. As digital assets become more mainstream, they have inevitably attracted the attention of organized crime syndicates capable of laundering billions.
Just one year prior to Shinjin’s sentencing, the UK judicial system presided over a far more massive case involving the intersection of cryptocurrency and money laundering. Zhimin Qian, a Chinese national, pleaded guilty in September 2025 to acquiring criminal property, a charge tied to one of the largest cryptocurrency seizures in history. Authorities successfully confiscated over 61,000 Bitcoin—valued at the time at approximately £5.5 billion ($7.43 billion).
Qian’s case, which involved the systematic defrauding of over 128,000 victims in China between 2014 and 2017, serves as the backdrop against which smaller, yet equally damaging cases like Shinjin’s are viewed. Will Lyne, the Metropolitan Police’s head of economic and cybercrime command, has previously described these operations as some of the most complex money laundering cases in British history.
Lessons for the Digital Age
The Shinjin case serves as a vital case study for both consumers and telecommunications providers. The ease with which a phone number can be hijacked illustrates the fragility of "knowledge-based" security systems.
For Consumers:
- Disable SMS 2FA: Security experts increasingly recommend moving away from SMS-based two-factor authentication in favor of app-based authenticators (like Google Authenticator or Authy) or hardware security keys (like YubiKey), which are immune to SIM-swapping.
- Monitor Account Activity: The victims in this case lost their assets within hours. Regular monitoring of bank and exchange accounts can allow for immediate action, potentially freezing assets before they are moved to offshore wallets.
- Limit Personal Information: Fraudsters often use social engineering to gather enough personal data to convince mobile providers to port a number. Limiting the exposure of personal details—such as home addresses, dates of birth, or account numbers—on social media is essential.
For Telecommunications Providers:
The burden of security does not fall solely on the consumer. BT’s role in identifying the unauthorized activity was critical, but the fact that the fraud occurred at all points to a need for more stringent identity verification protocols when customers request a SIM change. Many providers are now implementing "port-out protection" and requiring in-person verification for SIM changes, steps that are becoming the industry standard to prevent such breaches.
Conclusion
The incarceration of Ajay Shinjin is a small victory in a global war against cyber-enabled financial crime. While his gold-plated grills and Dubai holidays were short-lived, the damage inflicted upon his victims—and the loss of trust in digital systems—persists. As the United Kingdom continues to grapple with the fallout of multi-billion-pound money laundering cases and persistent, smaller-scale scams, the case of "AJ Marley Cruz" stands as a testament to the fact that while digital trails are often difficult to follow, they are rarely impossible to track.
For the legal system, the challenge remains to keep pace with the evolving ingenuity of criminals who view the global financial network as their playground. As technology continues to bridge the gap between physical identity and digital assets, the vigilance of law enforcement and the security protocols of private firms will be the only barriers standing between the public and an increasingly sophisticated class of digital predators.
