Police warn parents about VPN as fake ID suspect is arrested
Wednesday 14th October 2026 on 16:01 in
Iceland
Police have arrested one person in an investigation into the sale of counterfeit digital credentials, while warning parents that a VPN setting used by more than 300 young people could expose their online activity. The information was reported by mbl.is.
The suspect is accused of selling fake credentials to hundreds of minors by offering access to a website or an iPhone app, according to police. Police urged parents and guardians to discuss online safety with their children and explain that presenting fake credentials may constitute document forgery under criminal law.
Police also warned about a VPN setting called Island Surge VPN, which was sold alongside a smartphone app that appeared to be the official island.is app but was not. The VPN is intended to change the national ID number displayed on island.is and in online banking services, police said.
The VPN routes all traffic from a phone through servers controlled by the service provider. If users trust the provider’s security certificate, the provider can read and change that traffic, including information displayed on the phone. The browser’s padlock icon may still appear, even though the provider can intercept communications between the user and a website.
Police described this as a man-in-the-middle attack. The service operator could see information sent to island.is and banks, including personal and banking details entered after login, and could alter what users see. Because the phone trusts the certificate for all websites, the operator could potentially extend monitoring to email, social media and other messages. Even without reading content, the operator could see which websites and apps a customer uses.
Young people who bought the service had to provide their real national ID number and pay online through Stripe. Police said the operator therefore had their real ID numbers, full names and email addresses. In some cases, the operator also had a photograph and information about the age the child chose to display.
Police are urging parents and guardians to check whether Island Surge VPN is installed on their child’s iPhone or iPad. They can look under Settings, then General, then VPN and Device Management.