Busan police catch 101 in ring that made foreign phishing calls show '010' numbers
In short
Busan police said on 20 October they caught 101 people, 16 of them detained, for smuggling and running relay devices that made overseas internet calls appear as domestic '010' mobile numbers. Police said 19 victims lost 1.5 billion won in prosecutor-impersonation phishing that used the devices. The case began with SIM card fragments found in a drain in February.
Read the full story 3 min read
Busan police said on 20 October that they had caught 101 people on suspicion of smuggling, distributing and running relay devices that change the caller number of overseas internet calls to a domestic mobile number starting with '010', or of supplying SIM cards for them. The Narcotics and International Crime Investigation Unit of the Busan Metropolitan Police Agency detained 16 of them, including a Russian national in his 20s identified as the general distribution agent, A. The charges are violations of the Telecommunications Fraud Damage Refund Act and the Telecommunications Business Act. [ 1 , 2 , 3 , 4 ]
According to police, the group brought the relay devices into the country from November last year to September this year, disguised as hard disks. They installed the devices in one-room flats and elsewhere, where they were used by overseas phishing groups. Newsis reported that the operators set up equipment in 13 one-room flats spread across Yeonje District, Suyeong District and Changwon, ran about 10 relays at each location and were reported to receive about 600,000 to 700,000 won a week. It added that the operators included Koreans in their teens. [ 1 , 2 , 3 , 4 ]
Of those caught, 84 were Korean SIM card providers, according to Yonhap and Hankook Ilbo. They received 60,000 to 120,000 won per SIM or opened SIMs in their own names on condition of getting a loan, and handed them over. The domestic distribution and operating members were mostly foreign nationals from Russia, Belarus, Kazakhstan and Uzbekistan, recruited through a Russian-language job board on Telegram. They split into roles for managing equipment, recruiting members, carrying relays and SIMs, and installing and operating the devices. They kept in contact over Telegram and handed over equipment by leaving it at set places, a method called 'throwing', in a cell-like structure. [ 1 , 2 , 3 , 4 ]
The investigation began in February, when police received a tip that many SIM fragments had been found in a drain at a one-room building in Busan. Yonhap and Newsis place the building in Yeonje District. Police confirmed the SIMs had been used in prosecutor-impersonation phishing. Newsis quoted police as saying the numbers were suspended, and the SIMs are presumed to have been torn up and thrown away, and that the fragments were found during high-pressure cleaning of a blocked drain. Police analysed on-site checks and nearby CCTV to identify an operator, then traced how devices and SIMs were delivered and detained the general distribution agent, recruiter and delivery agents in turn. [ 1 , 2 , 3 , 4 ]
Police searched two warehouses and homes and seized 400 relay devices, 121 burner phones, 5,256 SIM chips and 848 other items, such as routers. Police said 19 victims lost 1.5 billion won in prosecutor-impersonation phishing that used the relays. [ 1 , 2 , 3 , 4 ]
Police are tracing the Chinese leader and smuggler based overseas and the rest of the group. Seoul Economic Daily and Newsis reported that Busan police will keep tracing more members, the identities and whereabouts of the overseas leader, the route by which the relays entered the country, and the funds. A police official urged people not to assume a call showing '010' is domestic, and to hang up and check the agency's official contact number if asked to send money or hand over cash by someone posing as an investigative agency. [ 1 , 2 , 3 , 4 ]
Why it matters
Police warned that a call showing an '010' number should not be assumed to be a domestic call. They advised people asked by a supposed investigative agency to send money or hand over cash to hang up and check the agency's official contact number.
Key facts
- Busan police said on 20 October that they caught 101 people and detained 16, including a Russian national in his 20s identified as the general distribution agent, A. [ 1 , 3 ]
- Police suspect the group smuggled in relay devices that change the caller number of overseas internet calls to a domestic mobile number, from November last year to September this year. [ 1 , 2 , 3 , 4 ]
- Of the 101 people, 84 were SIM card providers who received 60,000 to 120,000 won per SIM or opened SIMs in their own names on condition of getting a loan. [ 1 , 3 , 4 ]
- Police seized 400 relay devices, 121 burner phones, 5,256 SIM chips and 848 other items such as routers. [ 1 , 2 , 3 , 4 ]
- Nineteen victims lost 1.5 billion won in prosecutor-impersonation phishing that used the group's relay devices. [ 1 , 2 , 3 , 4 ]
- The investigation began in February with SIM fragments found in a drain at a one-room building in Busan. [ 1 , 2 , 3 , 4 ]
Confirmed by several sources
- Police caught 101 people and detained 16 on suspicion of violating the Telecommunications Fraud Damage Refund Act and the Telecommunications Business Act. [ 1 , 2 , 3 , 4 ]
- The group is suspected of bringing in relay devices disguised as hard disks and installing them in one-room flats to help overseas phishing groups. [ 1 , 2 , 3 , 4 ]
- Police seized 400 relay devices, 121 burner phones, 5,256 SIM chips and 848 other items from two warehouses and homes. [ 1 , 2 , 3 , 4 ]
- Nineteen victims lost 1.5 billion won in prosecutor-impersonation phishing that used the devices. [ 1 , 2 , 3 , 4 ]
Still unclear
- The overseas leader and smuggler have not been caught. Police are still tracing them and the rest of the group; Newsis and Seoul Economic Daily say police are also tracing further members, the devices' entry route and the funds.
- Details of the operators' pay, the 13 flats and the migration status of some members come from a single report. Only Newsis gives these details; the other documents do not mention them.