“Targeted young people just starting their careers” ... Vietnam-based ‘corporate-style phishing’ ring that extorted 8.1 billion won busted

[Financial News] Police have arrested a corporate-style phishing ring that set up an office in Ho Chi Minh City, Vietnam, and impersonated a court clerk, a prosecutor and a Financial Supervisory Service employee in succession to extort 8.1 billion won from 110 people. The members kept victims at lodging establishments and elsewhere and prevented them from telling anyone outside about their situation before stealing cash or virtual assets.
On the 29th, the Metropolitan Criminal Investigation Unit of the Seoul Metropolitan Police Agency’s Metropolitan Investigation Unit said it had arrested 54 people, including the Korean ringleader and other members of the Daedong Dangyeol phishing ring, on suspicion of organizing, joining and engaging in activities as a criminal group, violating the Act on the Refund of Damages from Telecommunications Financial Fraud, and other offenses. Thirty-seven of them were remanded in custody.
They are suspected of operating from Ho Chi Minh City and defrauding 110 victims of approximately 8.1 billion won from July 2024 through January this year. Police also applied charges of organizing, joining and engaging in activities as a criminal group to 45 key members, and secured pre-indictment preservation orders for the confiscation and collection of criminal proceeds worth approximately 850 million won.
The group operated from a headquarters centered on a senior Chinese ringleader and a Korean ringleader. As it grew, it sequentially set up the Ho Team, Hun Team and Sho Team, each with the same structure as the headquarters, and shared victims’ information in real time through Signal group chats.
The crimes were carried out in stages. The first tier impersonated a court clerk, telling victims that “a court notice had been returned,” and then directing them to a fake case-information website to obtain their personal information and assess their assets.
The second tier posed as prosecutors and deceived victims into thinking arrest warrants had been issued, keeping them at lodging establishments and elsewhere under the pretext of a “summary investigation” and “temporary protective measures.” Victims were required to report their location every hour and were prevented from sharing details of the case with third parties.
The members also told victims their existing phones were under surveillance and had them activate new phones, then install remote-control software and malicious apps. In some cases, the victims were made to read fake arrest warrants and similar documents aloud while the malicious apps were installed.
The app could steal information from phones and remotely control them. It was also used to make calls from the organization’s members display the Financial Supervisory Service’s main phone number.
The third tier impersonated Financial Supervisory Service employees and persuaded victims to lift the cash withdrawal limits on their debit cards, then leave the cards in lockers or similar places, or store cash at designated locations. Victims were also told to buy virtual assets themselves and transfer them to designated overseas wallets.
Of the 110 victims, 93% were in their 20s or 30s. The average loss per victim was approximately 73 million won, and the largest loss reached 1 billion won. Some victims remained deceived by the organization for as long as two months, from the first contact through their final loss.
The investigation gathered momentum on January 12, when Vietnamese police raided a call-center office in District 7 of Ho Chi Minh City and uncovered 29 Korean members of the group. Police repatriated 25 of them to South Korea in stages, from August 12 through the 2nd of this month, and remanded all of them in custody.
Police later identified additional members, including people who were absent during the local raid or had left the organization, bringing the total number arrested to 54. All 54 arrested in this operation are Korean.
Police also received a large number of tools used in the crimes, including mobile phones and laptops, transferred from overseas to South Korea. Police said this was the first case involving a phishing ring operating from overseas in which most of the tools used at the crime scene were repatriated to South Korea.
Police plan to track down the Chinese ringleaders and identify additional crimes and criminal proceeds through forensic analysis of the seized items and international cooperation.
[email protected] Choi Seung-han Reporter