Vietnam-based voice phishing ring that stole W8.1 billion dismantled

54 members arrested, 37 detained after gang defrauded 110 victims of W8.1 billion

Gang divided roles among fake court clerks, prosecutors and Financial Supervisory Service staff

Police seized largest-ever haul of crime tools from an overseas phishing operation

Crime tools seized by police. The Seoul Metropolitan Police Agency Metropolitan Investigation Unit held a briefing Thursday at its Mapo-gu office on the arrested organization. [Provided by Seoul Metropolitan Police Agency]

"Read the contents of the arrest warrant out loud three times." "You must not share details of the investigation with a third party in the same space, and you cannot be questioned in a public or communal area."

A voice phishing ring that set up a call center in Vietnam, impersonated court clerks, prosecutors and Financial Supervisory Service officials, isolated victims in lodging facilities and stole 8.1 billion won ($6.06 million) from them has been broken up by police.

The Seoul Metropolitan Police Agency Metropolitan Investigation Unit announced Thursday that it had arrested 54 members of the organization — including two Korean co-leaders identified as A and B — on charges including violations of the Act on Special Cases Concerning the Prevention of Loss Caused by Telecommunications-Based Financial Fraud, and detained 37 of them. Charges of organizing, joining and participating in a criminal organization were also applied to 45 core members.

According to police, the suspects formed a criminal organization called "Daedong Dangyeol" in Ho Chi Minh City, Vietnam, from July 2024 through last January, and are accused of defrauding 110 victims of 8.1 billion won by impersonating court clerks, prosecutors and Financial Supervisory Service employees.

Investigators found that the group assigned members to three tiers: first-line operators posing as court clerks, second-line operators posing as prosecutors, and third-line operators posing as Financial Supervisory Service staff.

First-line members approached victims by referencing alleged prostitution or ghost-account cases, telling them that a court registered letter had been returned undelivered and that they were calling to verify details before a second delivery attempt. Victims were then directed to a fraudulent website where forged documents were used to convince them they were implicated in a crime, after which the operatives gathered information on the victims' workplaces, personal details and financial assets.

Second-line members, armed with that information, impersonated prosecutors. They intimidated victims by telling them the matter was a formal investigation that should not be taken lightly, then cut off outside contact and pressured victims into staying at motels or other lodging facilities — a tactic known as "self-confinement" — by claiming the accommodation was a designated temporary supervision site.

During the scheme, members also persuaded victims to activate new mobile phone accounts under the pretext of covering expenses, then induced them to install a malicious app disguised as the legitimate anti-phishing application "Citizen Conan."

Third-line members, posing as Financial Supervisory Service employees, demanded that terrified victims submit to an asset inspection. They then pressured victims into lifting debit card limits and taking out loans, instructing them to withdraw cash and store it in subway station lockers or to purchase and transfer virtual assets.

Organizational chart of "Daedong Dangyeol," the Vietnam-based phishing ring [Provided by Seoul Metropolitan Police Agency]

Victims were also made to read the contents of fabricated arrest warrants aloud two or three times and ordered to report their location every hour.

The organization was founded around July 2024 by a Chinese ringleader who recruited lower-level members through online advertisements and local personal networks. From September of that year, the group expanded in a corporate-like fashion, establishing sub-units — known internally as the "Ho team," "Hun team" and "Show team" — in addition to its headquarters, in order to maximize criminal proceeds.

The group also took meticulous steps to evade police infiltration: prospective recruits were required to submit national health insurance enrollment certificates during the selection process, and members were told to wear suits or dress shirts when commuting so they would appear to local residents to be ordinary office workers.

The organization operated on a performance-based promotion system, advancing members from the first line to the second and third lines based on results, and paid a portion of criminal proceeds as performance bonuses.

Police said they became aware of the case last January after Vietnamese authorities first flagged 29 Korean suspects during a routine administrative inspection. On April 27, police designated a lead investigative unit and launched a joint probe with Vietnamese authorities.

From August, over two months and eight separate operations, police repatriated and detained 25 core members — including the Korean co-leaders — who had been held in custody in Ho Chi Minh City. Members who had fled domestically or abroad around the time of the Ho Chi Minh City crackdown were also apprehended, bringing the total to 54 arrested and 37 detained.

More than 80 percent of those detained were in their 20s and 30s.

Police said the operation also yielded the largest seizure of crime tools ever recorded in a case involving an overseas-based phishing organization. Confiscated items included scripts for the fraud scenarios, a database of victims' personal information, 117 mobile phones, 19 laptops, two desktop computers and 15 Wi-Fi routers.

"Voice phishing crimes in which perpetrators impersonate public institutions to steal money continue to occur, and the public needs to exercise particular caution," a police official said.

Police outlined five prevention tips: hang up immediately without panicking even if a caller tries to create anxiety by claiming involvement in a crime or a money-laundering investigation; do not provide personal or financial information such as resident registration numbers, account numbers, passwords, authentication codes or ID photos; do not install apps or visit internet addresses provided by the caller; verify suspicious calls directly through the official representative number of the relevant institution; and if money has already been transferred or personal or financial information has been disclosed, immediately request a payment suspension from the relevant financial institution and report the incident to police at 112.

kido@heraldcorp.com