Thailand-based phishing ring busted

Estimated losses reach 1.8 billion won

Gang posed as sex-work brokers to defraud victims

Eight senior members, including ringleader, still at large

Armed Thai police officers enter the criminal base of a phishing ring that operated a fake sex-work website targeting South Korean victims from Bangkok, Thailand. [Seoul Songpa Police Station]
Armed Thai police officers enter the criminal base of a phishing ring that operated a fake sex-work website targeting South Korean victims from Bangkok, Thailand. [Seoul Songpa Police Station]

Twenty-four members of a Southeast Asia-based phishing ring have been arrested after defrauding victims of approximately 1.8 billion won ($1.34 million) by promising to arrange paid encounters with female influencers and broadcast jockeys. The gang set up a fake sex-work website and systematically extracted fees from users at each stage of a fabricated process. Police have identified more than 100 victims.

The Seoul Songpa Police Station said Tuesday it had referred 10 suspects arrested last month in Bangkok, Thailand, to prosecutors on charges including organizing and participating in a criminal organization and violating the Act on Special Cases Concerning the Prevention of Loss from Communications Fraud. Nine of the 10 are in detention.

Police are also tracking eight senior members believed to be abroad — including the ringleader — as well as mid-level operatives. An additional 14 people who lent their bank accounts to the ring as proxy accounts have also been referred to prosecutors.

The ring operated from August 2025 to June 2026, shifting its base among Thailand, Cambodia and Vietnam to evade detection. While officially confirmed losses stand at 500 million won, an analysis of the ring's transaction accounts put the estimated total at 1.77 billion won.

An armed Thai police officer pins a suspect to the ground during the arrest of a phishing ring that operated a fake sex-work website targeting South Korean victims from Bangkok, Thailand. [Seoul Songpa Police Station]
An armed Thai police officer pins a suspect to the ground during the arrest of a phishing ring that operated a fake sex-work website targeting South Korean victims from Bangkok, Thailand. [Seoul Songpa Police Station]

The gang charged victims under the pretense of arranging paid encounters with female influencers, BJs, models and entertainment trainees. After luring victims to the fake website, they demanded a series of fees — starting with a membership fee and an identity verification charge.

The organization scripted its operators in detail. One passage read: "The women we match you with are naturally reluctant to have their identities exposed, so we cannot arrange a meeting without safeguards in place. A 'security screening' must be conducted before the first meeting to ensure a private encounter." Members were trained to deliver these lines systematically.

The gang then demanded further payments under a string of pretexts — a reservation deposit, a system restoration fee, a withdrawal data recovery fee and a credit score restoration fee, among others. One victim transferred a total of 150.88 million won across 16 separate transactions.

The ring operated with the discipline of a formal organization. Members rented an entire four-story villa in Bangkok and fitted it out as a phishing office, complete with desks, chairs, computers, burner phones and crime scripts. Living quarters for operatives were set up in the same building, and additional recruits were brought in via Telegram.

An organizational chart of the Thailand-based phishing ring, released by police. [Seoul Songpa Police Station]
An organizational chart of the Thailand-based phishing ring, released by police. [Seoul Songpa Police Station]

The ring also maintained a strict hierarchy. Roles were divided in order from ringleader, to general manager, to team leader, to consultant. Consultants who dealt directly with victims were further split into first-, second- and third-stage roles depending on where a target was in the fraud process. Some consultants posed as women when communicating with victims. Police said the group operated under a formal code of conduct and chain of command.

Members also took careful steps to avoid detection. They used aliases even among themselves and relocated their office whenever a member defected. The ring cycled through 19 nominee bank accounts, switching accounts every two weeks in anticipation of police investigations, systematically erasing any trail that could expose their activities.

Members of a phishing ring that operated a fake sex-work website targeting South Korean victims from Bangkok, Thailand, are detained following their arrest.
Members of a phishing ring that operated a fake sex-work website targeting South Korean victims from Bangkok, Thailand, are detained following their arrest.

Police launched the investigation in June after receiving a tip from the National Intelligence Service about a local scam operation. They quickly requested cooperation from Thai authorities, and a joint operation between a Korean liaison officer and Thai police led to the initial arrest of seven suspects in Bangkok on June 22.

All seven were subsequently extradited to South Korea, and Thai police handed over 53 items of seized evidence, including mobile phones used in the crimes.

Police said they will continue pursuing the ringleader and other accomplices and plan to take a firm stance against phishing crimes to strengthen international cooperation. "If you receive a URL from someone you do not know, the best prevention is to avoid clicking on it — and never transfer money after doing so," a police official said.


20ki@heraldcorp.com