On Friday, the Korean National Police Agency (KNPA) announced the arrest of seven gang members who allegedly established an office in Vietnam in order to commit smishing attacks.
Among those arrested, three associates, including the mastermind, were forcefully repatriated to South Korea a week before the announcement, according to a police press release.
The KNPA initiated an investigation against smishing attacks—the deceptive use SMS to steal sensitive information—in July of last year when a fraud victim filed a report to the cybercrime unit of the Gyeongbuk Provincial Police. The victim had received an online invitation to a wedding, which ultimately led to the installation of malicious software on their mobile device.
The investigators analyzed nearly 300,000 transaction records from 70 accounts involved in the attacks to trace the smishing gang. Their meticulous efforts revealed the scale of the international crime, which resulted in losses of approximately $7.5 million (10 billion won) for 230 victims who were scammed through various types of text messages.
The international investigation to dismantle the criminal operation across South Korea and Vietnam began in September 2023. So far, the joint team has arrested a total of 86 gang members.
Related article: Smishing is increasing during national holidays, but the arrest rate remains low
Smishing, a type of cyberattack that uses phishing through text messages, is on the rise, especially during South Korean holidays. However, the arrest rate for these crimes remains low.
According to Jung Hee-yong, a member of South Korea’s 22nd National Assembly, the number of smishing incidents surged during Chuseok, a South Korean national holiday when families gather to spend time together.
According to statistics provided by the National Police Agency to Jung, there were 13 cases of smishing during Chuseok in September 2019, with a police arrest rate of 23.1 percent. However, by September 2023, the number of smishing cases had surged 13-fold to 165, but only 10 arrests were made, representing just 6.1 percent of the total cases.
Smishing crimes reported during the month of Chuseok from 2019 to 2023
“During the Chuseok holiday, when people are actively exchanging text messages with friends and family, it’s easy for smishing crimes to occur, as people tend to readily accept incoming messages,” said Jung. “Hacking can lead to further damage. We need to strengthen regulations on smishing and combat the crime by conducting preventive training,” he added.
Smishing, a combination of Short Message Service (SMS) and phishing, is a cybercrime that steals personal information through malicious links sent via text messages. These messages trick individuals into making payments or downloading harmful applications.
Smishing crimes have been steadily increasing. According to the Ministry of Science and ICT (MSIT), 887,859 cases of smishing were detected from January to June 2024. This is a significant rise compared to the 37,122 cases detected in the entire year of 2022—an increase of 850,737 cases.
The MSIT stated that scammers hacked individuals with the authority to send messages to customers and stole their accounts. They then used these accounts to send smishing messages containing malicious links.
The Korea Internet & Security Agency (KISA) revealed that there are several types of smishing texts. Scammers often impersonate acquaintances, sending malicious links disguised as wedding invitations or funeral announcements. They also create fake links that resemble legitimate sites, such as those for government agencies, courier services, or news outlets, which redirect users to phishing sites.
In addition, the United Kingdom issued a warning in September about smishing fraud at the start of the school term. The Student Loans Company, a government-owned entity, revealed that scammers target students who have just received their loans. In 2023, the company reported preventing £2.9 million ($3.9 million) in loan payments from being stolen due to smishing crimes. READ MORE
