‘6th Emergency Employment Stability Support Fund Recipients’... Smishing Impersonating Public Institutions on the Rise

Text Messages Sent Ahead of Subsidy Application Deadline

On the 13th, smishing messages were sent out coinciding with the deadline for the 6th Emergency Employment Stability Support Fund reapplicants. Contact was made from different numbers, attempting to extract personal information through requests to install files, exposing recipients to 'smishing' attacks.
Photo by Oh Gyumin moh011@

Mr. A is currently on unpaid leave. On the 13th, he received a text message starting with 1533. It read, "Notice for 6th Emergency Employment Stability Support Fund Recipients." When checking the eligibility criteria, "unpaid leave workers" were included, so he called to inquire about applying for the support fund. Although the call did not connect immediately, he was contacted by a mobile phone number one minute later. The person introduced himself as "Lee Jin-ah, a counselor from Woori Bank," and sent a KakaoTalk message offering help with filling out the application form. The file he sent was a compressed file titled "Mobile Application Form." When the counselor requested installation of the file, Mr. A became suspicious and stopped communicating.

As the application period for the 6th Emergency Employment Stability Support Fund approaches, smishing (SMS phishing) messages impersonating the Ministry of Employment and Labor are on the rise. Criminals use a method called "Molkaem phishing," which induces installation of files on mobile phones to steal personal information. If victims do not fall for the text messages, the criminals repeatedly attempt "voice phishing" by impersonating other financial institutions. Since messages may be sent to actual support fund recipients, caution is necessary.

Even after ending the KakaoTalk conversation, Mr. A received similar contacts. On the morning of the 14th, a message titled "Low-income Emergency Living Stabilization Support Fund Notice" was sent from a number starting with 1599. In the afternoon, he received a call from someone introducing himself as "Lee Min-ho, deputy manager at NH Nonghyup," informing him that the government support fund application had been completed.

On the 13th, the deadline for the 6th Emergency Employment Stability Support Fund application for previous recipients, smishing messages were sent out. When calling to inquire about the application, the call does not connect immediately and is redirected to another number.
/Photo by Oh Gyumin moh011@

Many of the text messages contained information that differed significantly from what the Ministry of Employment and Labor explains. The actual eligible applicants are special-type workers and freelancers, but the smishing messages included regular employees, daily workers, and unpaid leave workers. At the bottom of the message, there was information about "loan scale and conditions," including interest rates, but the Emergency Employment Stability Support Fund is not related to loans. However, the criminals sent the messages close to the application deadline for previous recipients, which was 6 p.m. on the 13th. This suggests they have sufficient prior information to commit smishing crimes.

This method is similar to "Molkaem phishing." The file sent to Mr. A by the counselor, titled "Mobile Application Form," contained an apk file named 'woori3.0' inside the compressed file. If installed as instructed and various mobile phone permissions are granted, there is a high risk that contacts, photos, and other data on the phone will be leaked.

To prevent damage, it is important to recognize the characteristics of smishing messages. Most of these texts include the phrase "(Advertisement)," which differs from official government messages. Also, since government support funds are not related to loans, any mention of loan amounts or conditions should be considered a smishing message.

A Ministry of Employment and Labor official stated regarding these smishing messages, "For (support fund) previous recipients, consent to receive text messages is obtained at the time of application, but it is difficult to follow this procedure for new applicants, and it is also difficult to limit the recipients of the messages." However, they added, "We are reviewing ways to keep this situation in mind during applications and to prevent victims from suffering damage."