At Least 26 Victims Lost Money in Secret, but No Common Link Found Beyond 'Same Neighborhood' as Investigation Hits Dead End

No Evidence of Malicious Link Access or App Installation
Over 25 Million Won in Damages Reported in Gwangmyeong and Geumcheon

KT users in certain areas of the Seoul metropolitan region have suffered losses from mobile micro-payment crimes suspected to be the result of hacking, but questions remain about the circumstances of the incidents.

According to Yonhap News Agency on September 6, the Cyber Investigation Unit of the Gyeonggi Southern Provincial Police Agency announced plans to combine the existing Gwangmyeong micro-payment case with a recent similar incident in Geumcheon District, Seoul, for a joint investigation. Police have identified 26 victims in the Gwangmyeong case, and 14 reports have been filed in connection with the Geumcheon incident.

Previously, in Gwangmyeong, Gyeonggi Province, police received reports between August 27 and 31 that tens of thousands of won had been withdrawn from mobile phones in the early morning hours for purchases of mobile gift certificates and transportation card top-ups. The incident involved a total of 62 unauthorized transactions, including the charging of 804,000 won in mobile gift certificates, with total damages amounting to 17.69 million won. All victims lived in Soha-dong, Gwangmyeong, and some were found to reside in the same apartment complex.

However, between August 26 and September 5, police in Geumcheon District, Seoul, received reports of similar crimes resulting in damages of approximately 8 million won. As news of the incident spread, additional victims who only recently became aware of the fraud have also come forward, suggesting that the total damages could increase further.

The case has become even more mysterious because it has been reported that none of the recent victims accessed suspicious links or installed malicious apps. Police have also checked the mobile phone retail stores where the affected phones were activated. Since all victims are KT users and live in close proximity, investigators considered the possibility that the crimes may have originated at a specific retail store. However, it was found that the victims activated their phones at different stores, and some could not recall which store they used. As the pattern of the crime differs from typical smishing cases, police examined whether the crimes could have occurred during the phone activation process, but no definitive leads have been found.

Among the victims, there were also users of budget mobile plans that operate on the KT network. It is rare for hackers to target network equipment such as base stations and repeaters in order to profit from relatively small-scale crimes like this, deepening the mystery surrounding the case.

A police official stated, "The information regarding the phone activation routes has been confirmed based on the victims' statements, and further investigation is needed. We are keeping all possibilities open as we continue to investigate the circumstances of the case."