No honor among thieves: Voice phishing ring allegedly ripped off by plants from splinter gang

A criminal ring that allegedly stole money from another gang accused of voice phishing was busted by police, in what investigators called a rare case of one criminal organization preying on another.

A JoongAng Ilbo investigation on July 20 found that the Osan Police Precinct in Gyeonggi referred 18 suspects to the Suwon District Prosecutors’ Office on July 7. The suspects were accused of stealing about 360 million won ($244,000) from mule accounts controlled by a voice phishing operation.

Two alleged ringleaders of the group that stole the criminal proceeds were held in custody, while the remaining 16 were referred without detention. 

The case involved three interconnected criminal groups: a voice phishing syndicate, a network that supplied bank accounts for the scams and a splinter group that infiltrated the bank account supplier and stole the money it handled, police said.

The bank account suppliers allegedly recruited people willing to lend bank accounts through stock investment chat rooms on Telegram and other online channels. Once they collected information from the victims’ bank books, debit cards and authentication credentials, they allegedly handed it over to the scammers.

The suppliers then allegedly gathered account holders at motels and inns, where they stayed together while members monitored incoming deposits in real time. However, the splinter group had infiltrated the mule account pipeline with their own people, police said.

As soon as a deposit notification appeared on an account holder's phone, the infiltrators would excuse themselves by saying they were stepping out briefly. They then withdrew the money or transferred it to another account before disappearing, according to police.

By acting just moments ahead of the voice phishing operation, the splinter group stole the money before the scammers could get their hands on it, police said.

The splinter group’s members were able to infiltrate the gathering easily because they once belonged to the same organization, according to police. After disputes over profit-sharing, some members allegedly began secretly diverting the group's funds before eventually breaking away to form their own criminal network.

The scheme unraveled after police launched an investigation into the voice phishing scammers. Authorities began tracing the flow of funds for nearly a year — from April 2025 through March — after receiving reports that four members of the voice phishing gang had defrauded victims of approximately 80 million won.

Investigators then cross-checked surveillance camera footage with account records to identify those who withdrew the money. The two alleged ringleaders were arrested separately in Nonhyeon-dong, Gangnam District, southern Seoul, and Pyeongtaek, Gyeonggi.

"It is an unusual case in which one criminal ring exploiting mule accounts committed crimes against another," a police official said.

While there have been cases in which individual account holders or mule account brokers embezzled money from criminal groups, police said organized operations targeting another mule account network are rare.

Police also referred members of the group that allegedly supplied the bank account and the splinter group to the prosecution on charges of violating the Special Act on the Prevention of Telecommunications-based Financial Fraud and Refund of Fraudulently Obtained Assets. They concluded that the two groups originally operated as a single organization that traded bank accounts registered under other people's names.

Investigators additionally charged those involved with racketeering because the groups formed and operated criminal organizations with assigned roles to commit crimes.

BY HEO JEONG-WON [[email protected]]