Unauthorized micro-payment losses targeting KT users mostly occurred in the early morning hours because hackers chose times with less interference in communications signals to carry out the crime, investigators found.
According to police and others on the 23rd, A, a 48-year-old Chinese national who was arrested on suspicion of driving around with an illegal small base station (femtocell) loaded in a vehicle, said in questioning, "Those higher up told me that during the day there are many people and the signal is hard to catch, so move in the early morning." Police believe this statement could be an important clue to identifying how the femtocell operates.
A femtocell is a base station composed of communications equipment and antennas, and A is suspected of touring large apartment complexes in the Seoul metropolitan area, intercepting mobile phone signals, and inducing micro-payments such as buying mobile gift certificates and topping up transit cards. When A was apprehended, police seized a femtocell from the vehicle and additionally confiscated equipment that was about to be shipped out to China from Pyeongtaek Port.
A currently claims that the equipment was loaded in the vehicle and moved under orders from superiors, so the full picture of the case has not yet been identified. Police have formed a joint investigation team with the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) and are expediting analysis of the femtocell, and A could be sent to prosecutors as early as the 25th.
As of 6 p.m. on the 22nd, police had identified 214 victims, totaling about 1.365 billion won. However, as reviews of reported cases continue, the amount is likely to grow. KT earlier revised the tally from 278 victims and 1.007 billion won to 362 victims and 2.4 billion won, and the affected areas expanded beyond Geumcheon and Gwangmyeong in Seoul to Seocho and Dongjak, and to Goyang in Gyeonggi Province.