Investigators from the National Police Agency’s Cyber Investigation Bureau raided a leased warehouse in Bucheon’s Jung district before dawn Sunday, seizing 412 GSM gateway units, 1,900 unused prepaid SIM cards, and three laptop stacks running auto-dial scripts, according to a briefing sheet reviewed by InfoHandle. Police said the hardware could rotate more than 2,400 outbound numbers per hour—capacity they linked to voice-phishing crews targeting Chuseok remittance traffic.
What was in the warehouse
The site sat behind a logistics firm sign with no telecom branding. Inside, metal racks held eight-port gateways cabled to ceiling-mounted antennas patched through a vent cut in the corrugated roof—a setup cyber bureau technicians said was meant to avoid in-building signal repeaters that carriers can fingerprint. Officers also bagged ledgers listing “SIM burn rates” by mobile network, suggesting operators tracked when numbers were flagged and swapped.
Three tenants were detained for questioning; none have been charged yet. Police declined to name the suspected ringleader, citing an ongoing joint file with the Financial Supervisory Service on mule account flows.
Carrier response
SK Telecom and KT told InfoHandle they had already flagged abnormal activation bursts from Bucheon cell sectors in August. LG Uplus said it will pause wholesale prepaid activations above fifty units per corporate ID until October, mirroring a Korea Communications Commission advisory issued after last spring’s loan-scam wave.
The KCC notice reminds MVNOs they must verify live video calls for bulk SIM pickups—a rule scammers circumvent by sending couriers with forged power-of-attorney scans. Sunday’s raid included KCC inspectors photographing serial numbers for a forthcoming mandatory gateway registry pilot.
Legal exposure
Under Korea’s Telecommunications Business Act and the Electronic Financial Transactions Act, operating unregistered relay equipment for fraud can trigger both criminal charges and fines against landlords who “should have known” about illicit tenants. Police said the warehouse lease was signed to a dormant construction firm—a pattern seen in prior Incheon SIM farm cases.
Prosecutors have not yet seized bank accounts tied to the site. Investigators are still mapping whether numbers from the farm reached overseas cryptocurrency on-ramps or domestic instant-transfer apps popular during holiday gift money spikes.
What is still unknown
It is unclear how long the farm ran at full capacity or whether any stolen credentials came from the same Bucheon IP range police traced in July. Whether gateway firmware was modified to spoof legitimate femtocell signatures—a trick described in internal carrier bulletins—remains under lab review.
Holiday timing
Voice-phishing losses reported to FSS hotlines rose 18 percent year-on-year in the two weeks before Chuseok last year. Cyber bureau officials said they moved on the warehouse now because scammers typically burn fresh SIM batches when remittance SMS traffic peaks mid-September.
Residents near the warehouse reported intermittent buzzing on mobile handsets but no outages; technicians said that symptom matches high-power gateway tests before dialers go live.
Police asked anyone who received account-verification calls from Bucheon-prefix numbers since August to file reports through the 112 cyber portal, even if no money moved—metadata from those complaints helped map the antenna array.
Forensic timeline
Digital forensics teams copied hard drives on-site and shipped gateways to a Suwon lab that catalogs firmware versions used in prior voice-phishing cases. Preliminary hashes matched two images seized in a 2025 Gimpo raid, suggesting a shared supplier network rather than copy-paste scripts alone.
Banking regulators joined the briefing to warn that mule accounts opened with SIMs from the farm may still be active; FSS sent hold notices to five institutions pending account reviews. Cyber bureau officials said they will publish anonymized IOCs for MVNO compliance teams once prosecutors clear the list.
Warehouse neighbors told officers the loading bay operated mostly between 01:00 and 05:00—hours that match spike patterns in carrier fraud dashboards. Lease documents show monthly rent paid in cash through a convenience-store transfer service, complicating ownership traces.
Detectives are tracing whether the same logistics front company leased a smaller unit in Siheung last year; if confirmed, prosecutors may bundle cases into a single telecom-fraud indictment before year-end.
