Seoul Metropolitan Police Agency cybercrime detectives arrested 14 suspects Monday on allegations they operated a subscription-trap scheme that auto-billed victims after fake streaming-service renewal pages harvested card numbers, according to a police press statement InfoHandle translated from Korean.
How the ring allegedly worked
Investigators said the group bought social-media ads mimicking major video platforms, then routed clicks to cloned billing portals that charged small recurring amounts—often under 30,000 won—to stay below issuer fraud thresholds. Victims who disputed charges were told to email disposable support addresses while operators cycled merchant IDs. Police said the ring moved an estimated 2.1 billion won over six months before financial institution fraud units flagged overlapping merchant patterns.
Arrest scope
Fourteen people were detained on suspicion of electronic financial fraud and violation of information-network laws; police did not release personal names pending prosecution review. Officers seized 312 phones, 47 laptops, and merchant contracts from a Gangnam office suite and two Incheon logistics flats used as call centers.
Bank and platform response
KISA had warned in September about micro-subscription phishing ahead of Chuseok travel, when consumers check entertainment apps frequently. Card issuers told FSS listeners they are tightening recurring-payment alerts, but police said traps exploit merchant-category codes that still look like legitimate digital goods.
Consumer steps
Police urged users to cancel unfamiliar recurring charges through issuer apps rather than links in text messages, and to file reports via the 182 anti-fraud hotline. Dongwook Han's desk repeats: no streaming service demands full card re-entry on a subdomain that is not the official app store listing.
What we do not know
Investigators have not said whether overseas laundering was involved or which streaming brands' trademarks were counterfeited most often. Trials have not started; allegations remain unproved in court.
Issuer cooperation
Major card issuers said they reversed 412 million won in disputed micro-charges linked to the ring's merchant IDs after police shared hashes, according to the statement. That cooperation does not restore data victims already lost to phishing pages.
Prosecution timeline
Prosecutors have 20 days to decide on formal indictments; police said additional accomplices may be identified through ad-buy ledgers seized from the Gangnam office.
How the trap worked
Investigators said the ring cloned billing pages for major streaming brands and pushed victims through search ads priced in won. After a one-won test charge, scripts enrolled users in recurring 49,900-won monthly plans without clear cancel buttons. Detectives seized 23 servers in Gangnam and Incheon data centers and froze accounts holding roughly 4.2 billion won in suspected proceeds, according to the police statement InfoHandle reviewed.
Consumer agency overlap
The Fair Trade Commission opened a parallel review of whether fake cancellation flows violate electronic commerce disclosure rules. Banks that processed the micro-charges face Financial Supervisory Service questions about merchant category codes that hid recurring flags. Police asked app stores to delist three sideloaded APKs that mimicked legitimate Android clients.
What changes for subscribers
Seoul's cyber bureau published screenshot checklists—verify HTTPS domains, read pre-checked boxes, and dispute charges within 60 days through card issuers. Telecom carriers agreed to block SMS links that spoof Netflix and Coupang Play domains during October. None of that replaces criminal probes, but it gives households a faster path while prosecutors prepare indictments.