Report, photo copyright by : Gan Yung Chyan, KUCINTA SETIA
Ms. Zhang, the victim, stated: "The other party claimed to be a staff member of Shenzhen Airlines. He said my flight the next morning was canceled due to aircraft malfunction, and I needed to rebook. He also said that because my package included free insurance, which was now in effect, he would refund my premium and provide compensation."
Because the other party accurately recited her name, flight number, and other key information, and explained the claims process in detail, Ms. Zhang gradually lowered her guard.
Ms. Zhang continued: "He first asked me on the phone if I had activated the corporate payment function on Alipay. He even showed me, and after confirming I didn't, he said that in that case, I might need someone from the insurance company to guide me in activating a corporate payment function on a bank card, and he would directly transfer the 300 yuan compensation to my account."
Induced to download software, entering passwords and verification codes as instructed
Under the other party's inducement, Ms. Zhang downloaded two software programs. Then, a person claiming to be "customer service from the insurance company" guided her through the software operations. Following the instructions, Ms. Zhang entered her personal information on a so-called "civil aviation customer service website" and also entered her password and verification code on a bank's official WeChat account.
Ms. Zhang, the victim, stated: "The other party never asked me for any verification codes or withdrawal passwords. He just asked me to enter these things on the screen, without clicking 'send.' So I lowered my guard, thinking that since he didn't ask for these things, it must be legitimate."
However, Ms. Zhang was unaware that her screen was being monitored in real time. Immediately after the transaction was completed, 430,000 yuan was transferred out in one go. Realizing the problem, Ms. Zhang immediately called 110 to report the crime.
The phone had been set up for call forwarding while Police raced against time to stop the loss
At this point, Ms. Zhang's phone had already been set up for call forwarding by the fraudsters. The police raced against time to stop the loss.
Yu Qipeng, a police officer from the Heping Branch of the Shenyang Public Security Bureau, explained: "Our first step upon arriving at the scene was to physically isolate the phone, because the other party still had control of it. This phone is now the crime scene. All the criminal clues are on this phone she was scammed on. Many victims, after being scammed, sometimes think they need to delete the fraudulent apps or restart their phones. These operations actually erase some criminal clues and evidence." However, the fraudsters tampered with the receiving account information, which presented the first hurdle to stopping the payment.
Wu Baihan, a police officer from the Criminal Investigation Detachment of the Shenyang Public Security Bureau, explained: "After receiving the report, we immediately inquired about the recipient's card number and then stopped the payment from the receiving account. However, this account was unusual because part of the account number was masked, replaced with asterisks. Therefore, we needed on-site police and our team to form a three-level联动 (three-level linkage) to obtain complete information about the recipient."
Successfully frozen over 380,000 Yuan, locking down the flow of remaining funds
With close cooperation both online and offline, the police successfully froze 382,000 yuan in the account within half an hour of receiving the report. However, the police discovered that the remaining 48,000 yuan did not remain but flowed to a company account in Hainan Province.
This is a new type of "shopping money laundering" method: fraudsters transfer stolen funds to legitimate company accounts to purchase goods, attempting to "launder" the funds through multiple layers of transactions, significantly increasing the difficulty of tracking.
Shenyang Public Security Bureau Heping Branch Police Officer Yu Qipeng: The most crucial aspect of this case was that we immediately identified the recipient of the payment account and contacted the account holder in the shortest possible time.
Within 3 hours of the incident, 430,000 Yuan scammed funds intercepted
Subsequently, the police contacted the merchant's manager overnight through the anti-fraud hotline. After understanding the situation, the merchant cooperated actively and suspended shipments. Ultimately, within 3 hours of the incident, all 430,000 yuan of scammed funds were intercepted.
A key step in the scam : Guiding download of software for remote phone control
In this case, Ms. Zhang's phone was easily controlled by the scammers because she believed them and clicked to download a specific software, which was a key step in the scam.
Shenyang Public Security Bureau Heping Branch Police Officer Yu Qipeng: This software is similar to Tencent Meeting, which requires entering a meeting ID to communicate; the other software is actually a remote control software that enables screen sharing, allowing the other party to see your phone screen and every step you take.
In other words, Ms. Zhang's phone was remotely controlled by the other party at that time.
Wu Bohan, a police officer from the Criminal Investigation Detachment of the Shenyang Municipal Public Security Bureau: Generally, if a mobile phone exhibits abnormal behavior such as screen freezing, overheating, unresponsive touch, screen flickering, or a black screen, it indicates that your phone has been controlled.
The National Anti-Fraud Center reminds the public that when receiving any calls or text messages regarding flight cancellations, delays, or rescheduling, never directly call back or click on links in the text message. Please immediately check the flight status through the airline's official website, official app, or official customer service hotline to verify the authenticity of the information.
Li Zhenkai, a police officer from the National Anti-Fraud Center: If you receive a call from someone claiming to be airline customer service who uses these keywords—first, that your flight is delayed; second, that your flight is overbooked; or third, that your flight has been rescheduled—and asks you to download screen-sharing software, you must be on high alert, as this is very likely a ticket refund/rescheduling scam.
