The scammers have tricked millions of people worldwide, including thousands of Norwegians, through text messages. Who are they and how do they scam us?
A stream of text messages is being sent to mobile users across the globe.
The messages are crafted to deceive us.
The scammers never expected you to see this video.
NRK got hold of it from one of several scammer groups on the messaging app Read the Norwegian version of this story here.
The members of the scam groups communicate in Chinese and hide behind cryptic usernames. One of the most active members goes by the name x667788x.
For simplicity, NRK refers to him as x66.
He uses a Chinese cartoon wolf as his profile picture.
x66 uses a Chinese cartoon wolf as his profile picture on Telegram.
x66 often boasts about how much money he has made by scamming others. In a picture he has shared, a diamond ring shaped like a venomous snake flashes on the left index finger.
The ring is from the Italian luxury brand Bulgari. If it’s genuine, it has a list price of over 300,000 Norwegian kroner (NOK).
Even though x66 shares a lot on Telegram, there is one thing he is very careful about: never showing his face.
No one can know who he is.
But everyone makes mistakes.
IT security expert Erlend Leiknes had no intention of becoming a scam hunter.
IT security expert Erlend Leiknes from the company Mnemonic.
Until this text message appeared on his mobile one day:
There was a lot that seemed off: the spelling mistake, the sender’s contact info, and the strange url embedded in the message.
Leiknes recognized this as phishing — a scam method where culprits fish for sensitive information in order to steal someone’s identity or money.
But who was trying to reel him in?
He sat down with his American colleague Harrison Sand. Both work at the company Mnemonic, a cyber security service provider, based in Oslo.
Erlend Leiknes and Harrison Sand working at Mnemonic.
They decided to try to sneak up on the person behind the text message.
They clicked on the link to analyze the scam website. They found a loophole in the site’s code that allowed them to see what was going on behind the scenes.
What they discovered left them astonished.
Hundreds of names, addresses, and bank card details scrolled across the screen. Many of them were Norwegian.
The data experts had accessed the scammer’s hub.
And perhaps the most striking part was: They were now watching as people entered their card details.
These were people who, at that very moment, were taking the bait.
I was shocked by how many victims there were.
The data experts investigated further and gained access to a closed group on Telegram.
A new world unfolded.
The group had several hundred members that shared videos of mobile phones sending out deceptive text messages. They also showcased card terminals to charge the stolen cards, and images of luxury goods they purchased. The data experts had discovered a marketplace for phishing activities.
Essentially, the scammers’ fish market.
A scammer posted a picture of several pairs of shoes that appear to be from the luxury brand Valentino.
A scammer uploads an image of multiple card terminals. The scammers drain bank cards on such terminals.
Several boxes that appear to contain iPhones are shared in the scam group. These are used to send out scam messages or to load stolen cards into digital wallets.
A scammer displays a stack of American hundred-dollar bills.
In the group, members also discussed strategies for scamming as many people as possible. They referred to those who got fooled as «fish» and shared where the fish were biting now.
One of the most active members was the one who goes by the name x66.
Below is an excerpt from a typical dialogue:
How many of us have they deceived?
At the Mnemonic offices in Oslo, Leiknes and Sand worked for several weeks. The scam hub they had discovered was only the beginning.
It wasn’t just one scam hub, but several hundred.
IT security experts Sand and Leiknes working with coding.
Through a digital backdoor, they managed to access all of them.
There, they found lists with millions of names, addresses, and card details.
This was information that the scammers had reeled in.
The information had been collected through deceptive messages over the course of seven months in 2023 and 2024.
NRK has analyzed the lists in detail to assess the scope of the scammers’ global operations:
For Norway, the figures for those seven months are as follows:
Here is a table showing the number of people deceived worldwide specified by country.
Scammers are stealing money from people all around the world.
How exactly do they do it?
They use their super weapon — one of the most spectacular items at the fish market.
A custom-made software for text message scams: Magic Cat.
It makes it much easier for people with good data skills to try their hand at being scammers. Nevertheless, much more than the software is required to succeed.
NRK has gained access to the Magic Cat software and investigated how it works.
The program allows you to choose from over 300 fake websites looking like the original websites of well-known companies from almost every country in the world.
If you want to scam Norwegians, you can choose between look-alike sites representing The national toll road service in Norway</p> ” data-term=”Autopass”>Autopass.
For other countries, you can pretend to be Amazon, the U.S. Postal Service (USPS) or the British Royal Mail.
There are no fake websites available in Chinese.
Here you can see some of the fake website templates:
Magic Cat can be used by anyone, if they pay for the license. A license costs as little as 1500 NOK per week.
See an overview of all the fake websites here.
1: Text Message with a Link
The scammer sends you a text message claiming a bill needs to be paid, or that your address must be updated before a package can be delivered.
2: Fake Website
The text message includes a link leading to a fake website. Here is an example of one such website in Norwegian:
3: You Give Away Your Details
If you click further, you’ll encounter a form to fill in your name, address, and card details to pay a small fee.
While you fill out the form, the scammer monitors and saves everything.
Below is what you see on your phone, and what the scammer sees simultaneously on his computer.
4: Activation Code
This allows the scammer to add your card to a digital wallet, such as Apple Pay or Google Pay, on their mobile phone. Since it’s your card being added, your bank sends you an activation code, often as a text message.
5: The Scammer Has Taken Your Card
You enter the code on the fake website, believing it’s necessary to complete the payment of the fee. The scammer sees the code you type in and uses it to activate your card in their digital wallet.
Now the scammer can make purchases with your card without a PIN code.
x66 sits in an apartment with Telegram open on his computer screen. Outside the apartment, some tall buildings are visible.
This apartment appears in several images shared by x66. On a shelf in the apartment are several bear figures, which are collectibles and can cost several thousand kroner.
But where in the world is he located?
NRK has analyzed hundreds of videos and images x66 has shared on Telegram, searching for places he frequents, personal characteristics, and shopping patterns.
Receipts he posts after luxury shopping indicate he has spent at least 200,000 NOK.
On Telegram, he shares many images of luxury items he has purchased.
On Telegram, the scammer x66 posts many pictures of luxury goods he has purchased, like here where he is carrying a bag from Louis Vuitton. The pictures are marked with his username x667788x. He has blurred this image himself.
On Telegram, the scammer x66 posts many pictures of luxury goods he has purchased, like here where he is carrying a bag from Louis Vuitton. The pictures are marked with his username x667788x. He has blurred this image himself.
X66 has a particular fondness for the French luxury brand Louis Vuitton and its distinctive monogram.
NRK has pinpointed several of the stores he has posted receipts from. They are located in a popular shopping area in Bangkok.
x66 enjoys having a drink and partying in the city.
Staff at a nightclub in Bangkok serve bottles of alcohol.
A staff member at a nightclub in Bangkok serves x66.
One of the bars he posts many images from is also in Bangkok.
One day, he writes in the Telegram group where he is:
In a video from May last year, while using the software to scam people worldwide, he makes a mistake.
A mistake that will lead us to him.
A couple of seconds is all it takes.
– Don’t give them any information, they’re scammers!
This is shouted in the background when NRK calls Bjørnar Skogstad, aged 73. We have found his name on the scammers’ lists.
– Have I been scammed? Yes, let me tell you!
Then he becomes quiet.
For is it really NRK calling? Or is he about to be scammed again?
Only after Skogstad has seen the NRK badge and his bank has given the green light, he welcomes us to his home.
Bjørnar Skogstad and his cat Farsi in the garage.
Bjørnar Skogstad and his cat Farsi in the garage.
Skogstad lives in a yellow house at the foot of the mountain Svartfjell on the island of Senja in Northern Norway.
He was sitting in his living room when he received a text message last January.
– It said I had an unpaid bill from Autopass. And I’m very meticulous about paying such things, so I just clicked the link in the message, he explains.
The link led to a website that appeared to be Autopass. This fake website is a lookalike of autopass.no. The screenshot is taken from the scammers’ software Magic Cat.
The fake look-alike website of autopass.no. This image is taken from the software Magic Cat.
The fake look-alike website of autopass.no. This image is taken from the software Magic Cat.
Here, he entered his card details and put down his phone.
He didn’t know he had visited a fake website, but shortly after, he got a bad feeling.
Bjørnar Skogstad received a message and was deceived while he was sitting in his living room in Senja.
Bjørnar Skogstad received a message and was deceived while he was sitting in his living room in Senja.
Upon further thought, there are no toll roads on the island of Senja. The nearest is in the city of Tromsø, over two hours’ drive away.
– I hadn’t been to Tromsø, he says.
Skogstad quickly got on the phone to the bank to block his card.
For twenty minutes, he listened to the on-hold music playing.
When he finally got through, it was too late.
1,900 NOK had disappeared from the account, before the card was closed by the bank.
Others have been scammed for both 10,000 and over 100,000 NOK, according to documentation provided to NRK.
Bjørnar Skogstad reported the scam to the police, who closed the case without an investigation.

– It would require too many resources, given the low severity of the case, to attempt to identify the perpetrator, says Elin Norgård Strand, head of prosecution in Troms Police District.
Skogstad, however, got his money, minus a deductible, back from the bank.
– If the bank had responded immediately when I called, I could have avoided the scam, says Skogstad.
Morten Tønder Albertsen, head of communications at Sparebank1 Nord-Norge, apologizes for the long wait time. He adds that the bank has since implemented a dedicated phone option for customers who suspect fraud.
NRK has shown Skogstad the boastful images posted by the scammers in the Telegram group. The old man gets fired up and is not merciful:
– If they had dared to meet me face to face, I would have beaten them to death. That is what they deserve, since they are stealing from elderly people.
Bjørnar Skogstad outside his home in Senja, Northern Norway
Bjørnar Skogstad outside his home in Senja, Northern Norway
Posten:
– The most important assurance we provide to our customers is that we never send out SMS or emails with links where they should enter card numbers, says Kenneth Tjønndal Pettersen, head of press at Posten Norway.
Instead, Posten uses its own app and website to provide information about parcels that are on the way.
– Why do you think scammers impersonate Posten?
– Posten is Norway’s oldest company and one that many people trust. Criminals want to exploit that trust.
– What do you do to prevent being misused by scammers?
– We inform customers about attempted scams and give them advice on how to avoid being deceived. We also update our website and offer online courses where people can learn about scam prevention.
Autopass:
– We find it alarming that scammers use Autopass as a pretext to deceive people, says Bjørn Roar Eriksen.
He is the section leader at the Norwegian Public Roads Administration and head of Autopass. In recent years, the roads administration has warned against Autopass scams through press releases, media coverage, and social media channels.
– Why do you think SMS scammers choose Autopass?
– I can’t speculate on that, but it is a well-known product familiar to many. There are autopass signs along the roads, making it a very visible brand name.
– Does Autopass ever send out SMS with links?
– No, we do not.
The 19,000 individuals in Norway who have taken the bait and provided bank card details to scammers live all over the country, from Longyearbyen in the north to Kristiansand in the south.
NRK has talked to around 140 of them. They are professors, students, NRK staff, pastors, teachers, lawyers, and business owners.
Some were unaware they had been scammed until NRK reached out.
Others refused to believe it, even though their names and card details were on the scammers’ lists.
A few felt embarrassed or ashamed when we called. A highly educated man, who agreed to be interviewed, later withdrew from this story.
In the video posted by x66, a phone number is visible for a couple of seconds. The number on x66’s mobile is registered in Thailand.
Screenshot from the video where x66 reveals a phone number. NRK has blurred the number.
Screenshot from the video where x66 reveals a phone number. NRK has blurred the number.
NRK has investigated if the number can be linked to other profiles on social media. It is indeed tied to a profile on a