19th February 2025 – (Hong Kong) Hong Kong authorities have arrested a 23-year-old delivery worker suspected of using an illegal IMSI-catcher, commonly referred to as a “fake base station,” to distribute fraudulent text messages. These messages, bearing a deceptive “＃” prefix to impersonate verified senders, falsely appeared to originate from organisations such as AlipayHK, HKeToll, and SF Express. The scam led at least one victim to click on a phishing link, disclose credit card information, and suffer a financial loss of HK$22,000.
This is the first reported arrest involving the use of a fake base station for SMS fraud since the introduction of the Registered Sender Identity System in December 2023. The system was implemented to help users identify legitimate senders through a “＃” prefix. However, the suspect is accused of exploiting this mechanism to lend credibility to phishing scams.
Wan Chun-hong, Senior Inspector at the Cyber Security and Technology Crime Bureau, revealed that 28 complaints were filed beginning February 11, with victims reporting fraudulent text messages impersonating government agencies, courier services, and online payment platforms. These messages contained links to phishing websites designed to steal sensitive information. Wan emphasised that the phishing messages were crafted to mislead recipients into believing they originated from verified entities.
Following an investigation, police arrested the suspect in Mong Kok on 17th February. Officers seized two mobile phones and an operational fake base station from a van where the suspect was allegedly sending the messages. The individual remains in custody and faces potential charges of conspiracy to defraud.
Lo Tsz-him, a regulatory officer at the Office of the Communications Authority, explained that fake base stations exploit vulnerabilities in 2G networks, which only require one-sided authentication to transmit messages. He warned the public to stay alert if their phones unexpectedly switch to 2G before receiving suspicious messages, as this could indicate interference from a fake base station. Lo noted that these devices typically have limited range due to their low power output, restricting their impact to small areas. To maximise coverage, operators often move between locations in vehicles.
Wan Chun-hong further stressed the importance of public awareness, encouraging residents to verify suspicious messages directly with the relevant organisations. He urged caution and advised people not to click on links in unsolicited SMS messages.
Authorities are working closely with local telecom providers to enhance monitoring for abnormal signals and promptly report any irregularities. Investigations are ongoing to determine the origins of the IMSI-catcher and any financial benefits the suspect may have gained from the operation.
The police have reiterated that conspiracy to defraud is a serious offence under Hong Kong law, with a maximum penalty of 14 years in prison. They urged the public to remain vigilant and report any questionable messages to the Anti-Scam Helpline or through the Anti-Scam App for verification.

© 2021 DimSum Daily. ALL RIGHTS RESERVED.

source