Inside the Scam Network

A stream of text messages is being sent to mobile users across the globe.

The messages are crafted to deceive us.

The scammers never expected you to see this video.

NRK got hold of it from one of several scammer groups on the messaging app Telegram.

The scammers don't know that NRK has been monitoring them for a year. We've read over 40,000 chat messages between them to understand how the scam works.

The scammers have tricked millions of people worldwide, including thousands of Norwegians.

Who are they, really?

NORWEGIAN VERSION: Read the Norwegian version of this story here.

x66

The members of the scam groups communicate in Chinese and hide behind cryptic usernames. One of the most active members goes by the name x667788x.

For simplicity, NRK refers to him as x66.

He uses a Chinese cartoon wolf as his profile picture.

x66 often boasts about how much money he has made by scamming others. In a picture he has shared, a diamond ring shaped like a venomous snake flashes on the left index finger.

The ring is from the Italian luxury brand Bulgari. If it's genuine, it has a list price of over 300,000 Norwegian kroner (NOK).

Even though x66 shares a lot on Telegram, there is one thing he is very careful about: never showing his face.

No one can know who he is.

But everyone makes mistakes.

The Scam Hunters

IT security expert Erlend Leiknes had no intention of becoming a scam hunter.

Until this text message appeared on his mobile one day:

There was a lot that seemed off: the spelling mistake, the sender's contact info, and the strange url embedded in the message.

Leiknes recognized this as phishing — a scam method where culprits fish for sensitive information in order to steal someone's identity or money.

But who was trying to reel him in?

He sat down with his American colleague Harrison Sand. Both work at the company Mnemonic, a cyber security service provider, based in Oslo.

They decided to try to sneak up on the person behind the text message.

They clicked on the link to analyze the scam website. They found a loophole in the site's code that allowed them to see what was going on behind the scenes.

What they discovered left them astonished.

The Fish Market

Hundreds of names, addresses, and bank card details scrolled across the screen. Many of them were Norwegian.

The data experts had accessed the scammer's hub.

And perhaps the most striking part was: They were now watching as people entered their card details.

These were people who, at that very moment, were taking the bait.

The data experts investigated further and gained access to a closed group on Telegram.

A new world unfolded.

The group had several hundred members that shared videos of mobile phones sending out deceptive text messages. They also showcased card terminals to charge the stolen cards, and images of luxury goods they purchased. The data experts had discovered a marketplace for phishing activities.

Essentially, the scammers' fish market.

In the group, members also discussed strategies for scamming as many people as possible. They referred to those who got fooled as «fish» and shared where the fish were biting now.

One of the most active members was the one who goes by the name x66.

Below is an excerpt from a typical dialogue:

How many of us have they deceived?

The Scammers' Lists

At the Mnemonic offices in Oslo, Leiknes and Sand worked for several weeks. The scam hub they had discovered was only the beginning.

It wasn't just one scam hub, but several hundred.

Through a digital backdoor, they managed to access all of them.

There, they found lists with millions of names, addresses, and card details.

This was information that the scammers had reeled in.

The information had been collected through deceptive messages over the course of seven months in 2023 and 2024.

NRK has analyzed the lists in detail to assess the scope of the scammers' global operations:

• Over 13 million have clicked on the links embedded in the scam text messages.
• A total of 884,000 cards were captured from people worldwide.
• Over 600 scam operators were behind these text messages.

For Norway, the figures for those seven months are as follows:

• 138,000 times someone in Norway clicked on the link in a scam message.
• 19,000 of these provided card details on the fraudulent website.
• 2,900 of these additionally provided the code to activate bank cards in a digital wallet.

Here is a table showing the number of people deceived worldwide specified by country.

The Super Weapon

Scammers are stealing money from people all around the world.

How exactly do they do it?

They use their super weapon — one of the most spectacular items at the fish market.

A custom-made software for text message scams: Magic Cat.

It makes it much easier for people with good data skills to try their hand at being scammers. Nevertheless, much more than the software is required to succeed.

NRK has gained access to the Magic Cat software and investigated how it works.

The program allows you to choose from over 300 fake websites looking like the original websites of well-known companies from almost every country in the world.

If you want to scam Norwegians, you can choose between look-alike sites representing Posten or Autopass.

For other countries, you can pretend to be Amazon, the U.S. Postal Service (USPS) or the British Royal Mail.

There are no fake websites available in Chinese.

Here you can see some of the fake website templates:

Magic Cat can be used by anyone, if they pay for the license. A license costs as little as 1500 NOK per week.

See an overview of all the fake websites here.

How You Get Scammed:

1: Text Message with a Link

The scammer sends you a text message claiming a bill needs to be paid, or that your address must be updated before a package can be delivered.

2: Fake Website

The text message includes a link leading to a fake website. Here is an example of one such website in Norwegian:

3: You Give Away Your Details

If you click further, you'll encounter a form to fill in your name, address, and card details to pay a small fee.

While you fill out the form, the scammer monitors and saves everything.

Below is what you see on your phone, and what the scammer sees simultaneously on his computer.

4: Activation Code

This allows the scammer to add your card to a digital wallet, such as Apple Pay or Google Pay, on their mobile phone. Since it's your card being added, your bank sends you an activation code, often as a text message.

5: The Scammer Has Taken Your Card

You enter the code on the fake website, believing it's necessary to complete the payment of the fee. The scammer sees the code you type in and uses it to activate your card in their digital wallet.

Now the scammer can make purchases with your card without a PIN code.

The Luxury Life

x66 sits in an apartment with Telegram open on his computer screen. Outside the apartment, some tall buildings are visible.

But where in the world is he located?

NRK has analyzed hundreds of videos and images x66 has shared on Telegram, searching for places he frequents, personal characteristics, and shopping patterns.

Receipts he posts after luxury shopping indicate he has spent at least 200,000 NOK.

On Telegram, he shares many images of luxury items he has purchased.

X66 has a particular fondness for the French luxury brand Louis Vuitton and its distinctive monogram.

NRK has pinpointed several of the stores he has posted receipts from. They are located in a popular shopping area in Bangkok.

x66 enjoys having a drink and partying in the city.

One of the bars he posts many images from is also in Bangkok.

One day, he writes in the Telegram group where he is:

In a video from May last year, while using the software to scam people worldwide, he makes a mistake.

A mistake that will lead us to him.

A couple of seconds is all it takes.

– I Just Clicked

– Don't give them any information, they're scammers!

This is shouted in the background when NRK calls Bjørnar Skogstad, aged 73. We have found his name on the scammers' lists.

– Have I been scammed? Yes, let me tell you!

Then he becomes quiet.

For is it really NRK calling? Or is he about to be scammed again?

Only after Skogstad has seen the NRK badge and his bank has given the green light, he welcomes us to his home.

Skogstad lives in a yellow house at the foot of the mountain Svartfjell on the island of Senja in Northern Norway.

He was sitting in his living room when he received a text message last January.

– It said I had an unpaid bill from Autopass. And I'm very meticulous about paying such things, so I just clicked the link in the message, he explains.

The link led to a website that appeared to be Autopass. This fake website is a lookalike of autopass.no. The screenshot is taken from the scammers' software Magic Cat.

Here, he entered his card details and put down his phone.

He didn’t know he had visited a fake website, but shortly after, he got a bad feeling.

Upon further thought, there are no toll roads on the island of Senja. The nearest is in the city of Tromsø, over two hours' drive away.

– I hadn't been to Tromsø, he says.

Skogstad quickly got on the phone to the bank to block his card.

For twenty minutes, he listened to the on-hold music playing.

When he finally got through, it was too late.

Unforgiving

1,900 NOK had disappeared from the account, before the card was closed by the bank.

Others have been scammed for both 10,000 and over 100,000 NOK, according to documentation provided to NRK.

Bjørnar Skogstad reported the scam to the police, who closed the case without an investigation.

– It would require too many resources, given the low severity of the case, to attempt to identify the perpetrator, says Elin Norgård Strand, head of prosecution in Troms Police District.

Skogstad, however, got his money, minus a deductible, back from the bank.

– If the bank had responded immediately when I called, I could have avoided the scam, says Skogstad.

Morten Tønder Albertsen, head of communications at Sparebank1 Nord-Norge, apologizes for the long wait time. He adds that the bank has since implemented a dedicated phone option for customers who suspect fraud.

NRK has shown Skogstad the boastful images posted by the scammers in the Telegram group. The old man gets fired up and is not merciful:

– If they had dared to meet me face to face, I would have beaten them to death. That is what they deserve, since they are stealing from elderly people.

Some Were Unaware

The 19,000 individuals in Norway who have taken the bait and provided bank card details to scammers live all over the country, from Longyearbyen in the north to Kristiansand in the south.

NRK has talked to around 140 of them. They are professors, students, NRK staff, pastors, teachers, lawyers, and business owners.

Some were unaware they had been scammed until NRK reached out.

Others refused to believe it, even though their names and card details were on the scammers' lists.

A few felt embarrassed or ashamed when we called. A highly educated man, who agreed to be interviewed, later withdrew from this story.

The Car with a Starry Sky

In the video posted by x66, a phone number is visible for a couple of seconds. The number on x66's mobile is registered in Thailand.

NRK has investigated if the number can be linked to other profiles on social media. It is indeed tied to a profile on a messaging service popular in Asia.

A person using the profile calls himself «Kris». The profile picture shows a young man sitting in an elegant car with a starry sky on the ceiling.

Could he be x66?

NRK has investigated further and found the same image as the profile picture for an account on Instagram:

The person behind this account also calls himself Kris. He has both a Chinese and Thai flag on his profile.

Kris does not post much, but what is posted looks familiar. If you compare images that the scammer x66 has posted on Telegram with those Kris shares on Instagram, the resemblance is striking:

Both have - on the same day - shared an almost identical photo of the entrance to an exclusive Japanese restaurant in Bangkok.

Both images were published the same day. One on Telegram by the person calling himself x66. The other on Instagram by the person calling himself Kris.

There is evidently a connection between the scammer x66 and Kris.

Can we find him in Bangkok?

Searching the Streets of Bangkok

– Is this receipt real?

NRK is standing inside a Louis Vuitton store in Bangkok. We show the store manager a copy of a receipt that x66 posted in the scam group.

The store manager confirms it looks authentic but doesn't say more about it.

It is over thirty degrees in Thailand's capital, and the streets are crowded with people.

We are following in the footsteps of x66, whom we believe is the same person as Kris on Instagram.

We want to ask him why he is scamming Norwegians using Magic Cat.

NRK has noticed that Kris has a follower on Instagram called "Ken."

He has both a Chinese and Thai flag on his profile, just like Kris. NRK's investigation suggests that Ken is somehow connected to the scammer x66. Unlike Kris, Ken shares generously on Instagram about where he parties and spends his time in Bangkok.

Perhaps the easiest way to find Kris is through his friend Ken?

NRK visits the places Ken frequents, searching for him.

«You're Looking for Me»

– Do you know who took this picture of you?

The man we are talking to works at a popular bar in Bangkok. NRK holds up a mobile phone with a picture that Ken posted on Instagram. Could the man know Ken?

– It's Ken, the man says immediately, as loud music plays in the background.

After we leave the bar, the man comes running after us.

– Ken says he doesn't know who you are. He wants to talk to you.

The man gives us Ken's contact info, and shortly after, we receive a message.

I Know Who It Is

– We believe you are using Magic Cat to send messages to people, leading them to fake websites.

NRK speaks with Ken over the phone from a hotel room in Bangkok. He refuses to meet with us.

– Okay, I see. If you have any evidence, you can go to the police station, Ken responds.

We ask Ken if he works with x66.

– I am self-employed and have my own company.

– Is x66 a friend of yours? A colleague?

– No, I don't understand what you're talking about.

We then ask if he knows Kris, who NRK has linked to x66. He denies it at first, but after some thought, he says:

– I know him, but he is not my friend.

NRK informs Ken of the documentation we have regarding his connection to x66 and the scam messages.

– You've got the wrong person, understood? he says.

Shortly after the conversation with Ken ends, something happens.

More than half of the images from Kris's Instagram profile disappear, including several photos showing his face. Additionally, the name of the account changes.

Later that evening, Ken sends us a message saying we should visit him, so he can beat us up.

He includes this photo:

«I am in Canada»

The next day, NRK decides to try the Thai phone number that x66 inadvertently revealed for a few seconds.

No one answers, but we receive a message:

«Who is it?»

We explain about Ken and say we believe the person we are messaging knows him. However, the person we are messaging insists we have the wrong person.

«I'm not in Bangkok. I am in Canada.»

Before NRK mentions anything about fraud, this person, like Ken, refers us to the police:

«If others cheat you, you can go to the police. There is nothing to talk about.»

We then mention that we want to speak about Magic Cat and receive a reply:

«Who is magic cat?»

Norwegian Bank Cards

Since both Ken and the person behind the other number claim NRK has the wrong person, we contact x66 directly via Telegram, the platform where he shows off his scammer lifestyle.

Before revealing that we are journalists, he mentions Norway as a good place to fish for bank card details.

As evidence, he sends two pictures of Norwegian bank cards that he has deceitfully obtained and added to his digital wallet.

One of them is the Visa card from the norwegian bank DNB that has already been shown in this story:

x66 has collected over 10,600 bank cards worldwide using Magic Cat, according to data NRK has obtained.

Then we show him Kris's profile picture on Instagram — the young man in the car with a starry sky. Is it him?

x66 claims the image is taken from the internet and that it shows someone else. Then he tells us something intriguing: He claims to know the person behind Magic Cat.

«I am x66»

Then, we reveal that we are journalists and what we plan to publish. The tone changes dramatically.

We ask x66 if he wants to comment on this matter and what he believes is wrong with NRK's investigations.

Shortly after, he deletes the entire conversation. Then Kris's account disappears from Instagram.

The Boss

Who is the boss that x66 was talking about? The person behind Magic Cat?

While x66 uses the super weapon and boasts about his success, there is a mysterious figure lurking in the shadows.

This is the architect behind Magic Cat.

He is responsible for enabling x66 and hundreds of other scammers to deceive us.

Many have tried to find him, without success.

Can we succeed?

Read part two:

Also read: Mnemonic's technical report from their investigation.