Three images in a grid. A boy takes a selfie inside an elevator, lots of Voss water and alcohol on a counter, and a racer car with a man dressed in black.

Inside the Scam Network

The scammers have tricked millions of people worldwide, including thousands of Norwegians, through text messages. Who are they and how do they scam us?

A stream of text messages is being sent to mobile users across the globe.

The messages are crafted to deceive us.

The scammers never expected you to see this video.

NRK got hold of it from one of several scammer groups on the messaging app Telegram.

The scammers don't know that NRK has been monitoring them for a year. We've read over 40,000 chat messages between them to understand how the scam works.

The scammers have tricked millions of people worldwide, including thousands of Norwegians.

:Does anybody know where this card is from?
:Skjermdump av et lite mastercard med tilhørende tekst ved siden av: re:member silver etterfult av kortnummer
:Seems to be from Norway.

Who are they, really?

NORWEGIAN VERSION: Read the Norwegian version of this story here.

x66

The members of the scam groups communicate in Chinese and hide behind cryptic usernames. One of the most active members goes by the name x667788x.

For simplicity, NRK refers to him as x66.

He uses a Chinese cartoon wolf as his profile picture.

Bildet viser en tegneserie-ulv med en rød hatt.

x66 uses a Chinese cartoon wolf as his profile picture on Telegram.

x66 often boasts about how much money he has made by scamming others. In a picture he has shared, a diamond ring shaped like a venomous snake flashes on the left index finger.

 A diamond ring shaped like a venomous snake flashes on his left index finger.

The ring is from the Italian luxury brand Bulgari. If it's genuine, it has a list price of over 300,000 Norwegian kroner (NOK).

Even though x66 shares a lot on Telegram, there is one thing he is very careful about: never showing his face.

No one can know who he is.

But everyone makes mistakes.

The Scam Hunters

IT security expert Erlend Leiknes had no intention of becoming a scam hunter.

Harrison Sand and Erlend Leiknes står ved siden av hverandre

IT security expert Erlend Leiknes from the company Mnemonic.

Foto: Javier Ernesto Auris Chavez / NRK

Until this text message appeared on his mobile one day:

ivya.chanduedivy@icloud.com:The paackage has arrived at the warehouse but could not be delivered due to incomplete address information. Please confirm your address using the link.

https://postens2no.shop
/NO/

There was a lot that seemed off: the spelling mistake, the sender's contact info, and the strange url embedded in the message.

Leiknes recognized this as phishing — a scam method where culprits fish for sensitive information in order to steal someone's identity or money.

But who was trying to reel him in?

He sat down with his American colleague Harrison Sand. Both work at the company Mnemonic, a cyber security service provider, based in Oslo.

Two men looking at a computer screen. Erlend Leiknes and Harrison Sand working at Mnemonic.

Erlend Leiknes and Harrison Sand working at Mnemonic.

Foto: Javier Ernesto Auris Chavez / NRK

They decided to try to sneak up on the person behind the text message.

They clicked on the link to analyze the scam website. They found a loophole in the site's code that allowed them to see what was going on behind the scenes.

What they discovered left them astonished.

The Fish Market

Hundreds of names, addresses, and bank card details scrolled across the screen. Many of them were Norwegian.

The data experts had accessed the scammer's hub.

And perhaps the most striking part was: They were now watching as people entered their card details.

These were people who, at that very moment, were taking the bait.

I was shocked by how many victims there were.

Harrison Sand Scam hunter

The data experts investigated further and gained access to a closed group on Telegram.

A new world unfolded.

The group had several hundred members that shared videos of mobile phones sending out deceptive text messages. They also showcased card terminals to charge the stolen cards, and images of luxury goods they purchased. The data experts had discovered a marketplace for phishing activities.

Essentially, the scammers' fish market.

  • Valentino shoes english version

    A scammer posted a picture of several pairs of shoes that appear to be from the luxury brand Valentino.

  • Seven bank terminals in different colours on a white table.

    A scammer uploads an image of multiple card terminals. The scammers drain bank cards on such terminals.

  • A big stack of iphone boxes on a table.

    Several boxes that appear to contain iPhones are shared in the scam group. These are used to send out scam messages or to load stolen cards into digital wallets.

  • A stack of american dollar bills shown by someone sitting in a car.

    A scammer displays a stack of American hundred-dollar bills.

In the group, members also discussed strategies for scamming as many people as possible. They referred to those who got fooled as «fish» and shared where the fish were biting now.

One of the most active members was the one who goes by the name x66.

Below is an excerpt from a typical dialogue:

x66:Thailand is a great place for fishing.
:I sent out 20 to 30,000 text messages today.
:Where there's a lot of fish, there's a lot of money.

How many of us have they deceived?

The Scammers' Lists

At the Mnemonic offices in Oslo, Leiknes and Sand worked for several weeks. The scam hub they had discovered was only the beginning.

It wasn't just one scam hub, but several hundred.

IT security experts working with coding on a screen

IT security experts Sand and Leiknes working with coding.

Foto: Javier Ernesto Auris Chavez / NRK

Through a digital backdoor, they managed to access all of them.

There, they found lists with millions of names, addresses, and card details.

This was information that the scammers had reeled in.

The information had been collected through deceptive messages over the course of seven months in 2023 and 2024.

NRK has analyzed the lists in detail to assess the scope of the scammers' global operations:

  • Over 13 million have clicked on the links embedded in the scam text messages.
  • A total of 884,000 cards were captured from people worldwide.
  • Over 600 scam operators were behind these text messages.

For Norway, the figures for those seven months are as follows:

  • 138,000 times someone in Norway clicked on the link in a scam message.
  • 19,000 of these provided card details on the fraudulent website.
  • 2,900 of these additionally provided the code to activate bank cards in a digital wallet.

Here is a table showing the number of people deceived worldwide specified by country.

The Super Weapon

Scammers are stealing money from people all around the world.

How exactly do they do it?

They use their super weapon — one of the most spectacular items at the fish market.

A custom-made software for text message scams: Magic Cat.

It makes it much easier for people with good data skills to try their hand at being scammers. Nevertheless, much more than the software is required to succeed.

NRK has gained access to the Magic Cat software and investigated how it works.

The program allows you to choose from over 300 fake websites looking like the original websites of well-known companies from almost every country in the world.

If you want to scam Norwegians, you can choose between look-alike sites representing Posten or Autopass.

For other countries, you can pretend to be Amazon, the U.S. Postal Service (USPS) or the British Royal Mail.

There are no fake websites available in Chinese.

Here you can see some of the fake website templates:

  • Utsnitt av en mobil med en svindelside som utgir seg for å være Posten.
  • Utsnitt av en mobil med en svindelside som utgir seg for å være Autopass.
  • Utsnitt av en mobil med en svindelside som utgir seg for å være Amazon.
  • Utsnitt av en mobil med en svindelside som utgir seg for å være  USPS.
  • Utsnitt av en mobil med en svindelside som utgir seg for å være Royal mail.

Magic Cat can be used by anyone, if they pay for the license. A license costs as little as 1500 NOK per week.

See an overview of all the fake websites here.

How You Get Scammed:

1: Text Message with a Link

The scammer sends you a text message claiming a bill needs to be paid, or that your address must be updated before a package can be delivered.

:The package has arrived at the warehouse and is on hold for delivery due to a missing number on the package. Please update:

https://posten.center/m
5kjHT

2: Fake Website

The text message includes a link leading to a fake website. Here is an example of one such website in Norwegian:

Fake website of posten.no

3: You Give Away Your Details

If you click further, you'll encounter a form to fill in your name, address, and card details to pay a small fee.

While you fill out the form, the scammer monitors and saves everything.

Below is what you see on your phone, and what the scammer sees simultaneously on his computer.

4: Activation Code

This allows the scammer to add your card to a digital wallet, such as Apple Pay or Google Pay, on their mobile phone. Since it's your card being added, your bank sends you an activation code, often as a text message.

My Bank:Your activation code for Google Pay is 946829.

Use the code to activate the card from My Bank, ending in 0329.

The code is valid for 5 minutes.

Best regards,
My Bank

5: The Scammer Has Taken Your Card

You enter the code on the fake website, believing it's necessary to complete the payment of the fee. The scammer sees the code you type in and uses it to activate your card in their digital wallet.

aktivert-kort
Grafikk: NRK
Grafikk: NRK

Now the scammer can make purchases with your card without a PIN code.

The Luxury Life

x66 sits in an apartment with Telegram open on his computer screen. Outside the apartment, some tall buildings are visible.

apartment x66
apartment x66 showing kitchen counter with a computer open on a table.

This apartment appears in several images shared by x66. On a shelf in the apartment are several bear figures, which are collectibles and can cost several thousand kroner.

But where in the world is he located?

NRK has analyzed hundreds of videos and images x66 has shared on Telegram, searching for places he frequents, personal characteristics, and shopping patterns.

Receipts he posts after luxury shopping indicate he has spent at least 200,000 NOK.

On Telegram, he shares many images of luxury items he has purchased.

A Man is holding what looks like a Louis Vuitton bag and receipt.

On Telegram, the scammer x66 posts many pictures of luxury goods he has purchased, like here where he is carrying a bag from Louis Vuitton. The pictures are marked with his username x667788x. He has blurred this image himself.

On Telegram, the scammer x66 posts many pictures of luxury goods he has purchased, like here where he is carrying a bag from Louis Vuitton. The pictures are marked with his username x667788x. He has blurred this image himself.

X66 has a particular fondness for the French luxury brand Louis Vuitton and its distinctive monogram.

NRK has pinpointed several of the stores he has posted receipts from. They are located in a popular shopping area in Bangkok.

x66 enjoys having a drink and partying in the city.

  • A gold bottle and other drinks clutter a table in a bar.
  • Girls working at a club holding up bottles of alcohol about to be served.

    Staff at a nightclub in Bangkok serve bottles of alcohol.

  • A man at a club is serving a costumer. The light is dark, but there is a lamp glowing on the table.

    A staff member at a nightclub in Bangkok serves x66.

One of the bars he posts many images from is also in Bangkok.

One day, he writes in the Telegram group where he is:

x66: I'm in Bangkok, and I'm going to take a picture of it.

In a video from May last year, while using the software to scam people worldwide, he makes a mistake.

A mistake that will lead us to him.

A couple of seconds is all it takes.

I Just Clicked

Don't give them any information, they're scammers!

This is shouted in the background when NRK calls Bjørnar Skogstad, aged 73. We have found his name on the scammers' lists.

Have I been scammed? Yes, let me tell you!

Then he becomes quiet.

For is it really NRK calling? Or is he about to be scammed again?

Only after Skogstad has seen the NRK badge and his bank has given the green light, he welcomes us to his home.

Bjørnar Skogstad and his cat in the garage

Bjørnar Skogstad and his cat Farsi in the garage.

Foto: Tone Gjerdi / NRK

Bjørnar Skogstad and his cat Farsi in the garage.

Foto: Tone Gjerdi / NRK

Skogstad lives in a yellow house at the foot of the mountain Svartfjell on the island of Senja in Northern Norway.

He was sitting in his living room when he received a text message last January.

It said I had an unpaid bill from Autopass. And I'm very meticulous about paying such things, so I just clicked the link in the message, he explains.

The link led to a website that appeared to be Autopass. This fake website is a lookalike of autopass.no. The screenshot is taken from the scammers' software Magic Cat.

The fake look-alike website of autopass.no.

The fake look-alike website of autopass.no. This image is taken from the software Magic Cat.

Grafikk: Ukjent

The fake look-alike website of autopass.no. This image is taken from the software Magic Cat.

Grafikk: Ukjent

Here, he entered his card details and put down his phone.

He didn’t know he had visited a fake website, but shortly after, he got a bad feeling.

Bjørnar Skogstad uses his mobile phone

Bjørnar Skogstad received a message and was deceived while he was sitting in his living room in Senja.

Foto: Tone Gjerdi / NRK

Bjørnar Skogstad received a message and was deceived while he was sitting in his living room in Senja.

Foto: Tone Gjerdi / NRK

Upon further thought, there are no toll roads on the island of Senja. The nearest is in the city of Tromsø, over two hours' drive away.

I hadn't been to Tromsø, he says.

Skogstad quickly got on the phone to the bank to block his card.

For twenty minutes, he listened to the on-hold music playing.

When he finally got through, it was too late.

Unforgiving

1,900 NOK had disappeared from the account, before the card was closed by the bank.

Others have been scammed for both 10,000 and over 100,000 NOK, according to documentation provided to NRK.

Bjørnar Skogstad reported the scam to the police, who closed the case without an investigation.

It would require too many resources, given the low severity of the case, to attempt to identify the perpetrator, says Elin Norgård Strand, head of prosecution in Troms Police District.

Skogstad, however, got his money, minus a deductible, back from the bank.

If the bank had responded immediately when I called, I could have avoided the scam, says Skogstad.

Morten Tønder Albertsen, head of communications at Sparebank1 Nord-Norge, apologizes for the long wait time. He adds that the bank has since implemented a dedicated phone option for customers who suspect fraud.

NRK has shown Skogstad the boastful images posted by the scammers in the Telegram group. The old man gets fired up and is not merciful:

If they had dared to meet me face to face, I would have beaten them to death. That is what they deserve, since they are stealing from elderly people.

Bjørnar Skogstad outside his home in Senja, Northern Norway

Bjørnar Skogstad outside his home in Senja, Northern Norway

Foto: Tone Gjerdi / NRK

Bjørnar Skogstad outside his home in Senja, Northern Norway

Foto: Tone Gjerdi / NRK

Some Were Unaware

The 19,000 individuals in Norway who have taken the bait and provided bank card details to scammers live all over the country, from Longyearbyen in the north to Kristiansand in the south.

NRK has talked to around 140 of them. They are professors, students, NRK staff, pastors, teachers, lawyers, and business owners.

Some were unaware they had been scammed until NRK reached out.

Others refused to believe it, even though their names and card details were on the scammers' lists.

A few felt embarrassed or ashamed when we called. A highly educated man, who agreed to be interviewed, later withdrew from this story.

The Car with a Starry Sky

In the video posted by x66, a phone number is visible for a couple of seconds. The number on x66's mobile is registered in Thailand.

Phone number on a screen

Screenshot from the video where x66 reveals a phone number. NRK has blurred the number.

Screenshot from the video where x66 reveals a phone number. NRK has blurred the number.

NRK has investigated if the number can be linked to other profiles on social media. It is indeed tied to a profile on a messaging service popular in Asia.

A person using the profile calls himself «Kris». The profile picture shows a young man sitting in an elegant car with a starry sky on the ceiling.

Could he be x66?

Person in a car with a starry ceiling

The profile picture is showing a person in a car with a starry sky.

The profile picture is showing a person in a car with a starry sky.

NRK has investigated further and found the same image as the profile picture for an account on Instagram:

A screenshot of the Instagram-page of the man calling himself Kris.

The same image is used on this Instagram profile. NRK has blurred parts of the Instagram account's name.

The same image is used on this Instagram profile. NRK has blurred parts of the Instagram account's name.

The person behind this account also calls himself Kris. He has both a Chinese and Thai flag on his profile.

Kris does not post much, but what is posted looks familiar. If you compare images that the scammer x66 has posted on Telegram with those Kris shares on Instagram, the resemblance is striking:

Shared on Telegram by x66
Two fancy parked after each other, one white and one red.
Shared on Instagram by Kris
Fancy cars parked by the side of the road in the sunset.

Two fancy cars, one white and one red, are parked along the water with the sunset in the background.

Both have - on the same day - shared an almost identical photo of the entrance to an exclusive Japanese restaurant in Bangkok.

Shared on Instagram by Kris
The front of a japanese restaurant in the nighttime.
Shared on Telegram by x66
The front of a japanese restaurant in the nighttime.

Both have - on the same day - shared an identical photo of the entrance to an exclusive Japanese restaurant in Bangkok.

Both images were published the same day. One on Telegram by the person calling himself x66. The other on Instagram by the person calling himself Kris.

There is evidently a connection between the scammer x66 and Kris.

Can we find him in Bangkok?

Searching the Streets of Bangkok

Is this receipt real?

NRK is standing inside a Louis Vuitton store in Bangkok. We show the store manager a copy of a receipt that x66 posted in the scam group.

The store manager confirms it looks authentic but doesn't say more about it.

It is over thirty degrees in Thailand's capital, and the streets are crowded with people.

We are following in the footsteps of x66, whom we believe is the same person as Kris on Instagram.

We want to ask him why he is scamming Norwegians using Magic Cat.

  • A japanese restaurant in Bangkok in the daytime, with the gates open.

    The restaurant in Bangkok that both x66 and Kris posted a picture of on the same day.

  • Storefronts at a shopping mall in Bangkok where x66 may have purchased several of the designer clothes and jewelry he boasts about on Telegram.

    The shopping mall in Bangkok where x66 may have purchased several of the designer clothes and jewelry he boasts about on Telegram.

NRK has noticed that Kris has a follower on Instagram called "Ken."

He has both a Chinese and Thai flag on his profile, just like Kris. NRK's investigation suggests that Ken is somehow connected to the scammer x66. Unlike Kris, Ken shares generously on Instagram about where he parties and spends his time in Bangkok.

Perhaps the easiest way to find Kris is through his friend Ken?

NRK visits the places Ken frequents, searching for him.

Shared by Ken
A guy is posing in front of a neon sign on a wall that has angelwings and devil horns.
NRK in the same place
Neon sign in Bangkok showing angel wings and devil horns.
Shared by Ken
A guy sits outside on a sofa, posing with sunglasses on. He is wearing sneakers, a white shirt and denim vest.
NRK in the same place
A man is sitting outside working on a bench outside.

«You're Looking for Me»

Do you know who took this picture of you?

The man we are talking to works at a popular bar in Bangkok. NRK holds up a mobile phone with a picture that Ken posted on Instagram. Could the man know Ken?

It's Ken, the man says immediately, as loud music plays in the background.

After we leave the bar, the man comes running after us.

Ken says he doesn't know who you are. He wants to talk to you.

The man gives us Ken's contact info, and shortly after, we receive a message.

Ken:Hi (...) I was told you are looking for me.

I Know Who It Is

We believe you are using Magic Cat to send messages to people, leading them to fake websites.

NRK speaks with Ken over the phone from a hotel room in Bangkok. He refuses to meet with us.

Okay, I see. If you have any evidence, you can go to the police station, Ken responds.

We ask Ken if he works with x66.

I am self-employed and have my own company.

Is x66 a friend of yours? A colleague?

No, I don't understand what you're talking about.

We then ask if he knows Kris, who NRK has linked to x66. He denies it at first, but after some thought, he says:

I know him, but he is not my friend.

NRK informs Ken of the documentation we have regarding his connection to x66 and the scam messages.

You've got the wrong person, understood? he says.

Shortly after the conversation with Ken ends, something happens.

More than half of the images from Kris's Instagram profile disappear, including several photos showing his face. Additionally, the name of the account changes.

Later that evening, Ken sends us a message saying we should visit him, so he can beat us up.

He includes this photo:

Hand with a gun and more weapons in the background
Foto: PRIVAT
Foto: PRIVAT

«I am in Canada»

The next day, NRK decides to try the Thai phone number that x66 inadvertently revealed for a few seconds.

No one answers, but we receive a message:

«Who is it?»

We explain about Ken and say we believe the person we are messaging knows him. However, the person we are messaging insists we have the wrong person.

«I'm not in Bangkok. I am in Canada.»

Before NRK mentions anything about fraud, this person, like Ken, refers us to the police:

«If others cheat you, you can go to the police. There is nothing to talk about.»

We then mention that we want to speak about Magic Cat and receive a reply:

«Who is magic cat?»

Norwegian Bank Cards

Since both Ken and the person behind the other number claim NRK has the wrong person, we contact x66 directly via Telegram, the platform where he shows off his scammer lifestyle.

Before revealing that we are journalists, he mentions Norway as a good place to fish for bank card details.

x66:In Sweden, it is not easy to link a card to a digital wallet. Norway is okay.

As evidence, he sends two pictures of Norwegian bank cards that he has deceitfully obtained and added to his digital wallet.

One of them is the Visa card from the norwegian bank DNB that has already been shown in this story:

NRK has blurred certain details on these cards.

NRK has blurred certain details on these cards.

NRK has blurred certain details on these cards.

x66 has collected over 10,600 bank cards worldwide using Magic Cat, according to data NRK has obtained.

Then we show him Kris's profile picture on Instagram — the young man in the car with a starry sky. Is it him?

x66 claims the image is taken from the internet and that it shows someone else. Then he tells us something intriguing: He claims to know the person behind Magic Cat.

x66:I'm not the boss. I know the bigger boss in the back.

«I am x66»

Then, we reveal that we are journalists and what we plan to publish. The tone changes dramatically.

x66:There is something wrong with your survey. If a person really dares to publish his own things on the Internet, isn't he crazy hahahaha?

We ask x66 if he wants to comment on this matter and what he believes is wrong with NRK's investigations.

x66:I'm x66, but all the information you found is false.

Shortly after, he deletes the entire conversation. Then Kris's account disappears from Instagram.

The Boss

Who is the boss that x66 was talking about? The person behind Magic Cat?

While x66 uses the super weapon and boasts about his success, there is a mysterious figure lurking in the shadows.

This is the architect behind Magic Cat.

He is responsible for enabling x66 and hundreds of other scammers to deceive us.

Many have tried to find him, without success.

Can we succeed?

Read part two:

Also read: Mnemonic's technical report from their investigation.