Scammers Caught Using StingRay Phone Tracker to Scam Shoppers

Police in Bangkok arrested two Hong Kong men on Tuesday at Siam Paragon Shopping Mall, accusing them of intercepting cellular signals with a StingRay phone tracker for fraudulent purposes.

According to police, the StingRay phone tracker sent brief messages to shoppers with fake links attempting to steal money from smartphone users’ mobile banking accounts at Bangkok retail centers.

Tai Loi, 43, and Man Lok Lee, 25, were arrested in front of a mall in Pathumwan district carrying a portable electronic gadget known as a bogus base station or “Stingray” and four mobile phones, according to Pol Lt Gen Worawat Watnakhonbancha, commissioner of the Cyber Crime Investigation Bureau.

He claimed that the StingRay phone tracker and phones were used to send phony short messages to mobile phone customers, informing them that their reward points were about to expire and that they should click links to collect rewards.

Victims were taken to phony pages after clicking the links, and they were duped into entering personal information, resulting in the loss of all funds in their mobile banking accounts. The amount of money received through the plan was not disclosed.

The suspects utilized a Stingray that could deliver brief messages to 20,000 to 30,000 phone numbers within a one-kilometer radius. Such scammers typically operate in shopping malls and markets where many people pay with mobile banking accounts.

The Hong Kong men informed police that they met a man named Aken in Malaysia who instructed them to pick up the device in a bag from a Thai near the Erawan Shrine and transport it to specific sites.

They said they didn’t know what the StingRay phone tracker was for and had also been to CentralWorld and Iconsiam retail malls.

What is a StingRay phone tracker

Law enforcement uses the StingRay, a controversial cell phone spying gadget. It acts like a cell tower, luring surrounding phones into joining and giving their whereabouts and data.

Privacy opponents contend that StingRays violate constitutional privacy, while police argue that they are critical for tracking criminals and deterring threats. The technology’s secrecy and potential for abuse have sparked passionate discussions about security against civil freedoms.

Cell-site simulators, often known as Stingrays or IMSI catchers, are devices that impersonate actual cell-phone towers, causing phones within a given radius to connect to the device rather than the tower.

A StingRay phone tracker simulator works by running a general search of all cell phones within the device’s radius, which violates basic constitutional safeguards. Law enforcement uses cell-site simulators to locate phones more accurately than phone providers and without involving the phone company at all.

Cell-site simulators can also record IMSI numbers (International Mobile Subscriber Identifiers), which are unique to each SIM card, for all mobile devices in a specific area. Some cell-site simulators may include advanced features that enable law enforcement to intercept communications.

Once your cellular device connects to a StingRay phone tracker, the simulator can detect your position and prompt your device to communicate its IMSI for subsequent identification.

If the cell-site simulator can downgrade the cellular connection to a 2G/GSM connection, it may be able to perform much more intrusive acts, such as intercepting call metadata (what numbers were called or who called the phone, and how long each call lasted), the content of unencrypted phone calls and text messages, and some types of data usage (such as websites visited).

Furthermore, marketing brochures for cell-site simulators show that they may be set to reroute calls and text messages, modify messages, and even fake a caller’s identity in text messages and calls via a 2G/GSM network.