Hong Kong Police arrested a 25 year old local man on July 23 after catching him driving through the northern district of Sheung Shui with an SMS blaster operating inside his car. Officers seized the SMS blaster and a mobile phone used to control it. Initial forensic analysis showed the SMS blaster had sent more than 1,000 smishing messages.
The arrest followed the theft of approximately HKD1.1mn (USD141,000) from the account of a customer of an online investment company. The victim received an SMS that impersonated the company and claimed their account details needed updating. A link took the victim to a fake login page, where they disclosed their username, password and SMS one-time password. The criminals used those details to access the genuine investment account and conduct unauthorized transactions.
Police said this SMS blaster forced nearby phones to connect using 2G. The arrest occurred exactly one month after China Mobile Hong Kong, the territory’s last provider of 2G service, switched off its 2G network on June 23. Closing the genuine network did not prevent the attack because compatible handsets could still receive the 2G signal transmitted by the SMS blaster.
This is at least the fourth publicly reported Hong Kong SMS blaster bust since February 2025. Commsrisk covered the first arrest, when an SMS blaster sent over 10,000 messages impersonating government functions and prominent businesses. Further arrests followed in September 2025 and May 2026.
Police said phishing fraud of all kinds is also rising quickly in Hong Kong. There were 1,009 reported cases during the first five months of 2026, an increase of 83 percent compared with the same period last year.
The latest incident has been added to the SMS blaster map on the Commsrisk Global Fraud Dashboard. The facts were reported by HK01. The Hong Kong Police Force also shared the following video briefing about the arrest. The same video is available on its official Facebook page. Look below for images of the seized equipment.
Photographs: 黃煦緻/HK01
