Ong Kak Seng covered the equipment in his car with a cardboard box. It included an antenna, batteries and an SMS blaster, a device that mimicked a mobile network and sent phishing messages to nearby phones. He drove it around Singapore for 10 to 12 hours a day. CNA’s account of the court proceedings describes an operation whose reach depended on where the car went.
When police analysed the seized device, they found that 31,820 phones had fallen within its coverage and that 10,533 phishing messages had been successfully sent. These were separate measurements. Neither number establishes how many recipients believed the message. Mothership, which reviewed court documents, reported one identified victim’s loss of S$1,823.26.
Ong had a reason to understand the difference between receiving a scam and falling for it. His sister had previously been a victim. On a visit to her in October 2025, he warned her not to open webpages linked in suspicious messages. By then, according to CNA, he knew that the equipment he was driving around was sending WhatsApp phishing texts. He continued working.
The texts claimed that recipients’ WhatsApp accounts needed verification. Their purpose was to obtain the information needed to take over those accounts. The eventual request for money could then arrive through an account belonging to somebody the recipient knew.
The equipment under the cardboard box was the beginning of a journey from physical proximity to personal trust.
A network within driving distance
The Singapore Police’s original release describes how the scam progressed. A text warned of a prolonged lack of WhatsApp verification. A fraudulent webpage asked for a mobile number and verification code. Compromised accounts were then used to send loan requests to their owners’ contacts.
That sequence gave the first deception a second audience. A recipient who surrendered a code exposed an account that other people recognised. The fraudsters could approach those contacts through an existing relationship.
Reaching the first recipient was where the SMS blaster came in. Conventional scam texts pass through telecom infrastructure, where operators can apply filters. A false base station offers another route: persuade a nearby phone to connect, then deliver a message directly.
Google’s security researchers describe blasters that present themselves as 4G or 5G networks before pushing phones onto a fake 2G connection. The messages bypass the carrier’s usual SMS filters because they do not travel through its SMS infrastructure. An operator can filter messages passing through its systems; this attack changes the route.
The method exploits a weakness in GSM, the technology used by many 2G networks. A handset is not required to authenticate the base station in the way needed to defeat this impersonation. A 2017 research paper on fake base stations, written by academic and Baidu researchers, documented fraudulent messages delivered through such equipment.
This is an established attack class. The public material reviewed for the Singapore case does not identify the precise radio protocol Ong’s device used. It establishes network impersonation and phishing transmissions. The documented GSM weakness helps explain SMS blasters, but cannot substitute for a forensic account of this particular machine.
The network closes, the phone remembers
Singapore began retiring its legitimate 2G networks in April 2017. The joint announcement from its regulator and operators told remaining users to move to newer handsets.
Retiring a service does not remove its capabilities from every device. Phones travel, and the networks available in one country differ from those in another. A handset can retain support for a technology its owner no longer encounters at home.
Samsung’s Singapore specifications for a current Galaxy S26+ model still list GSM bands. That establishes compatibility. It does not establish that the model is vulnerable, or that its protective settings are disabled.
Android’s technical documentation addresses the distinction explicitly. A phone that allows 2G connections can remain susceptible to a false 2G base station even after its carrier stops offering 2G. The absence of legitimate towers does not prevent an impostor from presenting itself as one.
Manufacturers now document ways to restrict those connections. Google’s Advanced Protection includes 2G Network Protection on supported devices. Apple’s Lockdown Mode disables 2G and 3G support. Samsung’s Maximum restrictions setting, within Auto Blocker, blocks 2G connections.
Those controls differ in availability and scope. Apple’s option also limits certain attachments, web technologies and incoming invitations. A person enabling it is choosing a wider set of restrictions. The documentation establishes that protections exist; it does not tell us which settings were enabled on the phones within reach of Ong’s car.
A familiar account asks for money
The transmitter can also leave evidence that operators could detect. Ericsson researchers describe analysing reports from handsets about surrounding cells, looking for signals inconsistent with the legitimate network. Unexpected 2G cells can be useful clues where that service has been retired. Their laboratory work demonstrated detection, although it does not establish what Singapore operators deployed or how police located Ong.
The case therefore exposes several places where protection could intervene: the radio connection, the fraudulent webpage, the verification code and the subsequent request for money. Success at one stage does not guarantee success at the next.
That distinction was central to the defence. Ong’s lawyer, Claire Chong, argued that the demonstrated harm involved one victim and that a transmitted message did not establish whether it had been received, read, believed or acted upon. Ong was sentenced on September 14, 2026, to 21 months in prison and a S$1,500 fine.
The transmission count measures the machine’s activity. The police account explains what the criminals hoped to gain from it: access to conversations in which an appeal for a loan might be taken seriously.
Ong warned his sister about suspicious links. The scam depended on someone else opening one, giving up a verification code, and making their own contacts the next targets. By the time those people were asked for money, the car could have moved on. The account asking would still be familiar.
