AI Fraud Decoded 6 | Why Taiwan Phone Numbers Are Black Market Gold

Fraud messages don't materialize out of nowhere on your phone. They start as a fake investment ad on Facebook, a deepfake celebrity endorsement video, a fraudulent game promo code posted on Threads. They arrive as a fake delivery text, an overseas call, a satellite number beginning with +881, or a seemingly harmless LINE (line) friend request. The moment you click through, add the contact, join the group, reply to "customer service," or enable screen sharing, the fraud supply chain has completed its single most critical step: making contact with you.

Officials at Taiwan's Investigation Bureau note that once fraud proceeds move into mule accounts, cash-out networks, Tether (USDT), gold, or cross-border laundering channels, recovery becomes exponentially harder. But before any money moves, a syndicate first has to find a victim, build trust, and manipulate them into acting — which is exactly where telecom carriers and digital platforms sit at the center of the fraud pipeline.

Facebook, Instagram, Threads, SMS, phone calls, SIM cards, eSIMs, the domain name system (DNS), and fake websites are not isolated tools in isolation — they are entry points syndicates use to funnel traffic, cultivate trust, harvest login credentials, and move money. For fraud to operate at industrial scale, the first requirement isn't deception. It's reach.

So why does a scam ad on Facebook always seem to end with a request to add LINE? Wang Chih-ching (王志清), co-founder and Chief Digital Officer of Leadbest Consulting, explains that Facebook, Instagram, and similar platforms function primarily as traffic funnels for syndicates — fake ads, fake pages, deepfake celebrity investment videos, and fake promotional posts pull potential victims in. But sustained interaction, trust-building, and scripted manipulation work better on LINE, which dominates the Taiwanese market.

The reason is straightforward: LINE has extremely high usage and stickiness in Taiwan, serving as the primary communication tool for work, family, and friends. For a syndicate, a LINE group isn't just a chat space — it can be staged as a full theatrical production. One member plays the investment "teacher." Another plays the assistant pushing people toward account openings and transfers. Others play successful students, posting fake profit screenshots and cheering along. To a new member, it doesn't look like one stranger making a pitch — it looks like an entire community making money together.

In fake customer service scams, LINE handles the follow-up: identity verification, refunds, supplementary document requests, payments, and screen sharing. This is precisely why LINE's Party Mode feature has been repeatedly exploited as a screen-recording tool by fraud syndicates — and it illustrates one of the clearest distinctions between modern tech fraud and traditional scams. Where old-school fraud might have been a single phone call demanding a wire transfer, the current model draws traffic from an open platform, then funnels victims into a closed, more controllable messaging environment. Facebook is the doorway. LINE is where the manipulation happens.

Even as social platforms become primary entry points, SMS and phone-based fraud haven't disappeared. Tsai Chi-yen (蔡祈岩), Chief Information Officer at Taiwan Mobile (台灣大哥大), has observed that fraud increasingly relies on multiple contact points rather than a single channel. A syndicate might place a phone call, follow up with a text message, then push the target toward a LINE community for further manipulation.

Chu Chien-kuo (朱建國), Chief Information Security Officer at Far EasTone Telecommunications (遠傳電信), similarly notes that the core of fraud remains the flow and exchange of information — but over the past two to three years, that flow has clearly migrated from traditional SMS and calls toward digital channels like LINE and Facebook. With the rise of AI, scam content has expanded from text to voice and video.

What this means is that SMS isn't obsolete — it has simply been repositioned within more complex, multi-stage attacks. A text message might be the opening fake delivery notification, or the gateway nudging someone to add a LINE contact. It might be a fake tax refund notice, a fake utility bill, or the moment a one-time password (OTP) gets intercepted. The real danger isn't any single tool — it's the way syndicates chain tools together. A suspicious link used to be an obvious red flag. Now, a syndicate may skip the link entirely at first, building a friend connection or group membership and establishing some baseline trust before ever asking someone to access mobile banking, share a screen, or read out a verification code.

In the fraud supply chain, a telecom number functions as more than a way to make calls. It's a gateway to digital identity. Tsai notes that Taiwanese SIM cards and Taiwanese LINE accounts carry real value precisely because Taiwan's telecom carriers enforce relatively strict identity verification at the point of registration. A mobile number underpins login, registration, and OTP verification across countless online services — meaning that a verified, trustworthy Taiwanese number effectively functions as an admission ticket to a much broader set of platforms.

That's exactly why Taiwanese phone numbers have become a target for fraud syndicates. A number can register LINE accounts, social media profiles, and e-commerce accounts; it can receive verification codes, open new accounts, or power fake customer service operations. As registration requirements tighten, the underground value of legitimate numbers, "rented" identities, and stolen accounts rises accordingly.

Investigation Bureau officials note that as Taiwan's anti-fraud enforcement intensifies and the cost of acquiring SIM cards rises, syndicates simply pivot — toward dating apps, messaging platforms, eSIMs, AI translation tools, and virtual assets, all of which lower the cost of reaching victims and moving money. When one identity channel becomes more expensive, syndicates don't stop; they find a cheaper one. From physical SIM cards to eSIMs, overseas cards, messaging accounts, and stolen social media profiles, fraud operations are in constant search of cheaper, more scalable identity infrastructure.

Recent controversy around eSIMs has grown as more travelers purchase cheap travel eSIMs online. But the eSIM technology itself isn't the problem — the real question is whether a buyer actually knows which carrier is providing the service, which jurisdiction regulates it, and how robust its data protection actually is.

Chu explains that within the fraud supply chain, SIM cards and phone numbers typically function as identity verification tools, since many online services authenticate via SMS. Syndicates may attempt to intercept OTP codes to hijack accounts or execute transactions. Travel eSIM risk is a separate, related issue: many consumers buying low-cost travel eSIMs have no idea who the underlying carrier is or what network and regulatory regime their data passes through.

Some travelers who purchase a destination-country eSIM discover upon arrival that their network connection or service node isn't actually located in that country. This doesn't necessarily indicate fraud, but it does reflect a basic lack of transparency about the provider — and when a carrier's jurisdiction, regulatory obligations, KYC standards, and security protections are unclear, risk rises accordingly. The takeaway isn't that eSIMs are unsafe, or that all cheap eSIMs are problematic. It's that choosing based on price alone, without considering the source, means handing your communication and identity verification chain to an unfamiliar operator. Travelers are generally better served prioritizing licensed, reputable carriers with transparent ownership.

Tech fraud doesn't retire old tactics — it cycles them. Many older telecom scams go quiet for a period, then resurface when conditions are right. Recently, some Taiwanese residents have reported receiving calls from satellite numbers beginning with +881, with callers falsely claiming the recipient's phone had sent mass fraudulent text messages — a tactic designed to prolong the call or bait a callback. High-rate international and satellite call scams aren't new, but anyone who doesn't immediately recognize the number format risks incurring substantial charges.

A more technically sophisticated risk involves fake cell towers. Tsai explains that fake base stations can be mounted in vehicles or placed near crowded areas, broadcasting signals that mimic legitimate cell towers. Nearby phones register to the fake tower, after which the operator can send text messages that appear to originate from a specific number or company. Recipients may believe they're receiving an official message from a bank or business, when the actual source has been spoofed.

Taiwan has worked with telecom carriers and law enforcement to actively detect and report fake base stations, which has helped suppress this technique domestically — but it remains a reminder that fraud doesn't only happen on internet platforms. It can also exploit the underlying communications infrastructure. From high-rate +881 calls to spoofed base stations to fraudulent texts and overseas impersonation calls, old tactics haven't disappeared. They've simply been repackaged for new technical environments.

As fraud traffic increasingly flows through telecom and platform infrastructure, carriers have begun building multilayered defenses. Tsai describes Taiwan Mobile's approach as roughly three-tiered.

The first layer operates at the network level: flagging suspicious numbers, abnormal text patterns, overseas call alerts, and fake base station detection. While users still receive some fraudulent texts, a substantial volume is intercepted before delivery.

The second layer operates at the enterprise level. Through its enterprise anti-fraud service, Taiwan Mobile helps businesses detect spoofed websites — fake bank, retailer, government, or brand sites — flagging them immediately and reporting to Taiwan's 165 anti-fraud hotline or relevant authorities for takedown.

The third layer operates at the individual user level, through a consumer anti-fraud app that flags suspicious calls, suspicious texts, and high-risk links.

Tsai said the consumer-facing anti-fraud tool has screened roughly 550 million phone number checks cumulatively, blocked approximately 46 million fraud or telemarketing calls, and flagged nearly 3.7 million high-risk website links — though these figures would require further verification of the underlying measurement period and methodology before being treated as official statistics. Far EasTone takes a complementary approach centered on call and SMS behavior analysis, deploying AI detection models to flag messaging or calling patterns inconsistent with normal use. Chu notes that the public's perceived decline in fraud text volume in recent years tracks with combined efforts between carriers and government on interception, short-code messaging controls, and overseas call warnings.

Fraud defense is no longer the sole responsibility of any single carrier or platform. Chu describes Far EasTone's collaboration with Taiwan Network Information Center (TWNIC) and other organizations on domain and DNS-level blocking — feeding publicly reported or government-compiled lists of suspected fraud websites directly to carriers. When a user attempts to connect to a flagged site, the connection can be blocked at the DNS resolution stage itself, reducing exposure before contact even occurs. The underlying logic is shifting fraud defense from after-the-fact reporting toward upfront blocking: once a fake site has been identified, there's no need to wait for each individual victim to recognize it themselves.

Because fraud ultimately converts information flow into money flow, telecom carriers have also begun partnering with the financial sector. Far EasTone has worked with financial institutions to build risk models identifying high-risk users or transaction scenarios. Chu also points to international frameworks like the GSMA Open Gateway initiative, which envisions telecom carriers sharing select data to support identity verification across other industries — financial services first, with broader application expected to follow in other sectors requiring identity verification and fraud prevention.

This points toward fraud defense becoming genuinely cross-industry. Telecom carriers see communication behavior. Financial institutions see transaction behavior. Platforms see account and content behavior. Government and law enforcement hold case reports and investigative intelligence. Only by connecting these signals — within appropriate legal and regulatory bounds — does there become a realistic chance of intercepting fraud before it completes its cycle.

Carriers and platforms can intercept enormous volumes of abnormal signals: suspicious texts, high-risk links, spoofed websites, overseas calls, fake base stations, anomalous number behavior. These defenses genuinely reduce public exposure to fraud attempts. But syndicates simply rotate entry points — a flagged page gets replaced by a new one, a blocked URL gets replaced by a new domain, an intercepted batch of texts gets replaced by a LINE group, a fake customer service account, a hijacked friend's profile, or a deepfake video. The moment fraud shifts from system-detectable anomalies into person-to-person trust manipulation, the defensive challenge becomes substantially harder.

An unfamiliar text message tends to trigger caution. The same message sent from a friend's hijacked account does not. An unfamiliar website might get blocked outright. The same pitch, delivered after weeks of relationship-building inside a LINE group, may already have earned a victim's trust before any red flag appears. An overseas call may carry a warning label. The same call, delivered with a familiar tone, manufactured urgency, and a scripted fake customer service flow, can still override a person's better judgment.

Platforms and carriers can block a meaningful share of fraud traffic. They cannot substitute for human vigilance. What fraud syndicates are ultimately attacking — and have always attacked — is trust, greed, fear, and urgency. （Related： AI Fraud Decoded 7 | Inside Taiwan's 165 Anti-Fraud Hotline, Where Human Judgment Still Outpaces AI ｜ Latest ）

Original Article in Chinese