16 Arrested in Timor-Leste for Impersonating Japanese Police in Scam

Key Takeaways

• Timor-Leste authorities arrested 16 individuals in Dili for operating a phone scam targeting Japanese citizens.
• The suspects allegedly impersonated Japanese police officers, using fake uniforms, official-looking backdrops, and detailed scripts to enhance credibility.
• The scam specifically targeted individuals with household phone lines, alleging fraudulent parcel deliveries to initiate conversations.
• Seven Japanese and six Chinese nationals were among those detained, with the nationalities of three others undisclosed.
• This incident highlights a growing trend of transnational criminal organizations establishing scam operations in regions with limited experience in combating such cybercrimes.

Investigators in Timor-Leste have successfully dismantled a sophisticated phone scam operation in Dili, resulting in the arrest of 16 individuals. The transnational scheme allegedly targeted victims in Japan by impersonating Japanese law enforcement officials.

The Dili Raid and Impersonation Tactics

During a raid on a building in the capital, Dili, authorities uncovered a trove of evidence designed to lend authenticity to the scam. This included a fabricated Japanese police uniform, a backdrop featuring the official insignia of a Japanese prefectural police headquarters, and a Japanese-language document containing detailed instructions for fraudulent calls. The Ministry of Cyber Affairs said in a report, shared with Cyber Security News (CSN) on October 5, 2026, that the operation was an alleged impersonation scheme, not a malware campaign. The report, however, did not specify the number of victims or the financial losses incurred.

The arrested group comprised seven Japanese nationals and six Chinese nationals. The nationalities of the remaining three detainees were not disclosed in the report. The discovery of physical props, such as the uniform and backdrop, indicates a deliberate effort to create a believable facade of official authority. However, the report does not clarify whether these visual aids were presented to victims via video calls, recorded footage, or other methods.

Sophisticated Targeting and Scripted Interactions

The recovered instructional manual revealed a calculated approach to victim selection. Callers were directed to first ascertain whether a contacted number belonged to a private household or a business. If the recipient identified a company line, the scammer was instructed to politely terminate the call, claiming a wrong number. This selective targeting ensured that only individuals likely to be susceptible to the scam’s premise were engaged.

For those answering from private household lines, the script advanced to the next stage: falsely informing them that a fraudulent parcel had been sent in their name. This accusation served as the entry point for a conversation centered on fabricated legal issues, rather than a routine delivery inquiry. The existence of such a detailed script points to a highly organized effort to standardize the fraudulent approach and maximize its effectiveness, mirroring patterns observed in other sophisticated call center frauds.

Expanding Criminal Networks in Southeast Asia

This arrest in Dili aligns with prior warnings regarding the expansion of criminal networks into Timor-Leste. In September 2025, the United Nations Office on Drugs and Crime (UNODC) highlighted that transnational criminal groups were establishing scam center operations in the Oecusse-Ambeno special economic region through foreign investments. UNODC’s findings connected these activities to known cybercriminals, offshore gambling operators, and triad-linked organizations across the broader region. While the report does not directly link the Dili detainees to these specific organizations, it underscores a regional trend.

According to UNODC, increased enforcement pressure in traditional scam hotspots has pushed these syndicates towards jurisdictions like Timor-Leste, which possess limited experience in managing large-scale scam centers. This displacement phenomenon has been documented across Southeast Asia, with Timor-Leste exhibiting early warning signs previously observed in other parts of the region following crackdowns, such as those in Cambodia. The Dili arrests emphasize the critical need for coordinated international investigations to counter cross-border fraud, especially when criminal operations leverage the language and national identities of other countries to defraud remote victims.

While the immediate disruption of this alleged police impersonation scheme is a significant win, the full scope of its operations remains partially unknown. Crucial questions regarding the duration of the scam, the total number of individuals targeted, and the financial impact on victims are yet to be answered. These details are essential for a comprehensive assessment of the scheme’s scale and the harm inflicted upon unsuspecting individuals.

What You Should Do

• Verify Identity: Always independently verify the identity of anyone claiming to be law enforcement or government officials over the phone. Request their name, badge number, and department, then call the official police department or agency directly using a publicly listed number, not one provided by the caller.
• Be Skeptical of Unusual Requests: Law enforcement agencies will never demand immediate payment via gift cards, wire transfers, or cryptocurrency, nor will they threaten arrest for non-compliance over the phone.
• Protect Personal Information: Never share sensitive personal or financial information, such as bank account details, credit card numbers, or social security numbers, with unsolicited callers.
• Report Suspicious Calls: If you receive a call you suspect is fraudulent, report it to your local law enforcement agency or relevant consumer protection authorities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.