16 Suspects Detained in Timor-Leste for Japanese Police Impersonation Scam

Investigators in Timor-Leste have detained 16 people after raiding a building in Dili allegedly used to run telephone scams against people in Japan.

The suspects are accused of posing as Japanese police, using staged surroundings and a prepared script to make their claims appear credible.

The group included seven Japanese nationals and six Chinese nationals. Investigators recovered a fake police uniform, a backdrop displaying the insignia of a Japanese prefectural police headquarters, and a Japanese-language document believed to contain instructions for fraudulent calls.

Ministry of Cyber Affairs said in a report shared with Cyber Security News (CSN) that investigators believed the group impersonated Japanese law enforcement.

The publication is an independent news website, not an official government ministry. Its account describes an alleged impersonation operation, not a newly identified malware campaign.

Published on October 5, 2026, the report places the raid within a broader pattern of foreign-linked scam cases in Timor-Leste.

It does not disclose confirmed victim numbers, financial losses, or the nationalities of the remaining three detainees, leaving the operation’s full impact unclear.

16 Suspects Detained in Timor-Leste

The raid took place on Friday at a building in the capital. Investigators found physical props that could support the group’s claimed police identity, alongside written material showing how callers were expected to approach potential victims in Japan.

The recovered manual describes a deliberate screening process. Callers were instructed to ask whether the number belonged to a household or a company, then pretend to check it. If the recipient identified a company line, the caller would politely end the conversation, claiming a wrong number.

People answering private household lines were kept on the call. They were then told that a fraudulent parcel had been sent in their name.

This allegation supplied the opening for a conversation built around supposed wrongdoing rather than an ordinary delivery enquiry. The script suggests an organized effort to select targets and standardize the opening approach.

Similar patterns in scripted call center fraud show how prepared conversations can help operators repeat convincing stories, although the available report does not establish any connection to those other networks.

The uniform and police backdrop add another layer to that deception. Such props could reinforce a false claim of official authority, but the report does not establish whether suspects used video calls, recorded footage, or another format to show them to victims.

The available account also does not describe payment demands, bank transfers, stolen credentials, or device compromise.

The evidence therefore supports reporting on alleged telephone-based impersonation, without attributing technical capabilities or financial outcomes that investigators have not detailed.

Expanding Networks

The Dili operation comes against earlier warnings about criminal networks moving into Timor-Leste. In September 2025, the United Nations Office on Drugs and Crime warned that transnational groups were establishing scam center operations through foreign investment in the Oecusse-Ambeno special economic region.

UNODC linked that activity to convicted cybercriminals, offshore gambling operators, and networks associated with triads. These findings concerned the wider regional threat; the report does not establish that the 16 people detained in Dili belonged to any of those specific organizations.

The agency said enforcement pressure in established hotspots was pushing syndicates toward jurisdictions with limited experience handling scam centers.

Reporting on Southeast Asian scam operations provides wider context for this displacement, while Timor-Leste was showing early warning signs previously seen elsewhere in the region. The report also notes that fraud bases spread across Southeast Asia following a crackdown in Cambodia.

The Dili arrests illustrate why coordinated cross-border fraud investigations matter: an operation located in one country can allegedly use another country’s language and police identity to reach targets abroad.

For now, the central finding is the alleged use of police impersonation and a household-focused calling script. Investigators have disrupted the suspected site, but the source leaves unanswered how long it operated, how many people received calls, and whether any victims lost money. These questions matter when assessing the scheme’s scale and potential harm to victims.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post 16 Suspects Detained in Timor-Leste for Japanese Police Impersonation Scam appeared first on Cyber Security News.