Japanese Police Impersonation Scam Operation Dismantled as 16 Suspects Detained in Timor-Leste

Timor-Leste investigators have dismantled a suspected cross-border telecom fraud operation in Dili, detaining 16 individuals accused of impersonating Japanese police officers to defraud victims in Japan.

The raid exposed a professionally staged social-engineering setup that included counterfeit law-enforcement props, Japanese-language call scripts and infrastructure designed to lend credibility to “digital arrest” scams.

Authorities said the group included seven Japanese nationals and six Chinese nationals.

Investigators raided the premises on Friday and recovered a fake Japanese police uniform, a staged backdrop displaying the insignia of a Japanese prefectural police headquarters, and a Japanese-language document believed to be an operational fraud manual.

Officials believe the suspects used these materials to pose as Japanese police during calls or video interactions with targets in Japan.

The seized items point to an impersonation model built around visual authority and scripted victim engagement.

In this type of operation, callers commonly claim that a victim’s identity, telephone number, bank account or parcel delivery has been linked to criminal activity.

The alleged victim is then pressured to cooperate with a supposed police inquiry, often under threats of arrest, account freezing or legal consequences.

If the number was associated with a business, the caller was instructed to politely end the call by presenting it as a wrong-number incident.

Residential recipients, however, were retained on the line and allegedly told that a fraudulent parcel had been sent using their name.

That approach is consistent with targeted telecom-fraud tradecraft. Corporate lines can expose an operation to switchboard staff, call recording, internal security teams and rapid escalation.

Cyber Affairs Researchers said that, Japanese-language manual reportedly contained instructions for screening call recipients. Operators were told to determine whether a dialed number belonged to a private residence or a company.

Japanese Police Impersonation

Households may provide a more controlled environment in which operators can isolate an individual, exploit uncertainty and transition the interaction into a longer fake investigation.

The use of a police uniform and a realistic official backdrop can further strengthen the deception during video calls, particularly when victims are asked to verify the identity of the supposed officer.

The Dili bust also reinforces growing concern that scam-centre networks are shifting into Timor-Leste as enforcement pressure rises elsewhere in Southeast Asia.

In September 2025, the UN Office on Drugs and Crime warned that transnational criminal networks were using foreign investment structures to establish scam-centre and illicit-gaming operations in Timor-Leste, with particular concern over the Oecusse-Ambeno Special Administrative Region and its digital free-trade infrastructure.

UNODC said its assessment identified indicators associated with the establishment of Southeast Asia-style scam centres, including criminal infiltration through ostensibly legitimate investment activity.

The agency linked the risk landscape to networks associated with cybercrime, offshore gambling and organized-crime structures, warning that jurisdictions with limited prior experience in investigating large-scale scam compounds can become attractive relocation targets.

The latest raid follows a broader 2026 crackdown by Timor-Leste authorities against suspected online-fraud and illegal-gambling facilities.

Reports indicate that police had dismantled multiple sites in Dili and nearby areas, recovering communications equipment, SIM cards, mobile devices and satellite-internet hardware from operations allegedly run by foreign nationals.

For Japanese residents, the incident highlights a key defensive rule: legitimate police agencies do not demand secrecy, immediate transfers of money or cryptocurrency, remote-device access, or a “safe account” deposit through unsolicited calls.

Recipients who receive a purported police call should end the session and independently contact the relevant police station through an official number rather than using a number, link or video channel provided by the caller.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC