Scam Groups Target Elementary and Junior High Students via Instagram, Exploiting Telecom Payment Verification Codes

Scam groups are extending their reach into schools, increasingly targeting elementary and junior high school students who are less cautious. According to a criminal investigation bureau analysis of cases over the past three months, 188 related fraud incidents have been identified. Criminals steal or impersonate students’ friends’ Instagram accounts, using excuses such as a locked phone or needing to borrow a phone number to receive SMS verification codes. They then use telecom payment services to make unauthorized purchases.

According to reports by Ettoday News, just two sentences from a fake friend can break down a child’s defenses. Elementary and junior high students have become new targets for scam groups. These groups create fake accounts that closely resemble a student’s real friend—matching names and profile pictures—and request phone numbers under the pretense of needing urgent help. Since the requests don’t involve investment advice or bank transfers, but only ask the student to receive and forward a verification code, children often mistake it as a simple favor.

Media reports indicate that one middle school student received a direct message from an account differing by just one character from their real friend’s username. After providing the requested information as instructed, the student was immediately charged. In northern Taiwan, a primary school student provided two verification codes in succession and only realized they had been scammed after receiving a charge notification.

The verification code itself is the payment authorization. Telecom payment systems were originally designed to simplify digital content and online service transactions. In some transactions, after entering a phone number, the system sends a verification code. When the user inputs this code back into the transaction page, it is treated as consent to pay, and the fee is later added to the telecom bill.

The vulnerability lies in the fact that the system verifies who received the code, but cannot confirm whether the actual operator is the phone number’s legitimate owner. Scammers can initiate a transaction remotely and trick students into forwarding the verification code, exploiting the time gap between identity verification and when parents receive the bill to complete the payment.

Chunghwa Telecom warns users not to share SMS for payment verification, passwords, or security codes with others and provides an option to disable small payment functions. However, when a phone number is registered under a parent’s name but actually used by a child, the system may still approve services based on the adult applicant’s information, creating a blind spot in child and youth account management.

Three government agencies must act before victims report incidents. Cross-agency collaboration should be launched immediately. Relevant authorities must not shift all anti-fraud responsibility onto students and parents. The Ministry of Digital Affairs should work with the National Communications Commission to proactively audit telecom operators’ payment processes, requiring minor-registered numbers to have payment functions disabled by default. They should also establish parental confirmation, transaction cooling-off periods, abnormal transaction blocking, and immediate payment stop mechanisms. The Ministry has previously discussed upstream fraud prevention with telecom industries and should now include minor accounts in special management projects.

The Ministry of the Interior and National Police Agency should immediately provide telecom operators with fraud account data, transaction platforms, and high-risk product information collected by the 165 hotline and criminal investigation bureau, rather than waiting for individual cases after students are scammed. Suspicious activities—such as repeated verification code requests in a short time, transactions initiated from abnormal devices, or concentrated purchases of specific digital goods—should be blocked immediately, with fund flows traced promptly.

The Ministry of Transportation should also participate in cross-ministerial consumer protection and telecom payment risk assessments, using postal services, transportation hubs, and public service channels to expand fraud prevention awareness for children and youth. The government should have the Executive Yuan coordinate the Ministry of Transportation, Ministry of Digital Affairs, Ministry of the Interior, and NCC to prevent regulatory gaps caused by fragmented responsibilities.

Minor-registered phone numbers should have payment functions disabled by default, and high-risk transactions should require parental confirmation. Telecom operators should clearly label verification SMS with the merchant, product, and payment purpose, directly warning users that this is not account verification but payment authorization. If new merchants, repeated transactions, or abnormal devices are detected, payments should be paused and the account holder notified simultaneously.

Parents should immediately check whether their child’s phone number has telecom payment enabled and proactively disable it if not needed. If unauthorized charges are discovered, they should preserve screenshots of messages, accounts, and SMS, contact the telecom provider immediately, report to the police, and verify via the 165 hotline.