Police in Hyogo Prefecture, Japan, arrested a couple in October 2026 on suspicion of hiding a mini PC behind the refrigerator of a Kobe hotel room and connecting it to the hotel’s Wi-Fi. Investigators say the device sent at least 480,000 phishing emails impersonating credit card companies and held about 2.4 million target email addresses. Using a hotel network hides the sender behind an IP address with a clean reputation, so card issuers cannot rely on email filters alone: they also need to find and take down the fake sites the emails point to.
Summary
- A 39-year-old man and his 39-year-old wife, both Chinese nationals living in Kobe, were arrested by the Hyogo Prefectural Police cyber investigation division.
- Police say the man entered a hotel in Kobe’s Chuo Ward on May 15, 2025, posing as a guest, and left a mini PC hidden behind the room’s fridge, connected to the hotel Wi-Fi.
- The device sent at least 480,000 phishing emails impersonating credit card companies, and about 2.4 million target email addresses were found on it.
- Police believe another person operated the PC remotely and are investigating a possible cross-border fraud group.
- The couple is also suspected of using stolen card data to buy three items, including down jackets, worth about 470,000 yen (about 3,100 USD) at a Kobe shopping facility on January 1, 2026.
What happened in the Kobe hotel phishing case?
Investigators say the hotel room was used as a disposable launch point for a phishing campaign. A small computer was hidden where cleaning staff would not look, plugged in, connected to the guest Wi-Fi and left to send email.
The emails impersonated credit card companies and sent recipients to fake sites built to collect card numbers and login details. Police have not named the card companies involved.
Example of a credit card phishing page of the kind used in campaigns like this one (illustrative)
The suspects face charges of obstructing the hotel’s business by deception and computer fraud. A search of their home turned up 74 smartphones, and police say the fraudulent card purchases are part of the same investigation.
Why would phishers use a hotel’s Wi-Fi to send emails?
A hotel network gives phishers a borrowed identity. The emails leave from the hotel’s IP address, which has no history of spam, so they are less likely to be blocked than emails from known bad infrastructure.
The setup has three advantages for the attacker:
- Clean reputation: a business IP address with normal traffic passes many reputation checks that block known spam sources.
- Distance: the operator controls the device remotely, so the person physically present is replaceable and the operator stays out of sight.
- Disposability: when the hotel blocks the device, the group moves to another room or another hotel.
The same logic drives the market for residential proxies, where criminals route traffic through ordinary home and business connections to blend in.
What can hotels and other businesses with guest Wi-Fi do?
Guest networks should limit what a single connected device can do. These controls stop a hidden device from sending mail at scale:
- Block outbound email ports (SMTP on port 25, and ideally 465 and 587) on guest networks, or rate-limit them.
- Isolate clients so devices on the guest network cannot see or reach each other.
- Alert on volume: a single device sending thousands of connections to mail servers is not normal guest behavior.
- Act on abuse reports quickly: complaints about spam from your IP address are an early warning that something is running on your network.
- Include room checks in housekeeping routines for devices plugged in behind furniture or appliances.
How do card issuers take down the phishing sites behind email campaigns?
Card issuers stop the damage by removing the fake sites, not only by blocking the emails. Each phishing email points to a page that collects card data, and that page keeps working until someone takes it offline.
The takedown process usually follows four steps:
- Detect the fake site early, through new domain registrations, customer reports, spam traps, and abuse mailboxes.
- Collect evidence: screenshots, the page source, and proof that the site impersonates the brand.
- Request removal from the registrar, the hosting provider and, where relevant, the email or messaging platform used to spread the link.
- Block in parallel: submit the URL to browser blocklists so users are warned while the takedown is pending.
Financial brands are a frequent target. In PhishFort’s Digital Threat Intelligence Report for January to June 2026, Financial Services and Banking accounted for 18.6% of confirmed brand impersonation cases (PhishFort internal data).
How PhishFort helps financial brands
PhishFort Brand Protection for financial services takes down phishing kits, fake onboarding pages, and impersonated apps that target fintech, payments, and card customers. PhishFort has a 98% takedown success rate across all confirmed cases.
Frequently asked questions
How did the hidden PC in the Kobe hotel send phishing emails?
Why do criminals send phishing emails from hotel networks?
How can a hotel stop its Wi-Fi from being used to send spam?
Who takes down phishing sites that impersonate a card company?
Sources
- The Standard (Hong Kong), “Chinese couple in Japan accused of hiding computer in hotel room to send 480,000 phishing emails”, October 16, 2026.
- Kobe Shimbun, report on the arrests by Hyogo Prefectural Police, October 15, 2026.
- PhishFort Digital Threat Intelligence Report, January to June 2026 (PhishFort internal data).
