Fake Boss Scam hits Taiwan: How a Gmail Note and a LINE QR Code Became Taiwan’s Corporate Heist Kit

TAIPEI, A filing published through the Lumen Database shows Google was asked on 1 September 2026 to disable Gmail accounts used in a Taiwan executive-impersonation scam that lures staff off email and onto LINE, then presses them for company transfers.

The notice, labeled a “Government Request Removal Complaint to Google,” names two alleged targets. One is Cai Mingzhong (蔡明忠), chairman of Fubon Group and of the NTU Law Foundation, titles that match official corporate records. Lumen, the Harvard-hosted archive of takedown requests that Google voluntarily shares, published the text with the destination URLs redacted.

The filing is not, on its face, a signed order from the Criminal Investigation Bureau. It is a request submitted on Google’s government-removal form and later mirrored by Lumen. That distinction matters: the legal provisions cited in the letter were written for online advertising platforms, while the facts described are about mailboxes.

How the scam works

Police and anti-fraud groups in Taiwan have documented the same script since late 2025.

Scammers scrape a company’s website and news pages for the chairman’s name, title and staff emails. They then send a short message from a free Gmail address. There is often no link and no attachment. The only ask is operational: create a LINE group, do not invite anyone else yet, and email back the group QR code “for filing.”

Once the QR code arrives, fake “boss” and “assistant” accounts join the chat. The conversation moves off the corporate mail system, where legal and IT filters are weaker. The next messages cite an urgent vendor payment, a blocked official account, or a “pad fee” that must be advanced now and reimbursed later. In a case published by the Criminal Investigation Bureau, an employee who followed those instructions transferred about NT$17 million before anyone called the real executive.

MyGoPen and Whoscall posted matching warnings in December 2025. Both said the first email is designed to look routine. The theft happens in LINE. The Lumen notice says the same pattern was aimed at NTU Law Foundation staff in the name of Cai, and at staff of a Taichung mutual-aid group. It asked Google’s Gmail team to “remove the fraud gmail as soon as possible.”

That sequence is social engineering, not a hacked Fubon server. The public identity is the bait. Gmail is the door. LINE is the till.

Why the letter talks about ads

The requester cited Articles 32 and 33 of Taiwan’s Fraud Crime Hazard Prevention Act. Those articles tell online advertising platform operators to take down fraudulent ads, restrict related content, and suspend users who have been flagged as clearly involved in fraud after notice from judicial police or a competent authority.

Google is one of the foreign ad platforms designated by the Ministry of Digital Affairs under that statute. In November 2024 it published a local-agent disclosure for the Act. Google’s own transparency report later recorded the first Criminal Investigation Bureau request under the law: two Google Ads removed for fraud. In July–December 2025, fraud accounted for 121 of Taiwan’s government removal requests to Google, or 26 percent.

That is the statutory hook the Lumen filing tries to use. It is an imperfect fit. Gmail is an email service. The Act’s platform duties were drafted around paid ads. Google can still shut abusive mailboxes under its own terms. The letter does not, by itself, convert a private complaint into a police takedown order.

Where Google Ads sit in the same industry

The Cai/LINE case described in Lumen is an email-first attack. A parallel, much larger pipeline in Taiwan starts with Google Ads and Meta ads, then ends in the same place: a LINE group.

Criminal Investigation Bureau figures show how large that ad channel is. From mid-2023 through 30 June 2025, CIB referred more than 250,000 scam ads to platforms. In the second quarter of 2025 alone it asked Meta to take down 26,074 ads and Google to take down 418. Among investment-scam ads that quarter, 45 percent impersonated finance celebrities, 25 percent media influencers, 14 percent business leaders and 2 percent politicians. Typical copy promised “tips on time,” free books, or three days with a master trader, then pushed users into LINE.

The Financial Supervisory Commission’s “government notify, platform delist” arrangement with Google and Meta produced 11,417 reported scam-ad cases in the first half of 2026, after a dip in 2025. Google said that from July 2024 to June 2025 it removed 3,564 URLs in Taiwan following government requests, most under its own anti-fraud policies rather than a court finding. Globally in 2025 it reported removing more than 8.3 billion policy-violating ads and suspending more than 24.9 million accounts.

Ads and executive Gmail are not the same product. They are adjacent tools in one business model:

1. Ads buy reach. A fake Fubon or “stock teacher” creative appears above a Search result or in a YouTube pre-roll and harvests strangers.
2. Gmail buys trust. A message that looks like it came from the actual chairman harvests insiders who already have payment authority.
3. LINE completes the payment. Both paths ask for a QR code, then a transfer that never hits the real company’s books.

The Lumen notice is about path 2. Taiwan’s ad law, and most of Google’s published Taiwan fraud numbers, are about path 1. The requester treated them as one problem: Google hosts the account that starts the fraud, so Google should cut it off.

For companies, the operational lesson is narrower than the statute. A chairman will not invent a new LINE group by Gmail and demand a same-day remittance. An ad that offers a private LINE “investment classroom” is the consumer version of the same move. Both should be checked on a second channel before anyone scans a QR code.