Samsung computers, Huawei smartphones , Redmi handsets and dozens of Chinese and Malaysian passports. Some suspects fled the scene, and when police moved in, nearly 20 Chinese nationals were taken into custody.
On paper, the inventory from the police raid in early July looked like any of the scam-center busts now commonplace in Southeast Asia. Governments there are under pressure from China and the US to tackle sprawling illicit networks driving hundreds of billions of dollars in losses each year through operations built on cryptocurrency, human trafficking and cutting-edge AI tools to conduct online fraud on a massive scale.
Instead, the bust was thousands of miles away, on the 18th floor of a modern apartment building in Nairobi. The suspects allegedly ran a fake investment scheme targeting accounts in China, Hong Kong and Malaysia, laundering millions of shillings through Kenya’s banks, according to police investigators who spoke to Bloomberg on condition of anonymity to discuss an active case. They entered Kenya from China, Cambodia and Madagascar, the people said.
The raid points to a broader shift in scam operations as they spread beyond Asia’s fortified compounds, become cheaper and easier to run – and harder to kill. Stolen data, fake accounts, fraudulent websites, AI software and laundering services are all bought online, allowing smaller crews to rebuild after takedowns and move when authorities close in.
The Global Anti-Scam Alliance estimates victims lost $442 billion across 42 countries last year, above some valuations for the global cocaine trade. Alongside the high cost to those who are scammed there’s the growing challenge for companies to manage their exposure.
“It’s just gotten so cheap and so easy,” said Sean Letz, the Asia cyber lead at Marsh Risk, a US-based insurance broker and risk-management adviser. “What a lot of companies start to recognize is that you only get to a certain point, and trying to play whack-a-mole with the scams — with the different tactics — is impossible.”
Helping drive the proliferation are underground marketplaces operating on widely used social media platforms that let scammers buy the pieces online with ease. Cybersecurity researchers found that subscription-based exploitation tools are available for as little as $500 a month , while bulk-messaging services can send material to 10,000 email addresses for $1.
Basic phishing services can run under $100 , with bad actors rapidly generating fake sites by exploiting free accounts on popular, legitimate developer networks. One of the largest was Xinbi Guarantee, a Chinese-language platform whose operator had registered a company in Colorado and which processed about $24 billion in transactions before US authorities seized its Telegram channels and cryptocurrency wallets in September.
Blockchain-data firm Chainalysis mapped part of Xinbi’s supply chain for Bloomberg just before the takedown. The trails connected prospective customers with vendors selling stolen personal data, deepfake software, account-registration services, web development and money laundering — effectively putting prices on pieces of a scam operation.
One prospective buyer paid $834 to a data vendor, while another sent $9,150 to a seller of AI and deepfake software. A separate AI vendor was tied to a $200 payment. Other wallets were linked to services offering ready-made social-media accounts or exchanging scam-tainted crypto for cleaner assets at a discount.
“If Chinese organized crime can buy a custom website and a money laundering service the way you order takeout, then every American with a retirement account is in the blast radius,” US Attorney Jeanine Pirro said shortly after the US action against Xinbi.
Reported cybercrime losses in the US grew from $17.8 million in 2001 to nearly $21 billion last year, a number agencies warn will continue to balloon unless countries coordinate enforcement and disrupt the infrastructure that lets scams move across borders.
The Xinbi ecosystem also connected back to the old compound economy, according to Chainalysis. One wallet associated with KK Park, a notorious scam hub on the Myanmar-Thai border, sent $18.4 million through an intermediary to a prospective customer that later paid vendors offering account-registration and web-development services.
A real-time translation service offered on Telegram for less than $20 a month revealed links to libraries of investment pitches and romance-scam scripts tailored to sexuality preferences, with detailed chat schedules and information on US pensions, credit scores and even eating habits.
The same day Xinbi was closed, one vendor known to sell payment-fraud and money laundering services on the platform called it a “valuable opportunity” and told customers where to find it next. Having already weathered the closure of three other such marketplaces, the group represented on Telegram by a Guy Fawkes-masked figure encircled by a golden dragon, assured clients it had already diversified across different channels and would shift to a model where customers could deal with them directly.
“While this incident caused short-term volatility, in the long-run, it helps us refine our business,” it posted in Chinese on one of its channels.
With law enforcement targeting fortified compounds in Myanmar and Cambodia, some Chinese-linked syndicates are dispersing into new territories across Africa and Sri Lanka, with scam operations also being found as far afield as Dubai, Sri Lanka, Albania and Ukraine. Rather than taking over whole towns and cities, they are resurfacing in apartments, hotels and even vehicles, forming a more localized, pop-up industry aided by underground digital markets and local criminal networks.
The number of nationalities identified among people winding up in scam centers stands at 89, according to previously unpublished figures provided by Interpol, a more than fivefold increase since early 2023. The list now stretches well beyond Asia to Canada, Italy, Spain, Poland, Mozambique, Algeria, Argentina, Ecuador, Lebanon and dozens more.
The machinery has advanced significantly since the “Nigerian prince” mass-email scams of the 2000s. Stolen data is used to locate targets on platforms like Facebook or WhatsApp. The scam then moves through AI-generated scripts, phishing pages and laundering networks. Groups that once focused on Chinese victims, now run simultaneous schemes across multiple nationalities simultaneously – fake invoices, stolen bank credentials, romance-investment traps, bogus law-enforcement calls and even pitches tailored to religious beliefs.
At HSBC, fraud is now a $1 billion-a-year burden, while crypto platforms say the payments are hard to stop because victims often authorize the transfers themselves. Letz from Marsh Risk estimates the cyber insurance market has grown 150% over the last five years, with some firms spending 1% to 2% of annual turnover on IT and cybersecurity.
Some 57% of the world’s adult population have reported being targeted by fraudsters, according to a GASA survey .
In Brisbane, Australia, 69-year-old author Judy nearly fell for an impersonation scam from someone posing as an Atlantic Books editor. The approach escalated through a supposed literary agent and developmental editor, providing tailored feedback on her work and linking to professional-looking websites.
“I thought it was a bit odd, but they had picked up my most recent self-publication and asked me what else I was writing,” she said, asking to use only her first name in order to discuss personal matters. “They really liked it. This ego was a little bit massaged, but the cynic was still sitting there, luckily."
**
A recent visit to an abandoned fraud compound in Cambodia linked to the alleged scamming outfit Prince Group offered a glimpse of how the industry operates. Opened to reporters for the first time since authorities seized it in January, the sprawling facility in a rural commune near the Vietnamese border was used for impersonation and investment fraud.
Amid emptied industrial safes, half-eaten food packets and tangles of ethernet cables, one document tracked prospective victims from initial contact through “hot chat” to payoff, while payroll sheets recorded performance and commissions, with some workers earning 8% of the revenue they generated.
One handwritten training note instructed workers to hunt for women in their 40s and 50s in comments beneath posts about luxury goods, cars, high-end hotels and tourist destinations. It also suggested using Chinese navigation service Baidu Maps to identify restaurants, hotels, factories and other businesses, finding owners or managers, adding them on WeChat and fabricating an opening message from details about the business.
The contents of what appeared to be a roughly 90-page training manual listed sections on “building trust,” “praising customers,” “persona packaging” and “heart-to-heart scripts.” “Guide the customer step by step into your trap,” another document reads. “These stories can be made up, but when telling them you must put emotion into them and show genuine feeling.”
Cambodia launched a sweeping campaign to dismantle scam centers last year following pressure from the US and China, triggering an exodus of around 250,000 foreign nationals. Today, the coastal city of Sihanoukville that previously anchored the industry, is a landscape of hastily abandoned hotels largely emptied of the travelers who previously underpinned the local economy.
Provincial Governor Mang Sineth acknowledged the damage inflicted on Cambodia’s standing during a recent interview, while asserting that authorities have eradicated 95% of illicit operators, a figure scam watchers dispute. The remainder is far harder to track down, he said, as operators set up shop in eateries, passenger cars or hotel rooms rented for only a few hours before moving again.
“Even two people, a husband and wife, can operate a scam,” he said. Police at times follow food delivery drivers to track which houses are ordering large amounts of food late into the evening. “Sometimes we conduct online scam crackdowns throughout the night without sleeping,” he said.
The speed of the fraud is changing too. Pig-butchering, the long-con romance-investment scam that came to define Southeast Asia’s compounds, can still require weeks or months of grooming, yet nearly two-thirds of scam victims today pay within 24-hours of first contact.
Phishing operations can be faster still. Components for fake websites mimicking brands, banks and payment gateways are increasingly being sold together as kits, while an analysis prepared for Bloomberg by ZeroFox , a US-based cybersecurity outfit, reveals how scammers with little technical ability are abusing legitimate developer platforms and AI app builders to launch pages with just a few prompts .
Phishing pages detected on the free tiers of nine sampled developer platforms and AI app builders rose more than fourfold to 10,600 over two years. Some tools were used to mimic Brazilian retailers, Ecuadorian banks, French lenders and US telecom companies, while Facebook, Netflix and Moonshot, a crypto-trading app, were among the most impersonated brands in the broader sample.
“What's new is that AI code generators now let someone with no coding skills build a convincing fake bank login in a few minutes, deploy it under a free subdomain, and start collecting credentials before anyone notices,” the analysis reads. “The volume is still small in absolute terms compared to the traditional players, but the growth curve is steep and the barrier to entry has collapsed.”
The problem has become a nightmare for social media platforms already being used as a conduit to target victims. Since last year, Meta Platforms Inc. removed more than 16 million accounts from Facebook and Instagram associated with criminal scam centers, the company told Bloomberg. It has also taken down 65 million scam ads from the two platforms, noting that 94% were removed before being reported.
“We block their accounts; they create more accounts. We go further and we block the technology they use – we hard block their devices,” said Nathaniel Gleicher, Meta’s head of counter-fraud and security policy. “They are able to get new devices, bring them in, and spin them up to facilitate their operations very quickly. That cycle of speed is part of what makes tackling the problem so hard.”
“Scams are bad for users, they’re bad for advertisers, and they’re bad for our platforms,” he said. “If you want to build a social media community that people want to spend years in, you can’t have this stuff filling it up.”
Even so, Meta faces accusations that it's profiting from fraudulent activities. Earlier this year, the company was sued in California for allegedly facilitating and profiting from billions in scam ads targeting families and seniors. Gleicher didn’t directly address the revenue claims when asked about the case, but said scammers deliberately mimic legitimate advertisers, which makes separating them out “incredibly challenging.” One solution, he said, is that the platform is expanding advertiser verification requirements.
Recent studies show malicious or abusive content continued to rise across more than a dozen major social media platforms in the first quarter, with scams and impersonation making up the bulk of observed threats.
In response, law enforcement authorities and private firms are increasingly joining forces. A recent operation brought Meta, Microsoft, Coinbase and Starlink together with the US Justice Department, FBI, Royal Thai Police and agencies from several other countries. Meta disabled 1.4 million Facebook and Instagram accounts, pages and groups, Microsoft suspended about 20,000 accounts, Starlink cut service to thousands of kits and Thai authorities made 63 arrests .
Yet officials and experts say the criminal infrastructure can still regenerate faster than governments can coordinate. Legal requests, financial investigations and victim screening must cross companies and national borders, while fraudulent accounts, websites and wallets can be replaced in hours.
“As operations grow more sophisticated, the need for robust coordinated legal accountability is feeling increasingly urgent,” said Allison Pytlak, director of the cyber program at the Washington-based Stimson Center, during a webinar. She cited a variety of legal gaps and loopholes, including in combating trafficking. For example, governments should better align enforcement priorities and screen workers found in scam compounds as potential trafficking victims rather than automatically treating them as suspects, she said.
In Serbia, victims are often targeted by call centers outside the country in Ukraine or Russia, said Vladimir Vujic, head of the Interior Ministry’s high-tech crime unit, while Balkan centers recruit workers fluent in German or English to pursue victims farther afield. But Belgrade's unique geopolitical position as a non-sanctioning European state has also created an opening to cooperate with Moscow to combat the digital threat. “We all have problems,” Vujic said, but “every state tackles problems in which perpetrators are in another country.”
The challenge has begun to intrude on diplomacy as well. Canadian Foreign Minister Anita Anand, whose country records more than $500 million in annual scam losses, recently described using an informal conversation with US Secretary of State Marco Rubio on the sidelines of a Manila summit to press for deeper cooperation.
“The question is, how can we ensure that Interpol and related organizations have the resources needed to address a multi billion-dollar criminal activity, like cyber crime and cyber scam centers.”
The financial burden is increasingly landing on legitimate companies, with banks, telecom operators and tech platforms being asked to reimburse victims and police the infrastructure criminals exploit. UK Finance said banks paid out £354.3 million ($481.5 million) to push-payment fraud victims last year, even as criminals stole £1.28 billion through UK payment fraud. Singapore has imposed a shared-liability framework on banks and telcos.
Africa shows how quickly scam operations can be plugged into the local workforce. In Lagos, a woman fired from a Chinese-run company for sleeping during work hours helped trigger a sting in late 2024 after contacting her brother at Nigeria’s anti-graft agency. The trail led to a five-floor phishing compound on Victoria Island, where more than 700 suspects were arrested, many of whom were convicted of online fraud, identity theft and cyber-enabled Ponzi schemes.
Former workers said the operation paired Chinese managers with Nigerian recruits, black-market phone numbers and AI-generated profiles.
“They see potential in some of the victims who have returned home,” said Jalil Muyeke, who was trafficked to Myanmar in 2023 and now works as a project coordinator for Freedom Collaborative, an organization that aims to prevent human trafficking. “Taking workers from Africa to Southeast Asia is becoming more expensive so it’s better for them to set up shop here in Africa.”