By Angela SP Yap

The world is training its guns on organised cybercriminals operating industrial-scale scam centres in Southeast Asia.

Over the past 12 months, the Global Anti-Scam Alliance (GASA) reports that the world lost USD442 billion to scams. Closer to home, Malaysians lost an estimated MYR40.1 billion.

“Southeast Asia is the ground zero for the global scamming industry,” said Benedikt Hofmann, Deputy Regional Representative for Southeast Asia and the Pacific, from the United Nations Office on Drugs and Crime (UNODC) in an interview after visiting a defunct scam farm in the Philippines post-raid.

Operations range from identity theft, blackmail and extortion to more long-term fraud such as pig-butchering, and artificial-intelligence-driven deepfakes.

Battling what’s been described as “a national security problem and a homeland security problem”, the US Department of Justice declared that its newly formed Scam Center Strike Force will target cybercriminals based in Southeast Asia that are estimated to have defrauded Americans of USD10 billion in 2024, a 66% increase from the year prior.

This October, financial regulators in Asia, the US, and UK swiftly took down major scam operations in the region:

  • Cambodia-based Prince Group, an alleged transnational criminal empire of online investment scams where trafficked workers conduct online scams, was imposed with 146 sanctions by the Office of Foreign Assets Control under the US Department of Treasury.
  • An 18-month investigation into the Prince Group’s money trail led to the USD15 billion seizure of 127,271 bitcoins, the largest asset forfeiture in its history.
  • The UK government separately froze 19 London properties worth more than GBP100 million belonging to Chen Zhi, founder and chairman of Prince Group.
  • Singapore also seized the Group’s properties and financial assets worth over SGD150 million in relation to money laundering and forgery offences.
  • Huione Group, a financial services conglomerate, was severed from the US Financial system following the finalisation of a rule under Section 311 of the USA PATRIOT Act by the Financial Crimes Enforcement Network for alleged money laundering of proceeds from virtual currency scams.

Year-end efforts continue as the Prime Minister of Thailand Anutin Charnvirakul said on 3 December that the nation had seized over USD300 million in assets connected to transnational criminal networks running Southeast Asian scam centres.

From Centre to State

Cybercriminal networks have long been in existence, however, the pandemic supercharged their scale and trajectory using advanced technologies like artificial intelligence and malware to exploit their victims. It was faster, cleaner, and more lucrative.

The Centre for Strategic and International Studies reports that from 2022 to 2023, the Asia-Pacific region saw a 1,530% spike in deepfake fraud to help scammers perpetrate investment fraud, create deepfake pornography for blackmail, and impersonation schemes. It’s also been deployed by cybercriminals to bypass digital verification systems and Know Your Customer procedures, an added dimension of complexity and threat to financial institutions.

Scam centres are compounds used by cybercriminal networks to fuel an online fraud industry that is worth billions. In some states, illicit revenue comprises up to 50% of its local gross domestic product.

The Guardian’s Tess McClure writes in her December exposé that “[s]o monolithic has the multi-billion-dollar global scam industry become that experts say we are entering the era of the ‘scam state’. Like the narco-state, the term refers to countries where an illicit industry has dug its tentacles deep into legitimate institutions, reshaping the economy, corrupting governments and establishing state reliance on an illegal network.”

Throughout the past months, Myanmar’s military junta raided cyber scam hubs along the Thai-Myanmar border in a series of highly publicised crackdowns. The largest is KK Park, a heavily guarded 210-hectare complex which reportedly held over 100,000 trafficked scam workers on a site that barren fields just five years ago, proof of how quickly these ‘scam states’ proliferate. Time lapse satellite imagery however show that scam complexes along the border have doubled since 2021 – new sites are continuously popping up as older ones are either infiltrated and demolished or expand in size.

New Epicentre

Tasked with combatting organised crime, corruption, terrorism, and money laundering, the UNODC has long red-flagged regions such as Myawaddy (Myanmar), Sihanoukville (Cambodia), and Bamban (the Philippines) as fraud havens running large-scale compounds linked to sophisticated transnational criminal networks.

“In recent years, UNODC identified criminal syndicates have increasingly invested in casinos, junket operations, and online gambling platforms, particularly in Special Economic Zones and autonomous regions, to facilitate money laundering, underground banking, and cyber-enabled fraud. Some of these investments appear to have masqueraded, or operated under the cover of legitimate enterprises, allowing criminal actors to move and clean large volumes of illicit funds, including both fiat and cryptocurrencies.”

These fraud networks, which typically revolve around gaming and casino licences coupled with a network of corrupt beneficiaries, have since evolved to take advantage of green energy narratives, as seen in criminal groups masquerading as solar panel startups to gain entry into Cambodia. This provides a layer of legitimacy and front for illicit activity in jurisdictions with lax regulatory controls, limited technical expertise, and weak due diligence mechanisms.

In September 2025, UNODC announced a new scam hub emerging in Southeast Asia’s Timor-Leste which “showcases patterns and emerging developments indicative of the establishment and operation of a Southeast Asia-style scam centre”.

Its Threat Alert on the Strategic Infiltration of Vulnerable Jurisdictions Through Criminal Foreign Direct Investments: The Case of Timor-Leste spotlights trends in the country’s criminal foreign direct investment, specifically in the special administrative region of Oecusse and its Oecusse Digital Centre, where organised crime groups have reportedly embedded illicit activities within a legitimate economic framework.

The Alert came on the heels of the arrest of 10 people on suspicion of involvement in illegal gambling and computer fraud in Oecussi. The region relies on cryptocurrency and digital assets designed to attract investors and regulatory support whilst concealing illicit intent.

A well-placed source has confirmed with this writer about the accuracy of the Timor-Leste report. This source has also disputed claims by the mainstream Western presses that the syndicates are solely China-based, indicating that there are other high-net-worth perpetrators rolling in illicit activities and money laundering in Timor-Leste, including Malaysians.

This is further corroborated by an opinion piece by Michael Rose, adjunct professor at the University of Adelaide, carried in the South China Morning Post and online portal, The Conversation:

“On September 21, Agio Pereira, Timor-Leste’s Minister of the Presidency of the Council of Ministers in Timor-Leste, published in Facebook post titled, A Manifesto for the Defence of Timor-Leste, alleged that USD45 million had been smuggled into the country by “transnational criminal syndicates from Cambodia, Malaysia, Macau and Hong Kong” in order to influence regulatory bodies to grant “fraudulent licences” and set up “protected enclaves” where “illegal gambling, cyber-scam centres and human trafficking would be able to operate under state protection”.

“He [Pereira] said the country faces a simple choice: Will we be a sovereign nation governed by democratic laws and institutions, or will we become a criminal state owned by foreign mafia syndicates?””

The government subsequently passed a resolution to cancel licences granted to online gaming and betting operators plus prohibition from further new licences.

International Financial Intelligence

Swift enforcement requires global cooperation. In August 2024, a Singapore-based commodity firm was tricked into transferring USD42.3 million to a fraudulent account in Timor-Leste based on an email sent by cybercriminals impersonating as their supplier.

The Singapore Police Force (SPF) contacted Timor-Leste authorities through INTERPOL’s Global Rapid Intervention of Payments (I-GRIP) mechanism. This led to the freezing of USD39.3 million in the fake supplier’s account with an additional USD2 million recovered and the arrest of seven suspects.

With the majority of funds sent through wire or bank transfers (29%) and credit cards (18%), the Netherlands-based GASA’s State of Global Scams 2025 Report found:

  • 45% of adults believe that banks should always be responsible for reimbursing those experiencing a scam;
  • 74% Of adults Globally who were scammed did report the scam to the payment service; and
  • 30% were able to at least partly recover the money.

Debates are ongoing on the boundaries of liability and accountability of financial institutions when it comes to scams. Different jurisdictions have developed specific obligations in their regulatory frameworks in order to protect citizens from scams and enforce financial resilience mandates.

Morphed State

Transnational cybercriminal organisations don’t just commit economic crimes but crimes against humanity. The sweatshop labour camps they operate, oftentimes using enslaved labour, has been called out by United Nations rights experts as having “reached the level of a humanitarian and human rights crisis.”

These experts have urged Southeast Asian countries to “go beyond surface-level public awareness campaigns” and address the true drivers of forced cybercriminality – poverty, lack of access to reasonable work conditions, education, and healthcare.

These issues are at the heart of the environmental, sustainability, and governance movement that banking has pledged to tackle.

Exposing the dark inner workings of scam farms is only part of the equation. Banks should also look within, explore its own inner workings; question where they may have erred, when controls were lax, or whether bankers turned a blind eye.

Angela SP Yap is a multi-award-winning social entrepreneur, author, and financial columnist. She is Director and Founder of Akasaa, a strategic consulting and publishing firm with offices in London, Kuala Lumpur, and Sharjah. An ex-strategist with Deloitte and former corporate banker, she has also worked in bond pricing and in international development with the UNDP. Angela holds a BSc (Hons) Economics.