Fraud Management & Cybercrime , Fraud Risk Management , Geo Focus: Asia

Cambodian Scam Compounds Emerging as Growing Cybercrime Hubs

The Indian government has announced the repatriation of 250 citizens who were lured to Cambodia by cybercrime rings and forced to participate in a series of online scams.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

The government said fake recruiting agents operating in the Southeast Asian country used social media platforms such as Facebook and WhatsApp to lure Indian job seekers with fake job offers. Once the job seekers traveled to Cambodia, the agents forced them to work in "difficult and life-threatening conditions."

The illegal rings exploited citizens' lack of awareness about laws and regulations governing migrant work and used the veil of social media to falsify their credentials, contact details and whereabouts.

The government revealed in March that an estimated 5,000 Indians had fallen victim to such scams and were trapped in Cambodia against their will. Citing sources within the government, The Indian Express reported that the victims were offered data entry jobs in Cambodia and once they arrived were forced into virtual prisons with no way to contact authorities.

The government said international recruitment agencies must obtain a license from the Ministry of External Affairs prior to soliciting recruits, but illegal agencies bypass this mechanism by advertising fake job offers on WhatsApp and also overcharge applicants up to $6,000 to process applications and arrange travel.

"Our Embassy in Cambodia has been promptly responding to complaints from Indian nationals who were lured with employment opportunities to that country but were forced to undertake illegal cyber work," an Indian foreign ministry spokesperson said. "Collaborating closely with Cambodian authorities, it has rescued and repatriated about 250 Indians, of which 75 in just the last three months."

Unfettered Human Trafficking Fuels Cybercrime

The number of Indian rescued pales in comparison to the scale at which innocent job seekers are exploited and trafficked to Southeast Asian cybercrime hot spots such as Cambodia, Myanmar, Laos, the Philippines and Thailand to serve as cyber slaves. The UN Human Rights Office said last year that hundreds of thousands of people who ended up in these countries were forced to engage in cybercrime for food and shelter.

"Victims face a range of serious violations and abuses, including threats to their safety and security; and many have been subjected to torture and cruel, inhuman and degrading treatment or punishment, arbitrary detention, sexual violence, forced labor and other human rights abuses," the agency said.

UNHCR estimated that in 2023, scam centers in Myanmar and Cambodia held about 120,000 and 100,000 victims against their will, respectively, and Thailand, Laos and the Philippines accounted for tens of thousands of similar victims. Considering they generate revenue amounting to billions of U.S. dollars each year, there is no real incentive for scammers to move away from cybercrime.

Interpol said in December that human trafficking-fueled fraud had become so widespread that the industry had expanded beyond Southeast Asia and surfaced as far as the Middle East and Latin America.

An Interpol operation in October against human trafficking-fueled fraud, named Operation Storm Makers II, led to the arrest of 281 individuals for passport forgery, human trafficking and telecommunications fraud - plus the rescue of 149 victims.

"The human cost of cyber scam centers continues to rise," said Interpol Assistant Director Rosemary Nalubega. "While the majority of cases remain concentrated in Southeast Asia, Operation Storm Makers II offers further evidence that this modus operandi is spreading, with victims sourced from other continents and new scam centers appearing as far afield as Latin America."

Reuters reported that Interpol Secretary-General Jürgen Stock said organized cybercrime rings make up to $3 trillion every year. "What began as a regional crime threat in Southeast Asia has become a global human trafficking crisis, with millions of victims, both in the cyber scam centers and as targets," he said.

Cambodia has acknowledged the presence of a vast network of illegal scam centers, but the country faces several challenges in enforcement, including deep-rooted corruption, the involvement of politicians in cyber scam rings and the power wielded by casino owners.

The U.S. State Department in 2022 downgraded Cambodia to Tier 3, the lowest ranking in anti-trafficking efforts. Cambodia maintained that ranking in 2023, and the department found that the country failed to meet the minimum standards to curb trafficking and large-scale cyber scam operations.

"Authorities did not investigate or hold criminally accountable any officials involved in widespread, credible reports of complicity, in particular with unscrupulous business owners who subjected thousands of men, women and children throughout the country to human trafficking in cyber scam operations, entertainment establishments and brick kilns. Law enforcement did not effectively address forced labor in cyber scam operations," the State Department said.

According to the United Nations Office of Drugs and Crime, special economic zones and casinos in Cambodia, Myanmar, Laos, Vietnam and the Philippines have emerged as "scam compounds" for cybercrime cartels operating in Southeast Asia.

UNODC said a lack of law enforcement action against these scam compounds resulted in cartels amassing huge profits from their scam operations. "The profits of these organized crime groups have reached unprecedented levels, and illicit money is increasingly moving through the regional casino industry and other large cash flow businesses, including through a significant surge in the use of cryptocurrencies."

The cybercrime operations have defrauded businesses and individuals through pig-butchering scams, investment fraud, romance scams, cryptocurrency fraud and job-related scams. Prabeer Sarkar, a Malaysia-based data privacy advocate, told Information Security Media Group that scam operations in Southeast Asia have become a major social issue that governments must address through concerted action.

"The scam industry has become big and uncontrollable. To achieve greater profits, scam operators are now playing on people's emotions - selling dreams, offering lucrative jobs and promising huge profits from investments to deceive millions," he said.

The success of cybercrime in the region betrays the fact that despite organizations spending heavily on security solutions to harden their cyber defenses, cybercriminals continue to exploit the human factor to reap profits.

According to a survey by Vietnamese anti-scam nonprofit Chongluadao, cyber scam operations in Southeast Asia rose by a compounded annual growth rate of 29.8% since 2020, and the total number of scam calls and text messages in the region grew by 15 times in 2022.

The survey found that scam operations succeed because many people fail to recognize them, lack sufficient knowledge to detect them, are easily enticed by attractive offers and choose to take risks despite uncertainty over the offers being made.

"From a company standpoint, the findings underline the necessity of investing in fraud prevention, particularly in digital literacy and consumer awareness initiatives," said Hieu Minh Ngo, a threat analyst at NCSC Vietnam. "Collaboration between governments, corporations and civic groups is critical in building strong anti-fraud frameworks and technology to protect consumers and businesses alike."