How Scam Networks Operate
How scam networks operate has changed: many modern online scams are now organised like businesses. Different people or service providers may handle advertising, stolen data, websites, telephone calls, victim conversations, payment collection and money laundering. The person who sends a message may be in a different country from the person controlling the operation, the bank account receiving the money or the website being used.
There is no reliable league table showing which country has the “most scammers.” Criminals disguise their locations, investigations see only part of the market, reporting rates vary and many operations cross several borders. In some industrial scam centres, the people sending fraudulent messages are themselves trafficking victims working under coercion.
The strongest current evidence nevertheless shows several concentrations:
- Cambodia, Myanmar and Lao PDR remain prominent locations for industrial scam compounds.
- Scam compounds have also been documented in Malaysia and the Philippines, while Thailand has been important in recruitment, trafficking, transit and enforcement activity.
- West African networks are strongly associated with business email compromise, romance fraud and increasingly professional investment fraud.
- India-based call centres repeatedly appear in government, bank and technical-support impersonation cases.
- Central, Eastern and Southern Europe and the Western Balkans contain multilingual “boiler room” operations focused heavily on investment fraud.
- Scam-centre models are spreading into Southern Africa, the Middle East, Central America, South America and the Pacific.
These are documented operational patterns, not judgments about the people of any country or region.
Why a simple country ranking would be misleading
A visible clue rarely reveals where the whole operation is based. A local telephone number can be spoofed. A familiar bank account can belong to a money mule. A website can be hosted in one country, registered through a company in another and controlled from somewhere else. Operators can also buy advertising, identity documents, scripts, voice services and payment accounts from separate criminal suppliers.
Law-enforcement statistics have similar limits. A country with effective reporting may record more cases than one where victims have nowhere to report. Arrest figures measure enforcement activity, not the total number of offenders. Financial-loss figures usually describe victims’ locations, not the origin of the operation.
INTERPOL therefore describes fraud as a networked, transnational threat. Its 2026 assessment found that financial fraud continued to increase in volume and sophistication, supported by international criminal collaboration, artificial intelligence and specialised money-laundering groups.
Source: INTERPOL, Global Financial Fraud Threat Assessment 2026
The Scam Networks Operate: The Modern Scam Supply Chain
Although individual schemes differ, many organised operations follow the same broad sequence.
1. Finding potential targets
Initial contact may come through a social-media advertisement, search result, dating profile, marketplace listing, messaging application, email, telephone call or fake job offer. Some campaigns contact very large numbers of people. Others use leaked or purchased information to select people by age, profession, interests, financial position or previous activity.
The opening approach is often deliberately ordinary. It may look like a delivery notice, account warning, wrong-number message, employment opportunity, investment discussion or request from a customer or supplier.
2. Borrowing trust
Impersonation is central to many fraud types. The operator may pose as a bank, police officer, regulator, employer, broker, courier, technical-support agent, family member or romantic interest.
Trust can be supported by a professional website, copied branding, forged documents, a local telephone number, fake reviews or a trading dashboard displaying invented profits. Europol reports that investment-fraud networks use multilingual call centres, social media, dedicated websites and explanations about taxes or fees to keep victims paying when they attempt to withdraw funds.
Source: Europol, Online Fraud Schemes: A Web of Deceit
3. Controlling the conversation
The emotional pressure varies with the story. Impersonation scams create fear and urgency. Romance scams build trust and obligation. Investment scams create excitement, exclusivity and fear of missing out. Business email compromise relies on routine and authority, making a fraudulent payment instruction look like part of an existing commercial relationship.
Operators may move the conversation from a public platform to private messaging. They may discourage independent advice, insist on secrecy or remain on the telephone while the victim completes a payment. A small successful withdrawal or token return can be used to make a fraudulent investment platform appear genuine before larger payments are requested.
4. Extracting money or information
The requested payment method depends on what is available in the victim’s country. It may involve a bank transfer, card payment, cryptocurrency, mobile money, gift cards, a payment application or even a cash courier.
The FBI documented a 2026 cryptocurrency-investment pattern in which victims were shown fictitious returns and later told to hand cash to a courier. Other schemes seek account credentials, identity documents or one-time authentication codes rather than an immediate payment.
Source: FBI Internet Crime Complaint Center, Cash Couriers in Cryptocurrency Investment Scams
5. Separating the money from the crime
The first receiving account may not belong to the organiser. Criminal networks recruit money mules through fake jobs, romance approaches, investment offers and impersonation. A mule receives or forwards funds, allowing the network to place distance between the payment and the people controlling the scheme.
Funds may then move through additional bank accounts, payment processors, shell businesses, cryptocurrency wallets, exchanges, gambling services or cash withdrawals. INTERPOL warns that a person can face serious consequences for acting as a money mule even when that person did not initially understand the arrangement.
Source: INTERPOL, Money Mules: What Are the Risks?
6. Returning to the same victim
A payment does not necessarily end the operation. Criminals may request taxes, clearance charges, security deposits or withdrawal fees. Victim information can also be reused or sold.
Recovery fraud is a particularly damaging second stage. Someone claiming to be a lawyer, investigator, regulator or recovery company promises to retrieve the original loss in exchange for another payment. The FBI’s 2025 complaint data recorded 10,516 recovery-scam complaints associated with USD 1.4 billion in reported losses, although that loss figure may include money lost in the preceding fraud.
Source: FBI Internet Crime Complaint Center, 2025 Annual Report
Industrial scam centres and forced criminality
Some of the largest online fraud operations are physical compounds containing offices, accommodation, security and telecommunications infrastructure. They may operate behind the appearance of a casino, hotel, online-gambling business, technology park or other legitimate investment.
The workforce is not uniform. Organisers, managers and willing participants can operate alongside people recruited through fake job advertisements and then detained, threatened or forced to conduct fraud. UN Human Rights has documented passport confiscation, debt bondage, beatings, torture, sexual violence and other severe abuse within parts of this system.
This produces two groups of victims: people defrauded online and people trafficked into committing the fraud. Treating every person found inside a compound as a willing offender can conceal serious human-rights violations.
By March 2025, INTERPOL had identified trafficking victims from 66 countries. Seventy-four percent of the identified victims had been taken to centres in Southeast Asia. By late 2025, INTERPOL reported that the affected nationalities had risen to nearly 80.
Sources: INTERPOL, Globalisation of Scam Centres; UN Human Rights, Online Scam Operations and Trafficking into Forced Criminality
Where are the best-documented concentrations?
Southeast Asia: industrial compounds and global targeting
Cambodia, Myanmar and Lao PDR are the most consistently documented core locations for large scam compounds. UN reporting also identifies operations in Malaysia and the Philippines, with Thailand playing a significant role in recruitment, trafficking routes, transit and regional enforcement.
UNODC has linked the growth of this model to casinos, online gambling, special economic zones and border areas where regulatory oversight or state control may be weak. It identifies Sihanoukville in Cambodia, Myawaddy in Myanmar and Bamban in the Philippines as examples where criminal investment has supported scam centres, illegal casinos or trafficking activity.
The Philippines prohibited offshore gaming operations in 2024 following major enforcement and trafficking concerns. UNODC reports that the shutdown displaced some criminal operations towards neighbouring jurisdictions, particularly vulnerable areas in Cambodia, Lao PDR and Myanmar.
The most prominent schemes include fraudulent cryptocurrency and Forex investment, romance-investment fraud, impersonation, illegal gambling, sextortion and associated money laundering. Operations may use multilingual workers to target victims far outside the region.
Sources: UNODC, Casinos, Cyber Fraud and Trafficking in Southeast Asia; UNODC, Strategic Infiltration of Vulnerable Jurisdictions
West and Southern Africa: BEC, relationship fraud and expanding investment operations
INTERPOL identifies business email compromise, investment fraud and romance fraud as the three most prevalent financial-fraud threats reported by African member countries. It says many offenders targeted by international notices were from West Africa, while also recording offenders from other regions.
Business email compromise has progressed beyond a basic fake email. Organised groups can study corporate structures and communication patterns, compromise or imitate trusted accounts and redirect genuine payments. INTERPOL says leading networks are predominantly based in West Africa but are expanding into Eastern and Southern Africa.
Investment and romance-investment operations are also becoming more industrialised. Some use polished applications, AI-generated advertisements and scam centres in Southern and West Africa to target people in North America and Europe.
A separate model in Central and West Africa uses fake multi-level marketing or employment opportunities to recruit young people. Recruits can be pressured to obtain fees from relatives and friends, exploiting existing community trust.
Source: INTERPOL, Global Financial Fraud Threat Assessment 2026, Africa section
India and South Asia: impersonation call-centre cases
India-based call centres repeatedly appear in prosecutions involving government, bank, retailer and technical-support impersonation aimed at victims in English-speaking countries. These operations commonly use urgency or fear, telling a target that an account, tax record, computer or identity is in danger.
The visible caller may work from a call centre while cash collection, bank accounts or money laundering are handled by associates in the victim’s own country. This again illustrates why the apparent location of one participant does not describe the whole network.
This is a documented specialisation, not a claim that India accounts for most global fraud. South Asia is large and diverse, and the available cases cannot measure the number of offenders across its population.
Source: US Department of Justice, Annual Report on Activities to Combat Elder Fraud and Abuse 2025
Europe: investment boiler rooms and multilingual targeting
INTERPOL reports scam centres in Central, Eastern and Southern Europe and the Western Balkans. These more often resemble boiler rooms than the trafficking-linked compounds seen in Southeast Asia. Their principal focus is investment fraud.
Operators use scripted sales pressure, fake trading platforms and multilingual staff. Europol-supported cases have uncovered call centres in countries including Serbia, Bulgaria, Cyprus, Latvia and Lithuania, while other investigations have connected operations and facilitators across Albania, Israel and several EU countries.
European authorities also report bank, police, telecommunications and technical-support impersonation, business email compromise, romance fraud and family-emergency or “shock call” schemes. Networks and payment routes frequently cross several jurisdictions.
Sources: INTERPOL, Global Financial Fraud Threat Assessment 2026, Europe section; Europol, Call Centres Selling Fake Crypto Taken Down
Middle East and North Africa: investment, BEC and impersonation
INTERPOL identifies investment fraud, business email compromise and impersonation as the leading regional financial-fraud threats. A common investment pattern begins with social-media content or a closed messaging group, followed by a small apparent return and pressure to make a larger deposit. Victims can also be recruited as money mules.
Impersonation schemes commonly copy banks, delivery services, financial institutions or money-transfer agents. INTERPOL has also detected scam centres in several countries in the region, although the public evidence does not support a simple country ranking.
Source: INTERPOL, Global Financial Fraud Threat Assessment 2026, MENA section
The Americas and the Pacific: major victim markets and emerging centres
North America remains a major target for business email compromise, investment fraud, government impersonation, technical-support fraud and schemes aimed at older adults. Latin America and the Caribbean report impersonation, phishing, remittance-related fraud and increasing sextortion.
INTERPOL also reports that the scam-centre model is expanding into parts of South America, Central America and the Pacific. Some operations recruit through fake employment advertisements, while transnational groups seek Spanish- and Portuguese-speaking workers to target additional markets.
The presence of large reported losses in the United States, Canada or Australia does not mean that most offenders are located there. Those figures primarily describe where victims report the crime.
Sources: INTERPOL, Global Financial Fraud Threat Assessment 2026, Americas and Asia-Pacific sections; FBI Internet Crime Complaint Center, 2025 Annual Report
Regional patterns at a glance
| Region | Strongly documented patterns | Important qualification |
|---|---|---|
| Cambodia, Myanmar and Lao PDR | Large scam compounds, investment and cryptocurrency fraud, romance-investment fraud, impersonation, illegal gambling and laundering | Many workers are trafficking victims; operations are transnational |
| Philippines and Malaysia | Documented compounds, online gambling links, investment and impersonation fraud | Enforcement and displacement make the picture change quickly |
| West Africa | Business email compromise, romance fraud, advance-fee fraud and investment schemes | Networks operate internationally and may use infrastructure or associates elsewhere |
| Southern Africa | Expanding scam-centre and investment-fraud activity | Evidence supports an emerging regional pattern, not a precise country ranking |
| India | Government, bank, retailer and technical-support impersonation call centres | A well-documented specialisation, not a measure of all fraud originating in India |
| Central and Eastern Europe and the Western Balkans | Investment and cryptocurrency boiler rooms, telecom fraud and multilingual call centres | Networks, victims and money flows span multiple jurisdictions |
| Middle East and North Africa | Investment fraud, BEC, impersonation and money-mule recruitment | Public reporting often describes the region rather than naming every operating country |
| Americas and Pacific | Large victim markets, impersonation, BEC, sextortion and emerging scam-centre activity | Reported losses usually identify victim location, not offender location |
What AI changes
Artificial intelligence does not replace the underlying psychology of fraud. It makes existing methods easier to scale and personalise.
Criminals can use generative systems to translate messages, imitate professional writing, create profile images, clone voices, produce false documents or adapt a conversation to information gathered about the target. INTERPOL also reports AI-generated investment dashboards, deepfake-enabled sextortion and more automated fraud campaigns.
The practical implication is that spelling, design quality, a confident voice or a video call can no longer carry much evidential weight by themselves. Verification increasingly depends on independent records and consistency across sources.
Source: INTERPOL, Financial Fraud Threat Assessment 2026
What can be checked before relying on an online offer?
No single check can establish that an offer is safe. A stronger assessment compares several independent signals:
- when the domain was registered and whether its history matches the claimed business age;
- whether named companies, directors, licences or professional memberships appear in the relevant official registers;
- whether contact details, addresses and company names remain consistent across the website, invoices, advertisements and public records;
- whether copied text, images or terms appear on unrelated websites;
- whether the payment recipient matches the person or business making the offer;
- whether independent reporting, archived pages or regulatory warnings contradict the sales claims;
- whether pressure, secrecy or unexplained changes appear when questions are asked; and
- whether the promised service, investment or product can be verified outside material controlled by the seller.
These checks cannot determine guilt or guarantee safety. They can reveal contradictions, missing evidence and questions that deserve closer examination.
The central lesson
The question “Which country is this scam from?” is often too narrow. A modern fraud can involve advertising bought in one country, a website hosted in another, an operator in a third, a money mule near the victim and organisers or laundering services somewhere else.
The better questions are:
- Who is making the claim?
- What independent evidence supports it?
- Where is the money actually going?
- Are the website, company, people and payment details consistent?
- What changes when the offer is examined across several public sources?
Scam networks benefit when an offer is judged only by its surface appearance. Independent, source-linked research cannot guarantee an outcome, but it can make the hidden inconsistencies much easier to see.
AdUncovered provides focused Quick Reports and broader Comprehensive Reports based on publicly available sources. Reports organise relevant findings, links and limitations for further consideration; they do not issue legal findings or guaranteed verdicts.
Research limitations
This article summarises publicly available information from international organisations and law-enforcement authorities. Known concentrations reflect detected, reported or investigated activity. They are not a complete map of global fraud.
Terms such as “associated with” or “known for” refer to recurring patterns documented by cited sources. They should not be interpreted as claims about a nationality, ethnic group or population. Criminal organisers, willing participants, coerced workers, trafficking victims, money mules and defrauded consumers can all appear within the same transnational operation.
Principal sources
- INTERPOL: Global Financial Fraud Threat Assessment 2026
- INTERPOL: Globalisation of Human-Trafficking-Fuelled Scam Centres
- UN Human Rights: Online Scam Operations and Trafficking into Forced Criminality
- UN Human Rights: A Wicked Problem
- UNODC: Casinos, Cyber Fraud and Trafficking in Southeast Asia
- UNODC: Strategic Infiltration of Vulnerable Jurisdictions
- Europol: Online Fraud Schemes – A Web of Deceit
- FBI Internet Crime Complaint Center: 2025 Annual Report
- US Department of Justice: Annual Report on Activities to Combat Elder Fraud and Abuse 2025
- INTERPOL: Money Mules – What Are the Risks?
Check before you pay
About to pay a seller or business you don’t know? Start with a Free Quick Check of the advert link. It screens for common warning signs and shows where each result came from.
If you need the seller researched, a Quick Report or Comprehensive Report brings together source-linked Search Results on the seller and the offer. Neither gives a verdict: you check the sources and decide for yourself.
