Introduction

The headquarters of the scam economy have always been elusive, shifting between countries, towns and cities like a shadow. Western Africa, once heralded as a hotbed for digital fraud operations, has now been superseded by Southeast Asia, where hundreds of major scam centres are scattered.

The operations of these criminal groups transcend the digital world, securing land to build cities and special economic zones dedicated to crime operations. They’ve set up sophisticated money laundering and human trafficking networks dedicated to staffing operations across Southeast Asia, including scam bases in Cambodia, Laos, Myanmar and the Philippines.

The epidemic is named sha zhu pan, known in English as Pig Butchering, and it’s spreading with targets across the globe, including in Australia and New Zealand. A research deep dive on the tools, infrastructure and expertise has shone a light on how these operations have been able to scale rapidly.

The expansion has been enabled by new crime-as-a-service offering. Namely, toolkits which offer customers access to the social operation and technical platforms at the heart of crime operations, creating an easy entry point for wannabe scammers.

In January, a notorious pig butchering criminal, Kuong Li, was charged with illegal recruitment for exploitation, aggravated fraud, organised crime and money laundering relating to alleged offences committed in Cambodia and internationally since 2019.

The Tools of the Trade

Previously, cybercrime was only successful with highly skilled practitioners. These days, the sale of ‘how to’ toolkits, has substantially reduced the barrier to entry and, as a result, international law enforcement is struggling to keep up.

From romance and investment scams to law enforcement impersonation and job or task scams, the tools necessary to run these operations are readily available on specific marketplaces. Australians lost $156.8 million to romance scams in 2024, according to ScamWatch.

Some of the organisational structure of pig butchering services are not too dissimilar to your typical, legal, organisations. They need communication equipment, compelling sales scripts, access to bank accounts, social media accounts, as well as a website to convert potential targets.

However, cybercriminal organisations also need a reliable way to quickly launder stolen funds and cryptocurrencies, moving wealth without law enforcement catching on. This includes using pre-registered SIM cards, fake identities and stolen social media accounts, smuggled Starlink satellites and a rigged online investment platform.

All of these are available through the full packages and fraud kits now offered by nefarious actors, who openly advertise and sell these kits alongside scam templates and other solutions.

One particular distributer, known as Penguin, which began with shè gōng kù (社工库), literally, a “social worker database”, shares personally identifiable information taken through theft and resale, allowing aspiring cybercriminals to gain access to travel history, documentation of political leanings and information about relatives.

These groups also sell account data mined from social media platforms like Tinder and WhatsApp, as well as login information from sites like Adobe and Apple’s developer platforms.

With this information at their fingertips, wannabe scammers still need one thing: a platform they can direct victims to, the actual pig butchering website and fraud content. Such platforms are easily provided by other nefarious organisations in the business.

Premade templates for these websites include those geared towards crypto, forex or gold investment and the resulting website can also be easily geofenced in an effort to avoid law enforcement takedowns in high-risk jurisdictions.

The best part? The platform requires victims to upload proof of their identity, just like on a real trading website.

These toolkits offer everything needed to run a pig butchering operation. Some fraud syndicates even mix real transactions with fictional ones to disguise financial streams and confuse law enforcement. With access to valid trading accounts, scammers can move large sums of money, from both legitimate and illegitimate sources.

As if the barrier to entry needed to be any lower, these templates can cost as little as AU $75. Through this setup, an operation recently exposed in America and mentioned in Jia vs. the United States case, for instance, could achieve a return on investment of approximately 70,000 per cent.

The low barrier to entry has, unsurprisingly, resulted in an explosion of cyber-enabled fraud in Southeast Asia and subsequently, billions of dollars in financial losses felt throughout the globe. Sophisticated Asian crime syndicates have created a global shadow economy from their safe havens in Southeast Asia.

Conclusion

What once required technical expertise or an outlay for physical infrastructure, can now be purchased as an off-the-shelf service offering everything from stolen identities and front companies to turnkey scam platforms and mobile apps.

Some of the world’s network of underground powerhouses are now pivoting from drug dealing to scams and cybercrime, recognising its profitability and the lower risk of being apprehended. They know they are safe in their special economic zones, and that international investigations, when they happen, are often too slow to stop them.