Scam compounds

Recently, some of our team attended an online seminar on scam compounds hosted by the Global Anti-Scam Alliance, and presented by Dr Joshua James of the UN Office on Drugs and Crime, and David Braga, CEO of the International Justice Mission Australia.  

Some eye-opening things were covered that we thought were important to share. 

What are scam compounds? 

Scam compounds are facilities operated by criminal enterprises from which they conduct large-scale online scams. The people working in these compounds are often victims themselves, having been duped into travelling with the promise of a good job, and then trafficked to the compounds, often across borders.  

The types of scams

The scams are varied. They can include ransomware, cryptocurrency scams, sextortion, malware-enabled fraud, hacking, cyberattacks, and disinformation. 

How big is the problem? 

Huge. In 2023, the regional cyber-enabled fraud industry is estimated to have generated between US$18 billion and US$37 billion in financial losses for victims based in East and Southeast Asia alone. 

The advent of sophisticated artificial intelligence (AI) has lowered the bar for entry for all types of cybercrime. As is often the case, the speed of technological developments is outpacing the ability of governments and allied organisations to counter them. 

Changes to the finance sector have also made it more difficult to prevent and prosecute cybercrime. Money transfers are now often instant, even internationally. Cryptocurrencies make anonymous and untraceable transfers easy. New virtual assets often have loose or non-existent regulatory frameworks. 

Where is this happening? 

Criminal enterprises jurisdiction shop around, looking for areas with low levels of enforcement capacity and low awareness of their methods. Many of the compounds are located in remote border areas in and around special economic zones that have been infiltrated by organised crime. 

What is being done about it? 

Enforcement is still largely nationally based and fragmented, but the criminal enterprises are international and cooperating with each other. There is thought to be so much money to be made that rival enterprises are tolerant of each other and even share resources and technology. 

Enforcement operations do happen, and they do have an effect. Successful operations have discovered and shut down networks processing hundreds of millions of dollars in fiat and cryptocurrencies. A number of gambling websites involved in money laundering have been shut down.  

Successful operations also result in an observable reduction in scam activity, but the activity doesn’t stop. 

A big problem is that, often, countries struggle to identify the real perpetrators. The lines are blurred between people who are working in scam compounds because it is a genuine economic opportunity and those who are victims of trafficking and slavery. 

Working in scam centres sometimes is a genuine and voluntary economic opportunity because it is more rewarding than dangerous manual labour. This is especially true when international development funding is withdrawn from an area. 

However, huge numbers of people are still held involuntarily and forced, often under the threat of violence, to work in scam compounds. Job adverts promise attractive salaries, bonuses, and perks. Workers are told to pay for their visas and travel with the promise of reimbursement, but when they arrive, passports are confiscated and workers are forcibly removed to heavily-guarded scam compounds, often across international borders.   

What more can be done? 

There are too many scam instances to respond to all of them manually. Responses to scams need to be automated and scaled to make them effective. 

There needs to be much more cross-border cooperation, intelligence sharing (especially in the banking industry), and there needs to be much greater shared investment in tool and infrastructure development. 

Legislation needs to catch up — for instance, the UN Convention on Cybercrime needs to be signed and ratified. 

In response to forced scamming, the focus needs to be on identifying and prosecuting the real perpetrators, including those in the source and transit countries. Awareness of forced scamming and fake job offers needs to be raised in at-risk populations. 

The International Justice Mission is also involved in efforts to assist survivors of scam compounds. They identify victims during screening to enforce non-punishment principles and ensure the safe repatriation of the victims to their home countries. They also provide trauma support and translation services when dealing with foreign governments. 

Where to go if you have or someone you know has been scammed? 

National Cyber Security Centre (NCSC)

NCSC provides cyber security incident response services to all New Zealanders – from individuals and small to medium businesses and organisations, to large enterprises, government, and critical national infrastructure.

You can report incidents such as online scams, Malware, data breaches, and more to the National Cyber Security Centre (NCSC). They identify specific support they give to individuals and small to medium-sized businesses. 

Netsafe

Netsafe is New Zealand’s independent, non-profit online safety organisation. They provide practical tools, support, and advice. Their mission is to keep people of all ages safe online by providing free support, advice, and education to all ages.

You can report harmful content such as scams, bullying and harassment, to NetSafe, as well as access advice and support on how to stay safe online.  

'What about .nz domain names?

If you or someone you know comes across any .nz domain names that appear to be associated with websites or email addresses used maliciously or for scams, you can report these to the Domain Name Commission. 

We can carry out data validation and identify verification audits. We may not always be able to take any action, as we don't assess how .nz domain names are being used, but if the registration information is incorrect, we may suspend or cancel the .nz domain name.