Southeast Asia has quietly become the world’s largest manufacturing hub for financial fraud, and it’s no longer a distant problem for Australians. The scam economy operating out of Cambodia, Myanmar, Laos and the Philippines is already reaching into Australian bank accounts and phones.
In less than a decade, the industry has gone from misspelled emails and clumsy romance scams to vast, intricate business operations powered by AI-driven tools and manipulation tactics. There are now millions of victims and billions of dollars siphoned to cross-border criminal groups from all corners of the globe.
It’s costing Australians billions. Conservative estimates for 2022 sit around A$3 billion, but the actual figure may be even higher, as Australian data is based only on incidents reported to the Australian Federal Police.
Sophisticated Southeast Asian crime groups are involved in everything from malware for hire to ‘pig butchering’ scams (which build victims’ trust over time before taking their money). They have secured vast tracts of land to build cities and special economic zones dedicated entirely to criminal operations. Their operations, using workers brought from around the world, also include money laundering and human trafficking.
Perhaps the most prolific and well known is what Cambodians refer to as the Chinatown compound in Sihanoukville, Cambodia. The compound has been widely reported by the United Nations and other organisations as a scam centre that is connected to high-ranking Cambodian politicians and uses forced labour to run extensive malicious text, voice and email campaigns.
More details have been uncovered in research conducted by my company – networking and cybersecurity company Infoblox – working with Vietnamese non-profit Chong Lua Dao. Our researchers identified several compounds within the complex as the source of wide-scale banking fraud driven by remote-access malware distributed by scammers on a global scale.
For example, Infoblox researchers traced an Android banking trojan directly to a particular compound in Sihanoukville, Cambodia. The research was confirmed by testimonies provided to Chong Lua Dao of escaped forced workers who were beaten and electrocuted for missing performance targets.
These workers, usually from neighbouring countries, are often looking for legitimate job opportunities. Many go through what appear to be legitimate recruitment processes before being offered jobs. However, upon arrival in Cambodia, they are ushered to scam compounds – some even have their passports taken off them – and forced to scam people in countries such as Australia. Amnesty International this year called the situation a growing humanitarian crisis.
Crime groups use malware operations to facilitate real-time surveillance, credential theft, data exfiltration (including biometrics), and financial fraud. Many of these are crafted to impersonate government websites.
While current research doesn’t put Australia on the list of most targeted countries, that doesn’t mean Australians aren’t already being targeted. They should prepare for this to ramp up over the next 12 months.
In January this year, the Australian Federal Police reported an increase in scammers attempting to impersonate its officers to trick victims into transferring cryptocurrency.
These scammers act fast: through phone calls, text messages, or even video calls in which some scammers staged a fake police station. And with the help of AI tools, these communications are becoming more realistic. The human signals we have relied on to discriminate between what’s true and what’s a scam – facial expressions, the voice in a voice mails, fingerprints or documents such as passports – are becoming harder to trust. AI can now imitate them with increasing realism.
Australia can’t afford to treat this as someone else’s problem. It’s not just that the financial losses are already measured in billions; the infrastructure behind the scams is hardening, and the criminal groups running them are investing in better tools. This signals a mounting crisis.
Facing the problem will demand a coordinated response: mandatory real-time fraud detection requirements for Australian industries, the strengthening of cybersecurity infrastructure and a public awareness campaign that reflects the sophistication of our opponents.
