The Cambodian scammer's manual: How to launder money and get away with it

Phnom Penh, Cambodia: Every few weeks, fireworks light up the night sky in Cambodia, set off by scammers to salute their biggest swindles.

By the time the shells pop and crackle, somebody's life savings are probably gone. Maybe the victim fell for an online romance scam or bought into a fake cryptocurrency exchange. Whatever the scheme, the money has vanished, sucked into a complex money laundering network that moves billions of dollars at a dizzying speed.

The FBI, China's Ministry of Public Security, Interpol and others have tried to combat scammers, who ​often lurk on social media and dating apps, luring people into bogus financial schemes or other ruses. Telecom companies have blocked numbers. Banks have issued repeated warnings.

Yet the industry persists because its money laundering operation is so efficient. Unsuspecting victims worldwide lose tens of billions of dollars each year, money that must be scrubbed of its criminal origins and deposited into the legitimate economy. The money laundering system is so hydra-headed that when governments strike it in one place, it pops up in another.

This underworld peeks out in the Cambodian capital, Phnom Penh, home to a global clearinghouse for money launderers. It can be glimpsed, too, in the coastal city of Sihanoukville, a notorious refuge for fraudsters. Scammers ply their trade from call centers, operating in fortified compounds or on the upper floors of unfinished high-rises. Seaside restaurants are packed with money launderers and other criminals doing business over spicy Chinese food.

We obtained a cache of documents, a kind of money laundering handbook, and spoke to nearly a half-dozen scammers and their launderers. The documents are not linked to any one scam or victim but reveal a method for moving illicit money that has proved all but impossible to stop.

The money launderers are as vital to criminals as getaway drivers are to bank robbers. Without them, there would be no loot.

Once scammers persuade strangers to part with their savings, they need to quickly move money from one account to another, and one country to another, before ​their targets discover the ruse and alert their banks​ or police.

In the end, the money arrives "clean" -- with virtually no trace to the original scam.

So how does it get done?

Following the trail led us, surprisingly, to an established financial conglomerate in Cambodia called Huione Group.

This is not a back-alley shop with a side hustle in cleaning dirty money. Huione is an established firm that does brisk and legitimate business in Southeast Asia and has satellite companies in other parts of the world. Its QR codes are everywhere in Cambodia -- customers use them to pay their bills in hotels, restaurants and supermarkets. Huione ads are plastered along major highways. Its suite of financial services includes banking and insurance.

But Huione is a constellation of affiliates, and not all of them are legitimate. One arm offers bespoke money laundering services, according to the documents, which come from the company, and interviews with two people directly familiar with the operation. They spoke on the condition of anonymity out of fear for their safety. The company did not respond to requests for comment.

Another affiliate openly runs an online bazaar for criminals to find money launderers. The precise size of this marketplace is practically impossible to measure, but analytics firm Elliptic has linked it to $26.8 billion in cryptocurrency transactions since 2021. The industry is so opaque that it is difficult to separate legitimate transactions from illegal ones, but Elliptic says the bazaar is the world's largest illicit internet market.

Hun To, a cousin of Cambodia's prime minister, is a director of one Huione company.

Huione's clients include large criminal enterprises, such as a group in Myanmar that exploits human trafficking victims, according to a scammer, a money launderer and examinations of their cryptocurrency trade by analytics firms Elliptic and Chainalysis.

And yet, this money laundering network operates with impunity. The group has never been targeted for sanctions by any government. Cryptocurrency company Tether has frozen some of the group's accounts, at the behest of unspecified law enforcement officials, and messaging app Telegram has shut down some of its channels. But neither measure made a lasting effect.

This is how it works.

Moving Bricks

Huione makes money at every step of the process.

First, one affiliate, which until recently was called Huione Guarantee, hosts the marketplace where scammers can find matchmakers. The matchmakers are essential to the system and their work is so repetitive that the Chinese name for it is "moving bricks," according to Yanyu Chen, an anthropologist who studies money laundering schemes in Cambodia.

The online bazaar is made up of thousands of chat groups on Telegram.

On these Telegram channels, anonymous users advertise money laundering services with the wink and nod of barely disguised language. The posts are public; anyone with the Telegram app can see them. Some merchants also sell stolen personal data, applications for impersonating others and other essential services to scammers.

One channel, called "Demand and Supply," had more than 400,000 users with hundreds of daily messages, including advertisements for money laundering services. After we sent questions to Huione Group and others in late February, Telegram said it had removed the channel. But another quickly sprung up, with some 250,000 members joining within a week.

Huione Guarantee did not respond to repeated requests for comment but has denied its relationship with Huione Group, the financial conglomerate. It even changed its name in October, shedding the Huione name. But it told customers on Telegram that Huione Group remained one of its "strategic partners and shareholders."

Second, the bazaar guarantees the laundering transactions. Why? Because there is little honor among thieves, and scammers get scammed, too. To prove their credibility, matchmakers and money mules pay a deposit to Huione Guarantee, which holds it in escrow. This assures scammers that nobody will abscond with their money (or if someone does, that person will lose some of their own money).

The price to launder money is determined by the crime committed to get it. Scams like impersonating government officials incur a higher cost because the victims are more likely to call police or alert their banks.

Location affects the price, too. Launderers charge up to 60% to clean money in China. That is because the country has tightened controls since 2020, arresting thousands of people and freezing large sums of money in a nationwide crackdown.

China and Cambodia have agreed to collaborate on law enforcement operations, leading to multiple arrests of mostly lower-level criminals. This has not made a dent in the scamming and money laundering industries.

While the matchmaker deals are worked out privately, one-on-one, the bazaar makes money, too. It sells ads on public groups, charges maintenance fees for private groups and takes small cuts from deals. Most of the transactions are denominated in the cryptocurrency tether, but some are conducted in cash, gold and through bank transfers. (The bazaar even issued its own cryptocurrency last year.)

The bazaar denies any criminal association in disclaimers posted on its website and on Telegram channels. "All business in the public groups is provided by third-party merchants, which has nothing to do with Huione Guarantee," one post says.

Third, another Huione affiliate, Huione International Pay, is more directly involved in laundering money. It is a matchmaker itself, according to internal company documents and two people familiar with its operations.

The documents and insiders indicate that Huione International Pay operates with the efficiency of a legitimate, professional bank. It is based inside the conglomerate's headquarters in Phnom Penh, a glass and concrete building with two panda statues standing guard by the entrance.

One company department handles customer relations for scammers and other illicit actors. Another monitors Telegram channels. A third department tracks money mule accounts in at least a dozen countries, according to internal documents we reviewed.

Huione's companies operate with a veneer of legitimacy in a country with "very limited regulatory enforcement, if any at all," said John Wojcik, a threat analyst with the United Nations Office on Drugs and Crime. The conglomerate's obscure ownership structure creates challenges for targeted law enforcement, he said.

But even if Huione were shut down, other operators would quickly replace it, according to Wojcik.

"We can already see competitors now positioning themselves," he said.

The National Bank of Cambodia, which regulates financial institutions, said the government was committed to ensuring that "financial transactions are safe and transparent." It said the government was working to comply with international anti-money-laundering recommendations.

The national bank said that it had not renewed a license for Huione's payment service (the one with the QR codes) to operate in Cambodia because it "did not meet the renewal requirements." Huione quickly announced plans to register its business in Japan and Canada.

Hunting Mules

Money mules are the people who run the bank accounts and wallets.

Some mules open these bank accounts using fake identities, which artificial intelligence has made easier to create, according to Elad Fouks, who monitors fraud for Chainalysis.

Mules spread out the deposits and withdrawals to make them less noticeable to banks. Transactions below $10,000, for example, are less likely to draw attention. Most accounts and virtual wallets that are used for money laundering are active only for a few weeks or months.

Still, the mules -- and not matchmakers or scammers -- run the highest risk of getting caught.

In one US court case that outlines the mechanics of such operations, the lead defendant, Daren Li, ran a money mule syndicate that registered 74 US shell companies to launder nearly $80 million. The companies set up accounts at Bank of America and elsewhere.

When victims sent money to the accounts, the funds quickly moved to a bank in the Bahamas. From there, the money was used to purchase tether cryptocurrency held on the exchange Binance.

Within days, the money moved to another virtual wallet.

Li worked with Huione International Pay to launder money, according to records we reviewed. But both the FBI and the Secret Service declined to confirm the link. Li pleaded guilty in November to conspiracy to commit money laundering.

Payday

Imagine, once again, that you are a scam boss. Something has gone wrong: Your mule has been arrested; the bank froze his account; or maybe he ran off with your money.

In these cases, your matchmaker arbitrates disputes.

If the mule is at fault, the matchmaker will help retrieve the deposit from escrow and get it to you. If nobody is to blame, the losses are chalked up to the cost of doing business.

But, if all goes well, you will have your payday, usually in tether, which you can convert to US dollars at a casino or using Huione's payment company.

You can use that money to pay your employees.

These days, scamming operations mimic professional institutions, employing thousands of people in marketing, sales and human resources departments. Often, many employees are victims of human trafficking who are coerced into scamming faraway targets. Some scammers even model their organizations on 19th century company towns, paying wages only after employees complete a season of work. Until then, workers receive company credit.

The wages enrich the restaurants, casinos and brothels that make a killing from captive employees who are often confined to fortified compounds.

Also on the scammer payroll are attractive models who are paid to join video calls and persuade victims to part with their cash. Some of them swap their faces using AI.

Scammers, like everyone else, have to pay their landlords -- for housing and, in their case, for protection.

And then there are the behind-the-scenes services, many of which can be bought through Huione's bazaar. Scammers pay software developers to build websites that imitate investment platforms. They need internet and computer infrastructure. And they pay thieves to steal personal data on potential victims: national identification numbers, credit card information, location data and even details about previous hotel stays.

Some of the money will go to dealerships that sell luxury cars. Some is used to buy property in places like London and Dubai, United Arab Emirates.

And of course, some of it will go to fireworks.

How It Works

Imagine you're a scammer, cheating people out of their life savings. You need a way to get money out of countries around the world. You need a matchmaker.

A matchmaker is a trusted intermediary who will shepherd your loot home. A good matchmaker has a worldwide network of mules who can move money within hours.

The money mule can be a person or a shell company that controls a local bank account or a cryptocurrency wallet.

To start the working relationship, the matchmaker will pay a deposit to a third party to guarantee that they won't run away with your money.

Now, let us say that you have found someone willing to invest $40,000 in your scam.

Step 1: You, the scam boss, cut a deal with a matchmaker. For a U.S. scam, the matchmaker typically demands 15% of the proceeds for himself and his mules.

Step 2: Your matchmaker finds the right mules for the job and gets you a deal.

Step 3: The matchmaker sends you the mule's bank account or crypto wallet details. You send that information to your victim.

Step 4: Your victim sends $40,000 to your money mule's account.

Step 5: The mule moves the money from one account to another account and eventually converts it to cryptocurrency.

Step 6: Finally, the mule takes a cut for his services and sends the rest to the matchmaker. The matchmaker pays himself and gives you $34,000.