Original Title: The Scammer's Manual: How to Launder Money and Get Away With It

Original Authors: Selam Gebrekidan, Joy Dong, The New York Times

Original Translation: Deep Tide TechFlow

Every few weeks, the night sky in Cambodia is illuminated by fireworks. Scammers set off these fireworks to celebrate their latest "big score" scam.

As the fireworks burst in the sky, someone's life savings may have already vanished. The victim may have fallen for a fake online romance scam or invested in a bogus cryptocurrency exchange. Regardless of the form of the scam, the money has disappeared without a trace, swept into a complex money laundering network that circulates billions of dollars at a dazzling speed.

The FBI, China's Ministry of Public Security, Interpol, and other agencies have tried to crack down on these scammers. They often operate on social media and dating apps, luring people into phony financial schemes or other scams. Telecom companies block phone numbers, and banks issue warnings repeatedly.

However, this industry persists stubbornly, with highly efficient money laundering operations behind it. Unwitting victims worldwide lose hundreds of billions of dollars each year, and this money must be "cleaned" to disguise its criminal origins and ultimately enter the legitimate economy. This money laundering system is like a hydra: when one head is cut off by the government in one place, it reappears elsewhere.

This underworld thrives in the Cambodian capital, Phnom Penh, a hub for global money launderers. In the coastal city of Sihanoukville, this scene is even more pronounced, as it serves as a haven for notorious fraudsters. Scammers operate scam businesses in call centers, which are often located in heavily guarded buildings or upper floors of unfinished high-rises. Meanwhile, in seaside restaurants, money launderers and other criminals enjoy spicy Chinese food while conducting transactions.

In March of this year, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, UK and US authorities linked this casino to online scams and human trafficking.

We obtained a set of documents that can be seen as a "money laundering manual." At the same time, we interviewed nearly six scammers and their money laundering associates. These documents did not point to a specific scam or victim, but revealed an almost unstoppable method of illicit fund transfers.

From The New York Times

For criminals, the role of a money launderer is like the getaway driver in a bank robbery. Without them, the proceeds of crime cannot be realized.

Once a scammer successfully convinces a victim to hand over their savings, they need to swiftly move the funds from one account to another, from one country to another, in order to complete the operation before the victim realizes the fraud and reports it to the bank or authorities.

Eventually, this money becomes "clean"—almost untraceable to the original scam.

So, how is all of this accomplished?

Following this trail, we unexpectedly discover a link to a financial giant in Cambodia known as the "Huione Group."

This is not a clandestine workshop hidden in alleys, quietly "laundering money." The Huione Group is a well-known business operating legitimate ventures in Southeast Asia with branch offices in other parts of the world. Its QR code payment system is widespread in Cambodia, allowing consumers to pay their bills at hotels, restaurants, and supermarkets with it. Huione's advertisements line major highways, and its financial services span banking and insurance.

However, the Huione Group (Huione, pronounced "Hu-WAY-wahn") is made up of multiple affiliated companies, not all of which are legitimate. According to documents and two anonymous individuals with direct knowledge of its operations, part of the group's business offers customized money laundering services. These two sources spoke on the condition of anonymity due to concerns for their safety. The company did not respond to requests for comment on these allegations.

Another affiliate openly operates an online black market that acts as a go-between for criminals and money launderers. While the exact scale of this market is almost immeasurable, analytics firm Elliptic has linked it to $26.8 billion worth of cryptocurrency transactions since 2021. Due to the extreme opacity of the industry where legal and illegal transactions are hard to distinguish, Elliptic notes that this black market is one of the world's largest illicit online marketplaces.

It is worth noting that a cousin of Cambodia's Prime Minister, Hun To, is a director of a subsidiary of the Huione Group.

Research on Huione Group's cryptocurrency transactions conducted by a scammer, a money launderer, and analytics firms Elliptic and Chainalysis indicates that the group's clientele includes major criminal organizations, such as a syndicate in Myanmar that profits from exploiting victims of human trafficking.

The Huione Group is composed of multiple affiliated companies, with one subsidiary, Huione Pay, headquartered in Phnom Penh, Cambodia.

However, this money laundering network has been able to operate freely. To date, the organization has never been the target of any government sanctions. Although the cryptocurrency company Tether once froze some of the group's accounts at the request of an unspecified law enforcement agency and the messaging app Telegram also shut down some of its channels, these actions have not had a lasting impact.

Here is a detailed explanation of how it operates:

Imagine you are a scammer who has swindled people out of their life savings. You need a way to transfer these funds out globally, and this is where you need a "middleman."

The middleman is a trusted intermediary who can help you safely move the illicit funds to their destination. A good middleman has a global network, whose members are called "money mules," capable of completing fund transfers within hours.

A money mule can be an individual or a shell company that controls a local bank account or a cryptocurrency wallet.

Once you find a middleman, they will deposit the funds into an escrow account to ensure they do not abscond with the money during the transfer.

Now, you are ready to start your scam.

Let's say you successfully trick someone into transferring $40,000 to you.

Step 1: As the scam ringleader, you reach an agreement with the middleman. In the case of a U.S. scam, the middleman will usually demand a 15% cut of the proceeds as their and the money mule's reward.

Step 2: The middleman finds a suitable money mule and arranges the transaction for you.

Step 3: The middleman sends you the money mule's bank account or cryptocurrency wallet information, which you then provide to the victim.

Step 4: The victim transfers $40,000 to the money mule's account.

Step 5: The money mule moves the funds from one account to another, eventually converting it to cryptocurrency.

Step 6: Finally, the money mule takes a cut as a service fee and passes the remaining amount to the middleman. The middleman deducts their fee and then transfers the remaining $34,000 to you.

Through this process, the entire money laundering chain is completed, making the funds nearly untraceable, allowing the scam to proceed smoothly.

Arbitrage Business

The Huione Group profits at every step of the process.

Firstly, one of its subsidiaries (still known as "Huione Guarantee" until recently) operates a marketplace platform where scammers can find middlemen. These middlemen are crucial to the system and their work is so mechanically repetitive that, according to anthropologist Yanyu Chen, who studied money laundering behavior in Cambodia, the Chinese refer to this behavior as "arbitrage."

This online marketplace consists of thousands of Telegram chat groups.

Some branches of Huione Pay also advertise currency exchange services, including conversion between Tether and USD.

In these Telegram channels, anonymous users openly post money laundering service ads in almost blatant language. These posts are public, visible to anyone with the Telegram app. Some vendors also sell stolen personal data, applications for impersonating others, and other services crucial to scammers.

One channel named "Demand and Supply" has over 400,000 users, with hundreds of messages each day, including ads for money laundering services. After we sent questions to the Huione Group and other relevant parties at the end of February, Telegram said it had removed the channel. However, a similar channel quickly emerged, attracting around 250,000 members within a week.

Huione Guarantee did not respond to multiple requests for comments but denied any connection to the financial group Huione Group. The company even rebranded last October, removing the "Huione" name. However, it informed customers on Telegram that Huione Group remains one of its "strategic partners and shareholders."

Secondly, this marketplace platform guarantees money laundering transactions. Why? Because the saying "there's no honor among thieves" does not apply here, as scammers may also deceive each other. To prove their credibility, middlemen and money mules need to pay a deposit to Huione Guarantee, which is held in escrow. This assures scammers that no one will abscond with the funds (or if they do, they will lose their deposit).

The price of money laundering is determined by the type of criminal activity through which the funds were obtained. For example, scams involving impersonation of government officials have a higher cost because victims are more likely to report to the authorities or banks.

Geographical location also affects the price of money laundering. In China, the cost of money laundering can be as high as 60% of the illicit funds. This is due to China's increased financial control measures since 2020, national anti-money laundering campaigns, the arrest of thousands of individuals, and the freezing of significant funds.

China and Cambodia have entered into a cooperation agreement to conduct joint law enforcement operations, resulting in the arrests of several criminals, albeit mostly low-level offenders. These actions have not had a substantial impact on the fraud and money laundering industry.

While the transactions of intermediaries occur privately, the group itself also profits. It earns money by selling advertisements in public groups, charging maintenance fees to private groups, and taking small commissions from transactions. Most transactions are denominated in Tether cryptocurrency, but some are also conducted in cash, gold, or bank transfers. (Even last year, this market issued its own cryptocurrency.)

The market, in its disclaimers posted on its website and Telegram channel, denies any involvement in criminal activities. One post states: "All transactions in public groups are provided by third-party merchants and are not related to Huione Guarantee."

Thirdly, another subsidiary of the Huione Group, "Huione International Pay," is more directly involved in money laundering activities. According to internal company documents and statements from two individuals familiar with its operations, Huione International Pay is itself an intermediary.

These documents and insiders reveal that the operational efficiency of Huione International Pay rivals that of a legitimate professional bank. Headquartered in a glass-and-concrete building in Phnom Penh, the building's entrance is flanked by two panda statues.

According to two individuals familiar with its operations, Huione International Pay conducts its business within the group's headquarters in Phnom Penh.

One department within the company is dedicated to providing customer relationship services to fraudsters and other illicit actors; another department monitors Telegram channels; and yet another department tracks money mule accounts spread across at least a dozen countries, as per internal documents we reviewed.

The company's operations under Huione operate in countries with "extremely lenient or virtually non-existent regulation," wearing a "cloak of legitimacy." John Wojcik, a threat analyst at the United Nations Office on Drugs and Crime (UNODC), stated that the complex and opaque ownership structure of the Huione Group poses challenges for targeted law enforcement actions.

However, he also pointed out that even if Waiwai was shut down, other operators would quickly take its place.

"We have already seen competitors actively expanding," Wojciech said.

The National Bank of Cambodia, the department responsible for regulating financial institutions, stated that the government is committed to ensuring the "security and transparency of financial transactions." At the same time, the government is striving to comply with international anti-money laundering recommendations.

The central bank also stated that due to Waiwai's payment service (a QR code-based payment system) failing to meet renewal requirements, its related license in Cambodia was not renewed. In response, Waiwai promptly announced plans to register its business in Japan and Canada.

Tracking Money Mules

Money mules are individuals responsible for operating bank accounts and digital wallets.

According to Elad Fouks, an expert from Chainalysis, the company responsible for monitoring on-chain fraud, some money mules open bank accounts using fake identities, with advances in artificial intelligence making identity forgery easier.

Money mules will spread deposits and withdrawals to reduce the risk of attracting bank scrutiny. For example, transactions below $10,000 are usually less likely to raise alarms. Accounts and virtual wallets used for money laundering are often active for only a few weeks or months.

However, the real highest risk is not the middlemen or scammers, but these money mules. They are the most likely to get caught.

A case in a U.S. court revealed the specific mechanism of this operation. The main defendant in the case, Darren Li, ran a money mule network and registered 74 U.S. shell companies to launder nearly $80 million. These companies opened accounts at U.S. institutions like Bank of America. When victims wired funds to these accounts, the money was quickly moved to a bank in the Bahamas. Subsequently, these funds were used to purchase Tether cryptocurrency held on the Binance exchange.

Within days, these funds would be transferred to another virtual wallet.

Based on our review of the records, Darren Li was known to have engaged in money laundering activities with Waiwai International Payment. However, the FBI and Secret Service have both declined to confirm this association. Darren Li pleaded guilty to conspiracy to commit money laundering back in November last year.

Payday

Imagine again that you are the boss of a fraud syndicate. Something went wrong: your money mule got arrested; his bank account got frozen; or he may have absconded with the funds.

In these scenarios, your intermediary would step in to resolve the dispute.

If it was the money mule's fault, the intermediary would help you retrieve the deposit from the escrow account and return it to you. If no one is to blame, these losses would be considered a part of the operating costs.

But if all goes smoothly, you will experience a "payday," usually paid out in Tether. You can then convert these Tethers to USD through a casino or Hawala payment company.

The British authorities stated that a building near the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, once housed a large-scale fraud operation.

You can use this money to pay your employees' salaries.

Today, fraud operations mimic the operational model of a professional organization, complete with marketing, sales, and human resources departments, employing thousands of people. Often, many of the employees are actually victims of human trafficking, forced to execute scams on distant targets. Some fraud organizations even mimic a 19th-century company town model, only paying wages to employees after completing a work season. Until then, employees can only spend on the company's line of credit.

These salaries, in turn, sustain restaurants, casinos, and brothels within the closed-off areas where the fraudsters operate, profiting greatly from the restricted freedoms of the employees.

Additionally, the fraudsters' payroll includes some attractive models who are hired to engage in video calls, enticing victims to part with their money. Some of these models even use AI deepfake technology.

Like everyone else, fraudsters also need to pay rent—not just for living but also for "protection."

Furthermore, behind-the-scenes services of fraud require payment, and many services can be obtained through Hawala's "marketplace." Fraudsters pay software developers to create websites mimicking investment platforms. They need internet and computing infrastructure. They also pay thieves' fees to steal potential victims' personal data: including national ID numbers, credit card information, location data, and even detailed records of prior hotel stays.

Some of the funds flow to luxury car dealerships, and some are used to purchase real estate in locations like London and Dubai.

Of course, some of the funds will also be used to purchase fireworks.

Original Article Link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia