Original Article Title: The Scammer's Manual: How to Launder Money and Get Away With It

Original Article Authors: Selam Gebrekidan, Joy Dong, The New York Times

Original Article Translation: Deep Tide TechFlow

Every few weeks, the night sky in Cambodia is lit up by fireworks. Scammers set off these fireworks to celebrate their latest "big score" scam.

As the fireworks burst in the sky, someone's life savings may have already vanished into thin air. The victim may have fallen for a fake online romance scam or invested in a bogus cryptocurrency exchange. Regardless of the form of the scam, the money has disappeared without a trace, caught up in a complex money laundering network that circulates billions of dollars at a dizzying speed.

The FBI, Chinese Ministry of Public Security, Interpol, and other agencies have tried to combat these scammers. They are often active on social media and dating apps, deceiving people into participating in fake financial schemes or other scams. Telecommunication companies have blocked phone numbers, and banks have issued numerous warnings.

However, this industry still persists stubbornly, with a highly efficient money laundering operation behind it. Unprepared victims around the world lose hundreds of billions of dollars each year, and these funds must be "cleaned" to conceal their criminal origins and ultimately flow into the legitimate economy. This money laundering system is like a hydra; when the government strikes it in one place, it reappears in another.

This underground world is elusive in the Cambodian capital, Phnom Penh, which is one of the global hubs for money launderers. In the coastal city of Sihanoukville, this scene is even more pronounced, as it is a notorious haven for fraudsters. Scammers conduct scam operations in call centers, which are often located in heavily guarded buildings or on the upper floors of unfinished skyscrapers. Meanwhile, at seaside restaurants, money launderers and other criminals enjoy spicy Chinese food while engaging in transactions.

In March of this year, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, UK and US authorities have linked this casino to online scams and human trafficking.

We have obtained a batch of documents that can be considered a "money laundering manual." Additionally, we interviewed nearly six scammers and their money laundering accomplices. These documents do not point to a specific scam or victim but reveal an almost unstoppable method of illegal fund transfers.

From The New York Times

For criminals, the importance of money launderers is akin to the getaway driver in a bank heist. Without them, criminal proceeds would not be able to be cashed out.

Once a scammer successfully convinces a victim to hand over their savings, they need to swiftly move the funds from one account to another, from one country to another, in order to complete the operation before the victim realizes the scam and reports it to the bank or authorities.

Eventually, this money becomes "clean"—almost untraceable back to the original fraud.

So how is all of this done?

Following this trail, we unexpectedly find that it is connected to a financial giant in Cambodia called the "Huione Group."

This is not a workshop hidden in a back alley secretly "cleaning dirty money." The Huione Group is a well-known enterprise conducting legitimate business in Southeast Asia with branch offices in other parts of the world. Its QR code payment system is widespread in Cambodia, allowing consumers to pay their bills at hotels, restaurants, and supermarkets using it. Huione's advertisements line major highways, and its financial services span banking and insurance.

However, the Huione Group (Huione, pronounced "Hu-WAY-wahn") is composed of multiple affiliated companies, not all of which are legitimate. According to documents and two anonymous individuals with direct knowledge of their operations, part of the group's business provides customized money laundering services. These two informants requested anonymity out of concern for their safety. The company did not respond to any requests for comment regarding these allegations.

Another affiliated company openly operates an online black market that acts as a go-between for criminals and money launderers. While the exact scale of this market is nearly immeasurable, analytics company Elliptic has linked it to $26.8 billion in cryptocurrency transactions since 2021. Due to the extreme opacity of this industry, distinguishing between legal and illegal transactions is difficult, but Elliptic notes that this black market is one of the largest illicit internet markets globally.

It is worth noting that a cousin of the Cambodian Prime Minister, Hun To, is a director at a subsidiary of the Huione Group.

Research on the cryptocurrency transactions of Huione Group by a scammer, a money launderer, and analytics companies Elliptic and Chainalysis indicates that the group's clients include large criminal organizations, such as a syndicate in Myanmar that profits by exploiting human trafficking victims.

The Huione Group is composed of multiple affiliated companies, with one subsidiary, Huione Pay, headquartered in Phnom Penh, Cambodia.

However, this money laundering network has been able to operate with impunity. To date, the organization has never been the target of any government sanctions. Although the cryptocurrency company Tether has previously frozen some of the group's accounts at the request of an unspecified law enforcement agency, and the messaging app Telegram has also shut down some of its channels, these measures have not had a lasting impact.

Below is a detailed explanation of how it operates:

Imagine you are a fraudster who has scammed people out of their life savings. You need a way to transfer these funds out of various countries, which is where you need a "middleman."

The middleman is a trusted intermediary who can help you securely transfer the illicit funds to their destination. A top-notch middleman has a global network, with network members known as "money mules," who can complete fund transfers within hours.

A money mule can be an individual or a shell company that controls a local bank account or cryptocurrency wallet.

When you find a middleman, they will deposit the funds into an escrow account to ensure they do not abscond with the money during the transfer.

Now, you are ready to start your scam.

Assume you have successfully tricked someone into transferring $40,000 to you.

Step 1: As the scam ringleader, you agree with the middleman. In a U.S.-based scam, the middleman typically demands a 15% cut as their and the money mule's reward.

Step 2: The middleman finds a suitable money mule and arranges the transaction for you.

Step 3: The middleman sends you the money mule's bank account or cryptocurrency wallet information, which you then provide to the victim.

Step 4: The victim transfers $40,000 to the money mule's account.

Step 5: The money mule moves the funds between accounts, eventually converting them into cryptocurrency.

Step 6: Finally, the money mule takes a portion as a service fee and transfers the remaining amount to the middleman. The middleman, after deducting their own fee, then hands over the remaining $34,000 to you.

Through this process, the entire money laundering chain is completed, rendering the funds almost untraceable, allowing the scam to proceed smoothly.

“Brick-and-Mortar” Business

The Huione Group profits at every step of the process.

Firstly, one of its subsidiaries (until recently still known as Huione Guarantee) operates a marketplace where scammers can find middlemen. Middlemen are crucial in this system, their work is so mechanically repetitive that, according to anthropologist Yanyu Chen, who researched money laundering behavior in Cambodia, the Chinese refer to this behavior as “brick-and-mortar.”

This online marketplace consists of thousands of Telegram chat groups.

Some branches of Huione Pay also advertise currency exchange services, including conversions between Tether and USD.

In these Telegram channels, anonymous users openly post money laundering service ads in almost blatant language. These posts are public, visible to anyone with the Telegram app. Some vendors even sell stolen personal data, applications for impersonating others, and other crucial services for scammers.

One channel named “Demand and Supply” has over 400,000 users, with hundreds of messages daily, including ads for money laundering services. After we posed questions to the Huione Group and other relevant parties in late February, Telegram stated that it had removed that channel. However, a similar channel quickly emerged, attracting around 250,000 members within a week.

Huione Guarantee did not respond to multiple comment requests but denied any association with the financial group Huione Group. The company even rebranded last October, removing the “Huione” name. However, it informed customers on Telegram that Huione Group remains one of its “strategic partners and shareholders.”

Secondly, this marketplace platform provides escrow for money laundering transactions. Why? Because there is no honor among thieves here, and scammers will also deceive each other. To prove their credibility, middlemen and money mules need to pay a deposit to Huione Guarantee, which is held in escrow. This serves to reassure scammers that no one will run off with the funds (or if someone does, that person will lose their deposit).

The price of money laundering is determined by the type of crime from which the funds were obtained. For example, scams involving impersonation of government officials have a higher cost because victims are more likely to report to the authorities or notify the bank.

Geographical location also influences the price of money laundering. In China, the cost of money laundering can be as high as 60% of the illicit funds. This is because since 2020, China has intensified its financial control measures, conducted nationwide crackdowns, arrested thousands of individuals, and frozen significant amounts of funds.

China and Cambodia have entered into a cooperation agreement to jointly carry out law enforcement actions, resulting in the arrest of several criminals; however, those arrested are mostly low-level offenders. These measures have not had a substantial impact on the fraud and money laundering industry.

Although transactions by intermediaries are conducted in private, the group itself also profits. It earns money by selling advertisements in public groups, charging maintenance fees to private groups, and taking small commissions from transactions. Most transactions are denominated in Tether cryptocurrency, but some are also conducted in cash, gold, or bank transfers. (Even last year, this market issued its own cryptocurrency.)

In the disclaimer posted on its website and Telegram channel, the market denies any involvement in criminal activities. One post states: "All business in public groups is provided by third-party merchants and is not related to Huione Guarantee."

Thirdly, another subsidiary of the Huione Group, "Huione International Pay," is more directly involved in money laundering activities. According to internal company documents and two individuals familiar with its operations, Huione International Pay is itself an intermediary.

These documents and informants reveal that the operational efficiency of Huione International Pay is comparable to that of a legitimate professional bank. Its headquarters is located in a glass and concrete building in Phnom Penh, with two panda statues standing at the entrance.

According to two individuals familiar with its operations, Huione International Pay conducts its business within the group's headquarters in Phnom Penh.

One department within the company is specifically responsible for providing customer relationship services to scammers and other illegal actors, another department monitors Telegram channels, and yet another department tracks money mule accounts spread across at least a dozen countries, based on internal documents we have reviewed.

The companies under Huione operate in countries where regulation is extremely lax or virtually non-existent, wearing a "cloak of legitimacy." John Wojcik, a threat analyst at the United Nations Office on Drugs and Crime (UNODC), stated that the complex and opaque ownership structure of the Huione Group poses challenges for targeted law enforcement actions.

However, he also pointed out that even if [汇旺] were to be shut down, other operators would quickly take its place.

"We have seen competitors actively preparing," Voychak said.

The National Bank of Cambodia, the department responsible for regulating financial institutions, stated that the government is committed to ensuring the "security and transparency of financial transactions." At the same time, the government is striving to comply with relevant international anti-money laundering recommendations.

The central bank also stated that as [汇旺]'s payment service (a QR code-based payment system) failed to meet renewal requirements, its related license in Cambodia was not renewed. In response, [汇旺] promptly announced plans to register its operations in Japan and Canada.

Tracking Money Mules

Money mules are individuals responsible for operating bank accounts and digital wallets.

According to Elad Fouks, an expert from Chainalysis, which monitors on-chain fraud, some money mules open bank accounts using fake identities, with advances in artificial intelligence making identity fraud easier.

Money mules spread deposits and withdrawals to reduce the risk of attracting attention from banks. For example, transactions under $10,000 are usually not easily noticed. Accounts and virtual wallets used for money laundering are mostly active for only a few weeks or months.

However, the highest risk is not posed by intermediaries or fraudsters, but by these money mules. They are the most likely to be caught.

A U.S. court case revealed the specific mechanism of this operation. The main defendant in the case, Daren Li, ran a money mule network, registering 74 U.S. shell companies to launder nearly $80 million. These companies opened accounts at U.S. institutions such as Bank of America. When victims transferred funds to these accounts, the funds were quickly moved to a bank in the Bahamas. Subsequently, the funds were used to purchase Tether cryptocurrency held on the Binance exchange.

Within a few days, these funds were transferred to another virtual wallet.

Based on our review of records, Daren Li was involved in money laundering activities in collaboration with [汇旺] International Payment. However, the FBI and Secret Service both declined to confirm this association. Daren Li pleaded guilty to conspiracy to commit money laundering last November.

Payday

Once again, imagine that you are the leader of a fraud ring. Something has gone wrong: your money mule has been arrested; his bank account has been frozen; or he may have absconded with the funds.

In these cases, your middleman would intervene to mediate the dispute.

If it was the money mule's fault, the middleman would help you retrieve the deposit from the escrow account and return it to you. If no one is held accountable, these losses would be considered part of the cost of doing business.

But if everything goes smoothly, you will experience "payday," usually paid out in Tether. You can then convert these Tethers to USD through a casino or Hawala payment company.

UK authorities have stated that a building near the Golden Sun Sky Casino & Hotel in Sihanoukville once housed a large-scale fraud operation.

You can use these funds to pay your employees' salaries.

Today, fraud operations mimic the operational model of professional organizations, with departments for marketing, sales, and human resources, employing thousands of people. Often, many employees are actually victims of human trafficking who are forced to carry out fraud against distant targets. Some fraud organizations even mimic a 19th-century company town model, only paying wages to employees after the completion of a work season. Until then, employees can only spend on the company credit line.

These wages in turn fuel restaurants, casinos, and brothels in the enclosed areas where fraudsters operate, with these establishments profiting heavily from the restricted freedom of the employees.

Additionally, the fraudsters' payroll includes some attractive models who are hired to engage in video calls to deceive victims into giving money. Some of these models even use deepfake AI technology.

Like everyone else, fraudsters also need to pay rent—not just for living but for "protection" as well.

Furthermore, behind-the-scenes services of fraud require payments, and many services can be purchased through Hawala's "marketplace." Fraudsters pay software developers to create websites mimicking investment platforms. They need internet and computer infrastructure. They also pay thieves to steal potential victims' personal data: including national ID numbers, credit card information, location data, and even detailed records of prior hotel stays.

Some of the funds flow to luxury car dealerships, while some funds are used to purchase real estate in locations like London and Dubai.

Of course, some of the funds will also be used to purchase fireworks.

Original Article Link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia