Editor | TechFlow
Selam Gebrekidan is an investigative reporter for The New York Times based in Hong Kong.
Chang W. Lee is a staff photographer for The New York Times for 30 years, covering events around the world and is currently based in Seoul.
Every few weeks, the night sky over Cambodia lights up with fireworks, set off by scammers to celebrate their latest “big-ticket” scam.
By the time the fireworks burst into the sky, someone’s life savings may have vanished. The victim may have fallen for a fake online romance scam or invested in a bogus cryptocurrency exchange. Whatever the scam, the money has disappeared, entangled in a complex money-laundering network that moves billions of dollars at a dizzying pace.
The FBI, China's Ministry of Public Security, Interpol and other agencies have tried to crack down on these scammers, who are often active on social media and dating apps, luring people into fake financial schemes or other scams. Telecommunications companies have blocked phone numbers and banks have issued warnings.
Yet, the industry persists, and the money laundering operations behind it are highly efficient. Unsuspecting victims around the world lose tens of billions of dollars each year, which must be “laundered” to conceal their criminal origins and eventually flow into the legal economy. This money laundering system is like a hydra: when governments crack down on it in one place, it pops up in another.
This underworld looms in Phnom Penh, Cambodia's capital, one of the global hubs for money launderers. It's even more evident in the coastal city of Sihanoukville, a notorious haven for fraudsters. Fraudsters run their operations in call centers, often housed in heavily guarded buildings or on the upper floors of unfinished high-rises. In seaside restaurants, money launderers and other criminals conduct transactions over spicy Chinese food.
In March this year, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, authorities in the UK and the US have linked the casino to online fraud and human trafficking.
We obtained a collection of documents that can be considered a "money laundering manual" and interviewed nearly a half-dozen scammers and their money laundering accomplices. The documents do not point to a specific scam or victim, but reveal a nearly unstoppable method of moving illicit funds.
From The New York Times
Money launderers are as important to criminals as getaway drivers in bank robberies: without them, the proceeds of crime would go unrealized.
Once the scammers have managed to get a victim to hand over their savings, they need to quickly move the funds from one account to another and from one country to another, before the victim realizes the scam and alerts the bank or police.
Eventually, the money becomes “clean” — making it almost impossible to trace back to the original scam.
So, how is this all done?
Following this clue, we unexpectedly discovered that this was related to a Cambodian financial giant called Huione Group.
This is not a small workshop hiding in the back alleys, secretly "laundering dirty money". Huiwang Group is a well-known company that conducts legal business in Southeast Asia and has branches in other parts of the world. Its QR code payment system is spread throughout Cambodia, and consumers can use it to pay bills in hotels, restaurants and supermarkets. Huiwang's advertisements are all over major highways, and its financial services cover banking and insurance.
However, Huione (pronounced “Hu-WAY-wahn”) is made up of multiple affiliated companies, not all of which are legitimate. Part of the group’s business provides customized money-laundering services, according to documents and two anonymous people with direct knowledge of its operations who requested anonymity because they fear for their safety. The company did not respond to any requests for comment on the allegations.
Another affiliate openly operates an online black market that connects criminals and money launderers. While the exact size of the market is almost impossible to measure, analytics firm Elliptic has linked it to $26.8 billion worth of cryptocurrency transactions since 2021. Due to the extreme opacity of the industry, legitimate transactions are difficult to distinguish from illegal ones, but Elliptic points out that the black market is one of the largest illegal Internet markets in the world.
It is worth noting that Hun To, a cousin of the Cambodian Prime Minister, is a director of a subsidiary of Huiwang Group.
Huiwang Group’s clients included large criminal organizations, such as a gang in Myanmar that profited from exploiting victims of human trafficking, according to a study of its cryptocurrency transactions by a scammer, a money launderer and analytics firms Elliptic and Chainalysis.
Huione Group is made up of several affiliated companies, one of which, Huione Pay, is headquartered in Phnom Penh, Cambodia.
Yet the money laundering network has been able to operate with impunity. To date, the group has never been the target of any government sanctions. While cryptocurrency company Tether has frozen some of the group’s accounts at the request of unspecified law enforcement agencies, and messaging app Telegram has shut down some of its channels, these measures have failed to have a lasting impact.
Here is a detailed description of how it works:
Imagine you are a scammer who has swindled people out of their life savings. You need a way to move these funds across the world, and you need a “middleman”.
A middleman is a trusted intermediary who can help you transfer the stolen money safely to its destination. A good middleman has a global network of people called "money mules" who can complete the transfer of funds within hours.
A money mule can be a person or a shell company that controls a local bank account or cryptocurrency wallet.
When you find a middleman, he will deposit the funds into an escrow account, thus ensuring that he cannot abscond with the money while it is being transferred.
Now you are ready to start your scam.
Let's say you successfully trick someone into transferring $40,000 to you.
Step 1: As the scam leader, you reach an agreement with the middleman. Taking the US scam as an example, the middleman usually asks for 15% of the proceeds as compensation for himself and the fund mule.
Step 2: The middleman finds the right money mule and arranges the transaction for you.
Step 3: The middleman sends you the mule’s bank account or cryptocurrency wallet information, which you then provide to the victim.
Step 4: The victim transfers $40,000 to the fund mule’s account.
Step 5: The money mule transfers the funds from one account to another, eventually converting them into cryptocurrency.
Step 6: Finally, the money mule takes a portion of the money as a service fee and passes the rest to the middleman, who deducts his own reward and gives you the remaining $34,000.
In this way, the entire money laundering chain is completed, the funds become almost untraceable, and the scam can proceed smoothly.
"Brick Moving" Business
Huiwang Group can make a profit at every step of the process.
First, a subsidiary, until recently known as Huione Guarantee, operated a marketplace where scammers could find middlemen, who are so crucial to the system and whose work is so repetitive that the Chinese call it “moving bricks,” according to Yanyu Chen, an anthropologist who studies money laundering in Cambodia.
The online marketplace consists of thousands of Telegram chat groups.
Some Huione Pay affiliates also advertise currency exchange services, including conversions between Tether and the U.S. dollar.
In these Telegram channels, anonymous users post advertisements for money laundering services in barely veiled language. The posts are public and can be seen by anyone with the Telegram app. Some businesses also sell stolen personal data, apps for impersonating others, and other services that are crucial to scammers.
One channel, called “Demand and Supply,” had more than 400,000 users and hundreds of messages a day, including ads for money laundering services. After we sent questions to Huiwang Group and other parties involved in the matter in late February, Telegram said it had deleted the channel. However, another similar channel soon emerged, attracting about 250,000 members within a week.
Huiwang Guarantee did not respond to multiple requests for comment, but it denies any relationship with financial group Huiwang Group. The company even changed its name in October last year, removing the word "Huiwang". However, it told customers on Telegram that Huiwang Group is still one of its "strategic partners and shareholders."
Second, the marketplace guarantees money laundering transactions. Why? Because the saying that thieves have their own code of conduct does not apply here, and scammers will deceive each other. To prove their credibility, middlemen and money mules need to pay a deposit to Huiwang Guarantee, which will be held in escrow. This can assure scammers that no one will abscond with the money (or if someone does, that person will lose their deposit).
The price of money laundering is determined by the type of crime used to obtain the funds. For example, scams impersonating government officials are more costly because victims are more likely to call the police or notify their bank.
Geography also affects the price of money laundering. In China, the cost of money laundering can be up to 60% of the stolen money. This is because since 2020, China has strengthened its financial controls and launched a nationwide crackdown, arresting thousands of people and freezing a large amount of funds.
China and Cambodia have reached a cooperation agreement to jointly carry out law enforcement operations, which have led to the arrest of several criminals, but most of the arrests are low-level criminals. These measures have not had a substantial impact on the fraud and money laundering industry.
While the middleman’s transactions are private, the group itself is making money. It earns by selling ads in public groups, charging maintenance fees for private groups, and taking a small commission from transactions. Most transactions are denominated in the Tether cryptocurrency, but some are done in cash, gold, or bank transfers. (The market even issued its own cryptocurrency last year.)
The marketplace denies any connection to criminal activity in disclaimers posted on its website and Telegram channel. “All business in the public group is provided by third-party merchants and has nothing to do with Huione Guarantee,” one post said.
Third, another subsidiary of Huione Group, Huione International Pay, was more directly involved in money laundering. According to internal company documents and two people familiar with its operations, Huione International Pay itself acted as a middleman.
The documents and people familiar with the matter reveal that Huiwang International Payment operates with the efficiency of a legitimate professional bank. Its headquarters is located in a glass and concrete building in Phnom Penh, with two panda statues at the entrance.
According to two people familiar with its operations, Huiwang International Payment operates out of the group’s headquarters in Phnom Penh.
One division of the company is responsible for providing customer relations services to scammers and other illegal actors; another is responsible for monitoring Telegram channels; and another is responsible for tracking money mule accounts in at least a dozen countries, according to internal documents reviewed by the company.
Huiwang's companies operate under a "veneer of legitimacy" in "countries where regulation is extremely lax or almost non-existent." John Wojcik, a threat analyst at the United Nations Office on Drugs and Crime (UNODC), said Huiwang Group's complex and opaque ownership structure poses challenges for targeted law enforcement operations.
But he also pointed out that even if Huiwang was shut down, other operators would soon take its place.
"We're already seeing competitors moving aggressively," Wojcik said.
The National Bank of Cambodia — the agency responsible for regulating financial institutions — said the government is committed to ensuring “security and transparency in financial transactions” and is working to comply with international anti-money laundering recommendations.
The National Bank also said that Huiwang’s payment service (i.e. payment system with QR code) license in Cambodia was not renewed because it failed to meet the renewal requirements. In response, Huiwang quickly announced plans to register its business in Japan and Canada.
Tracking the money mules
Money mules are people who operate bank accounts and digital wallets.
According to Elad Fouks, an expert at Chainalysis, which monitors on-chain fraud, some money mules open bank accounts using false identities, and advances in artificial intelligence have made it easier to forge identities.
Money mules spread out deposits and withdrawals to reduce the risk of being noticed by banks. For example, transactions of less than $10,000 are usually not easily noticed. Most accounts and virtual wallets used for money laundering are only active for a few weeks or months.
However, the people who are at the highest risk are not the middlemen or the scammers, but the money mules. They are the ones most likely to be caught.
A US court case reveals the specific mechanism of this operation. The main defendant in the case, Daren Li, operated a money mule network. He registered 74 US shell companies to launder nearly $80 million. These companies opened accounts at institutions such as Bank of America. When victims transferred funds to these accounts, the funds were quickly transferred to a bank in the Bahamas. Subsequently, the funds were used to purchase Tether cryptocurrency held on the Binance exchange.
Within a few days, the funds are transferred to another virtual wallet.
According to records we reviewed, Darren Lee worked with Huiwang International Payment to launder money. However, both the FBI and the Secret Service refused to confirm the connection. Darren Lee pleaded guilty to conspiracy to launder money in November last year.
Payday
Imagine again that you are the head of a fraud ring. Something goes wrong: your money mule is arrested; the bank freezes his account; or he absconds with the money.
In these cases, your middleman will step in to mediate the dispute.
If it’s the money mule’s fault, the middleman will help you get your money back from the escrow account and return it to you. If no one is held liable, the losses are considered part of the cost of doing business.
But if all goes well, you will get a “payday,” usually paid in Tether, which you can exchange for dollars through the casino or Huiwang’s payment company.
British authorities say buildings near the Golden Sun Sky Casino & Hotel in Sihanoukville once housed a large-scale fraud operation.
You can use these funds to pay your employees’ salaries.
Today, fraud operations mimic the operations of professional organizations, with marketing, sales, and HR departments, employing thousands of people. Often, many of the employees are actually victims of human trafficking, forced to commit fraud against far-flung targets. Some fraud organizations even mimic the model of 19th-century company towns, paying employees only after they complete a season of work. Before then, employees can only spend money using company lines of credit.
Those wages, in turn, feed the restaurants, casinos and brothels in the closed-off areas where the scammers operate, which profit handsomely from the restricted workers.
The scammers also have attractive models on their payroll, hired to participate in video calls to trick victims into handing over money. Some of these models even use artificial intelligence face-changing technology.
Like everyone else, scammers need to pay rent — not only for shelter, but also for “protection.”
Beyond that, the services behind the scam also require payment, many of which can be purchased through Huiwang’s “marketplace.” Scammers pay software developers to create websites that mimic investment platforms. They need internet and computer infrastructure. They also pay thieves to steal potential victims’ personal data: national ID numbers, credit card information, location data, and even detailed records of previous hotel stays.
Some of the money will go to dealers selling luxury cars, and some will be used to buy real estate in places like London and Dubai.
Of course, some of the funds will be used to purchase fireworks.
