S elam Gebrekidan is an investigative reporter for The New York Times based in Hong Kong. Chang W. Lee is a staff photographer for The New York Times for 30 years, covering events around the world and currently based in Seoul.
Every few weeks, the night sky over Cambodia lights up with fireworks, set off by scammers to celebrate their latest "big-ticket" scam.
By the time the fireworks burst into the sky, someone's life savings may have been wiped out. Victims may have fallen for a fake online romance scam or invested in a bogus cryptocurrency exchange. Whatever the scam, the money has disappeared without a trace, entangled in a complex money-laundering network that moves billions of dollars at a dizzying pace.
The FBI, China's Ministry of Public Security, Interpol and other agencies have tried to crack down on these scammers. They are often active on social media and dating apps, tricking people into participating in fake financial schemes or other scams. Telecommunications companies have blocked phone numbers and banks have issued repeated warnings.
However, this industry still persists and the money laundering operations behind it are extremely efficient. Tens of billions of dollars are lost each year to unsuspecting victims around the world, funds that must be “laundered” to conceal their criminal origins and ultimately flow into the legitimate economy. This money laundering system is like a hydra. When the government cracks down on it in one place, it pops up somewhere else.
This underworld looms large in the Cambodian capital of Phnom Penh, one of the global hubs for money launderers. The scene was even more pronounced in the coastal city of Sihanoukville, a notorious haven for scammers. Scammers operate their fraudulent operations from call centers, which are often located in heavily guarded buildings or on the upper floors of unfinished high-rises. In seaside restaurants, money launderers and other criminals conduct transactions over spicy Chinese food.
In March this year, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, authorities in the UK and the US have linked the casino to internet fraud and human trafficking.
We have obtained a batch of files that can be regarded as a "money laundering manual". Meanwhile, we interviewed nearly half a dozen scammers and their money laundering accomplices. The files do not point to a specific scam or victim, but reveal a nearly unstoppable method of illicit money transfer.
From The New York Times
To criminals, a money launderer is as important as the getaway driver in a bank robbery. Without them, the proceeds of crime would go unrealized.
Once the scammers have managed to get a victim to hand over their savings, they need to quickly move the funds from one account to another and from one country to another, before the victim realizes the scam and alerts the bank or police.
Eventually, the money becomes “clean” — making it almost impossible to trace back to the original scam.
So, how is this all done?
Following this clue, we unexpectedly discovered that this was related to a Cambodian financial giant called Huione Group.
This is not a small workshop hidden deep in the alley, secretly "laundering dirty money". Huiwang Group is a well-known company that conducts legitimate business in Southeast Asia and has branches in other parts of the world. Its QR code payment system is available throughout Cambodia, and consumers can use it to pay bills in hotels, restaurants and supermarkets. Huiwang's advertisements are spread across major highways, and its financial services cover banking and insurance.
However, Huione (pronounced “Hu-WAY-wahn”) is made up of multiple affiliated companies, not all of which are legitimate. Part of the group’s business provided customized money-laundering services, according to the documents and two anonymous people with direct knowledge of its operations. The two people familiar with the matter requested anonymity because they feared for their safety. The company did not respond to any requests for comment on the allegations.
Another affiliated company openly operated an online black market that connected criminals and money launderers. While the exact size of the market is almost impossible to measure, analytics firm Elliptic has linked it to $26.8 billion worth of cryptocurrency transactions since 2021. Due to the extreme opacity of the industry, it is difficult to distinguish legal from illegal transactions, but Elliptic points out that the black market is one of the largest illegal Internet markets in the world.
It is worth noting that Hun To, a cousin of the Cambodian Prime Minister, is a director of a subsidiary of Huiwang Group.
Huiwang Group’s clients included large criminal organizations, such as a gang in Myanmar that profited from exploiting victims of human trafficking, according to a study of its cryptocurrency transactions by a scammer, a money launderer and analytics firms Elliptic and Chainalysis.
Huione Group is made up of several affiliated companies, one of which, Huione Pay, is headquartered in Phnom Penh, Cambodia.
Yet, this money laundering network was able to operate with impunity. To date, the group has never been the target of any government sanctions. While cryptocurrency firm Tether froze some of the group’s accounts at the request of unspecified law enforcement, and messaging app Telegram shut down some of its channels, those measures failed to have a lasting impact.
Here is a detailed description of how it works:
Imagine you are a scammer, bilking people out of their life savings. You need a way to move these funds around the world, and that’s when you need a “middleman.”
A middleman is a trustworthy intermediary who can help you transfer the stolen money safely to its destination. A good middleman has a global network of people called money mules who can transfer funds within hours.
A money mule can be a person or a shell company that controls a local bank account or cryptocurrency wallet.
When you find a middleman, he will deposit the funds into an escrow account, thus ensuring that he cannot abscond with the funds while they are being transferred.
Now you are ready to start your scam.
Let's say you successfully trick someone into transferring $40,000 to you.
- Step 1: As the scam ringleader, you strike a deal with a middleman. Taking the US scam as an example, the middleman usually asks for 15% of the profits as compensation for himself and the money mule.
- Step 2: The middleman finds the right money mule and arranges the transaction for you.
- Step 3: The middleman sends you the mule’s bank account or cryptocurrency wallet information, which you then provide to the victim.
- Step 4: The victim transfers $40,000 to the money mule’s account.
- Step 5: The money mule transfers the funds from one account to another, eventually converting them into cryptocurrency.
- Step 6: Finally, the money mule takes a portion of the money as a service fee and passes the rest on to the middleman. The middleman deducts his own fee and gives you the remaining $34,000.
In this way, the entire money laundering chain is completed, the funds become almost untraceable, and the scam can proceed smoothly.
Brick Moving Business
Huiwang Group can make a profit at every step of the process.
First, one of its subsidiaries (until recently known as Huione Guarantee) operated a marketplace where scammers could find middlemen. Middlemen are crucial to the system, and their work is so repetitive that the Chinese call it “moving bricks,” according to Yanyu Chen, an anthropologist who studies money laundering in Cambodia.
This online marketplace consists of thousands of Telegram chat groups.
Some Huione Pay affiliates also advertise currency exchange services, including conversions between Tether and the U.S. dollar.
In these Telegram channels, anonymous users advertise money laundering services in barely veiled language. The posts are public and can be seen by anyone with the Telegram app. Some businesses also sell stolen personal information, apps used to impersonate others, and other services that are vital to scammers.
One channel, called Demand and Supply, has more than 400,000 subscribers and hundreds of messages a day, including ads for money laundering services. After we sent the issue to Huiwang Group and other relevant parties at the end of February, Telegram said it had deleted the channel. However, another similar channel soon emerged, attracting about 250,000 members within a week.
Huiwang Guarantee did not respond to multiple requests for comment, but denied any relationship with financial group Huiwang Group. The company even changed its name in October last year, removing the word "Hui Wang". However, it told clients on Telegram that Huiwang Group remains one of its "strategic partners and shareholders."
Secondly, this market platform provides guarantees for money laundering transactions. Why? Because the saying "even thieves have their own code of conduct" does not apply here, scammers will also deceive each other. In order to prove their credibility, middlemen and money mules need to pay a deposit to Huiwang Guarantee, which will be held in escrow. This assures the scammer that no one will abscond with the money (or if someone does, that person will lose their deposit).
The price of money laundering is determined by the type of crime that obtains the funds. For example, scams impersonating government officials are more costly because victims are more likely to call the police or notify their bank.
Geographic location also affects the price of money laundering. In China, the cost of money laundering can be as high as 60% of the stolen money. That’s because China has stepped up its money controls since 2020, launching a nationwide crackdown that has resulted in thousands of arrests and frozen large amounts of funds.
China and Cambodia have reached a cooperation agreement to jointly carry out law enforcement operations, which have led to the arrest of several criminals, but most of them are low-level criminals. These measures have not had a substantial impact on the fraud and money laundering industries.
Although the middlemen’s transactions are conducted privately, the groups themselves are making money. It makes money by selling ads in public groups, charging maintenance fees for private groups, and taking a small commission from transactions. Most transactions are denominated in the Tether cryptocurrency, but some are conducted in cash, gold or bank transfers. (The market even launched its own cryptocurrency last year.)
The market denied any involvement in any criminal activity in a disclaimer posted on its website and Telegram channel. One post said: "All businesses in the public group are provided by third-party merchants and have nothing to do with Huione Guarantee."
Third, another subsidiary of Huione Group, Huione International Pay, was more directly involved in money laundering activities. Huiwang International Payments itself is a middleman, according to internal company documents and two people familiar with its operations.
These files and insiders reveal that Huiwang International Payment's operational efficiency is comparable to that of a legitimate professional bank. Its headquarters is located in a glass and concrete building in Phnom Penh, with two panda statues standing at the entrance.
According to two people familiar with its operations, Huiwang International Payment operates out of the group’s headquarters in Phnom Penh.
One division of the company is dedicated to providing customer relations services to scammers and other illegal actors; another is responsible for monitoring Telegram channels; and another is responsible for tracking money mule accounts in at least a dozen countries, all of which are based on internal archives reviewed by us.
Huiwang's companies operate under a "legal veneer" in "countries where regulation is extremely lax or almost non-existent." John Wojcik, a threat analyst at the United Nations Office on Drugs and Crime (UNODC), said Huiwang Group’s complex and opaque ownership structure posed challenges for targeted law enforcement operations.
But he also pointed out that even if Huiwang was shut down, other operators would soon take its place.
“We’re already seeing competitors moving aggressively,” Wojcik said.
The National Bank of Cambodia - the agency responsible for regulating financial institutions - said the government was committed to ensuring "the security and transparency of financial transactions". At the same time, the government is working to comply with international anti-money laundering recommendations.
The National Bank also said that Huiwang’s relevant license in Cambodia was not renewed because its payment service, which is a payment system with QR code, failed to meet the renewal requirements. In response, Huiwang quickly announced plans to register its business in Japan and Canada.
Tracking the money mules
Money mules are people who operate bank accounts and digital wallets.
According to Elad Fouks, an expert at Chainalysis, which monitors on-chain fraud, some money mules open bank accounts using false identities, and advances in artificial intelligence have made it easier to forge identities.
Money mules spread out deposits and withdrawals to reduce the risk of being noticed by banks. For example, transactions under $10,000 usually go unnoticed. Most of the accounts and virtual wallets used to launder money are active for only a few weeks or months.
However, the people who are most at risk are not the middlemen or scammers, but the money mules. They are most likely to be captured.
A US court case reveals the specific mechanism of this operation. The main defendant in the case, Daren Li, operated a network of money mules, registering 74 U.S. shell companies to launder nearly $80 million. These companies open accounts with institutions such as Bank of America. When victims wired funds into these accounts, the funds were quickly transferred to a bank in the Bahamas. The funds were then used to purchase the Tether cryptocurrency, which is held on the Binance exchange.
Within a few days, the funds are transferred to another virtual wallet.
According to the records we reviewed, Darren Lee worked with Huiwang International Payment to conduct money laundering activities. But both the FBI and the Secret Service declined to confirm the link. Darren Lee pleaded guilty to conspiracy to launder money in November last year.
Payday
Imagine again that you are the leader of a fraud ring. Something went wrong: your money mule was arrested; the bank froze his account; or he absconded with the money.
In these cases, your middleman will step in to mediate the dispute.
If it is the money mule’s fault, the middleman will help you retrieve the deposit from the escrow account and return it to you. If no one is held liable, the losses will be considered part of the cost of doing business.
But if all goes well, you’ll get a payday, usually paid in Tether. You can exchange these Tethers into US dollars through the casino or Huiwang's payment company.
British authorities say buildings near the Golden Sun Sky Casino & Hotel in Sihanoukville once housed a large-scale fraud operation.
You can use these funds to pay your employees’ salaries.
Today, fraudulent operations mimic the operations of professional organizations, with marketing, sales and human resources departments employing thousands of people. Often, many of the employees are actually victims of human trafficking, forced to carry out scams on faraway targets. Some scams even mimic the 19th century company town model, paying employees only after they complete a season of work. Prior to this, employees could only use company credit lines for purchases.
Those wages, in turn, feed the scammers' gated communities of restaurants, casinos and brothels, which profit handsomely from their restricted workers.
The scammers' payroll also includes attractive models who are hired to take part in video calls to trick victims into handing over money. Some of these models even use artificial intelligence face-changing technology.
Like everyone else, scammers need to pay rent — not only for shelter, but also for “protection.”
In addition, the services behind the scam also require payment, and many services can be purchased through Huiwang’s “market”. Scammers pay software developers to create websites that mimic investment platforms. They need Internet and computer infrastructure. They also pay thieves to steal personal data from potential victims: national identification numbers, credit card information, location data and even details of previous hotel stays.
Some of the money will go to dealers selling luxury cars, and some will be used to buy real estate in places like London and Dubai.
Of course, some of the funds will be used to purchase fireworks.
