Beyond the Compound: Territorial Authority and Responsibility in Southeast Asia’s Scam Economy

  Focus - Allegati
  12 novembre 2026
  22 minuti, 21 secondi

Authors: Alessia Borromeo (Senior Researcher, G.E.O. Politics Section) and Tommaso Ravizza (Author, International Organisations Section, MI Post)

Abstract: Cyber-scam compounds have become a significant component of transnational organised crime in Southeast Asia, connecting online fraud, human trafficking and illicit financial activities. Their expansion has drawn increasing international attention, yet the persistence of these operations raises questions about the economic and political relationships that sustain them. This analysis examines how scam compounds have developed within different configurations of territorial authority and commercial infrastructure, focusing particularly on Cambodia and Myanmar. It then considers how forced criminality complicates the attribution of responsibility when individuals subjected to trafficking are compelled to participate in unlawful activities. Drawing on academic research and recent institutional developments, the article argues that effective responses require a clearer distinction between those who execute fraudulent operations, those who exercise control over them and the actors who facilitate their continuity. The implications extend to international cooperation, where disrupting criminal networks depends on connecting financial investigations, territorial enforcement and victim protection.

Introduction: The Political Dimensions of Cyber-Scam Compounds

Investigations into online fraud can identify deceptive communications, trace financial transactions and link individuals to fraudulent activities, but such evidence does not necessarily reveal the conditions that make large-scale operations possible (INTERPOL, 2026). The limits of an approach centred on digital evidence become particularly apparent in Southeast Asia, where online fraud has increasingly been organised through facilities known as cyber-scam compounds. Prominent in Cambodia, Myanmar and Laos, the compounds accommodate activities ranging from investment fraud to romance scams, relying on physical infrastructure, specialised services and different forms of labour organisation. Their reach, however, extends beyond individual facilities: recruitment networks, financial intermediaries and the people targeted may be located across different countries, connecting operations carried out in specific locations to a much wider transnational criminal economy (UNODC, 2023; INTERPOL, 2026).

Understanding how such operations function also requires examining the position of the people involved. While some individuals knowingly participate in fraudulent activities, others are recruited through deceptive employment offers and subsequently subjected to confinement or coercion; different degrees of authority can also be found among those responsible for recruitment, supervision and financial management (UNODC, 2023; OHCHR, 2026). Participation in the same operation does not, however, imply comparable autonomy or responsibility. In cases involving trafficking, evidence that an individual carried out fraudulent activities may reveal little about the conditions under which they acted, particularly when threats, restrictions on movement or other forms of coercion are involved. The distinction between carrying out an offence and exercising control over its execution thus becomes essential in understanding how responsibility should be assessed.

Yet the organisation of scam operations cannot be understood solely through the individuals conducting or directing fraudulent activities. Operating on a large scale also requires access to buildings, technological infrastructure, financial services and territory, often involving relationships with commercial actors, political intermediaries or armed organisations. The role of such relationships complicates explanations that associate the expansion of cyber-scamming primarily with weak governance or the absence of state control. Loughlin (2026), for instance, examines how illicit capital can become embedded in established systems of patronage and political authority, while Loong and Siegel (2026) explore the connections between scam operations, armed-group financing and civilian livelihoods along the Myanmar-Thailand border. Although the political and economic environments differ, both studies suggest that criminal activities may become closely connected to existing arrangements of power rather than simply operating outside them. Economic involvement, however, does not necessarily imply knowing participation in criminal activity, making it important to distinguish the different roles through which resources, services and protection become available to scam networks.

The question of responsibility consequently extends beyond the individuals who carry out fraudulent activities to the wider relationships that sustain their organisation. Focusing on Cambodia and Myanmar, the analysis examines how different economic and territorial arrangements support scam operations, how forced criminality complicates the attribution of responsibility and why interventions against individual compounds may leave broader networks intact. Its central concern is how control and responsibility are distributed across the actors involved in Southeast Asia’s scam economy, and what the distribution of power means for efforts to disrupt criminal operations and protect people subjected to exploitation.

The Historical Development and Political Economy of Southeast Asia’s Scam Compounds

The development of scam compounds in Southeast Asia cannot be separated from the earlier expansion of telecommunications fraud and its growing connections with the gambling industry. As scam operations relocated from Taiwan and mainland China to parts of Southeast Asia during the 2010s, they drew on an expanding casino and online gambling economy whose infrastructure could also support fraudulent activities (Franceschini et al., 2025). Buildings, internet connectivity and payment services provided some of the resources needed to organise fraud on a larger scale, while the overlap between gambling and scamming extended to the use of personnel and financial networks. The expansion of the industry was therefore connected to existing commercial infrastructures, although the relationship varied considerably across locations and did not imply that gambling-related businesses were uniformly involved in criminal activities (UNODC, 2023).

Sihanoukville offers a particularly relevant example of how these developments unfolded (Franceschini et al., 2025). During the 2010s, investment in casinos, hotels and real estate transformed the Cambodian coastal city, attracting businesses and operators linked to the growing online gambling sector. The economic environment changed considerably after August 2019, when Cambodian authorities announced that licences for online gambling would no longer be issued or renewed. While some operators closed or relocated, others continued their activities within larger and better-protected compounds, where gambling and fraudulent operations could make use of existing infrastructure and services. The subsequent COVID-19 pandemic brought further disruption, particularly to tourism and casino activities; as demand declined, some hotels and gambling establishments began renting their premises to online operators or adapting their own activities. Rather than marking the beginning of the scam industry, these developments contributed to its reorganisation, with some operations becoming increasingly concentrated in facilities whose continued functioning also depended on relationships with local actors (Franceschini et al., 2025; Loughlin, 2026).

The concentration of fraudulent activities in physical facilities, however, represents only one dimension of their organisation. A compound may provide the location from which scams are conducted while relying on recruitment networks, technological specialists and financial intermediaries operating elsewhere. As UNODC (2024) documents, the expansion of cyber-enabled fraud has been accompanied by an increasingly specialised market for services ranging from technological assistance to underground banking and money laundering. Criminal organisations can therefore obtain capabilities from external providers without directly managing every stage of an operation, allowing different activities to be distributed across actors and jurisdictions.
The scale of the associated financial losses helps illustrate the economic significance of the phenomenon: UNODC estimated that cyber-enabled scams caused between USD 18 billion and USD 37 billion in losses among victims in twelve countries and territories across East and Southeast Asia in 2023. Although a substantial proportion was attributed to criminal groups operating from Southeast Asia, the estimate concerns victims’ losses rather than the verified revenues or profits of individual compounds (UNODC, 2024).

The reliance on external services also connects scam operations to the wider economy. Property owners, financial intermediaries and providers of technological or security services may earn income by supplying resources used by criminal networks, even without necessarily being aware of the unlawful activities these resources facilitate. However, the economic dimension of scam operations goes beyond the reliance on external providers. It also encompasses the exploitation of coercive labour and the accumulation of illicit profits, which are integral to the organisation and functioning of the scam economy. These dynamics reflect a form of predatory capitalism that can be examined through the concept of compound capitalism. (Franceschini et al., 2023). In contexts where access to property, services and protection is shaped by established systems of authority and patronage, economic relationships take on a political dimension, allowing criminal capital to interact with actors who exercise control over local resources (Loughlin, 2026).
The persistence of scam compounds therefore depends not only on the availability of infrastructure, but also on the relationships through which access to it is secured and maintained.

Territorial Authority and Criminal Governance

Access to land, infrastructure, and protection is shaped by political relationships that govern the allocation and control of resources, helping to explain why scam compounds have developed under different forms of authority across Southeast Asia. Cambodia and Myanmar exemplify this variation, although neither presents a single, uniform model. In Cambodia, the expansion of scam operations has intersected with property development, gambling-related investment, and commercial networks connected to political elites, within a relatively centralised system of patronage where relationships supporting legitimate investment may also facilitate the circulation of illicit capital and access to resources (Loughlin, 2026). Such overlaps, however, should not be interpreted as evidence that all businesses in the surrounding economy knowingly support criminal activities. Understanding the conditions under which scam operations develop requires examining how specific actors gain and maintain access to resources, as well as the extent of involvement of those providing them.

Along the Myanmar–Thailand border, access to comparable resources is negotiated within a fragmented landscape of authority shaped by decades of conflict and competing armed organisations. In the Myawaddy area, gambling and fraudulent activities existed prior to the February 2021 military coup. As conflict intensified, certain armed groups gained additional opportunities to generate revenue by providing land, security, and control over border crossings. Their involvement, however, varies significantly. The Karen Border Guard Force, later renamed the Karen National Army, has been particularly involved in scam operations, while the central leadership of the Karen National Union has publicly condemned the industry, despite reports of individual officials’ involvement (Loong and Siegel, 2026).
While armed organisations play a significant role in controlling and protecting scam operations, the economic relationships sustaining the industry also extend to civilian populations whose livelihoods have been disrupted by prolonged conflict, displacement, and insecurity. For some residents, employment in construction, transport, or security offers income where alternatives are scarce and may provide precarious protection from violence. Participation in the scam economy may thus become a strategy for survival even among people who regard the industry as harmful, with their labour contributing to its continuity without necessarily establishing knowing involvement in trafficking or fraud (Loong and Siegel, 2026).

Differences in how resources and protection are provided are also relevant to the restrictive measures adopted by the Council of the European Union on 30 July 2026. By designating seven individuals and three entities associated with serious human rights violations linked to scam centres, the Council identified actors allegedly involved in different aspects of the industry’s organisation. Among these was the Democratic Karen Benevolent Army (DKBA), which, according to the Council, enabled large-scale scam operations by permitting compounds to operate under its protection near Myawaddy. The measures also targeted Prince Holding Group and Jin Bei Group, two Cambodia-based conglomerates engaged in distinct commercial activities: Prince Holding Group was associated with the construction of scam compounds in Cambodia and Myanmar through front companies, while Jin Bei Group was linked to the development of casinos and scam facilities in Cambodia (Council of the European Union, 2026). Although the designations do not constitute criminal convictions, they draw attention to the different forms of commercial and territorial involvement identified by the Council.

Considered together, the two cases complicate explanations that associate the persistence of scam compounds primarily with weak institutions or an absence of governance. Criminal operations may become embedded in established systems of political and commercial patronage (Loughlin, 2026) or in more fragmented arrangements involving armed actors and competing territorial authorities (Loong and Siegel, 2026), with different implications for how resources are controlled and protection is maintained. Such differences also shape the possibilities for enforcement, since closing an individual facility may interrupt fraudulent activities without necessarily disrupting the relationships through which criminal networks secure land, financial services, and territorial protection. Understanding who exercises control over those resources, and how that control is maintained, is therefore essential to assessing the wider organisation of the scam economy. Yet identifying the actors who sustain criminal operations addresses only one dimension of responsibility: within the compounds, the individuals carrying out fraudulent activities may occupy very different positions, including circumstances in which their participation results from trafficking and coercion.

Forced Criminality and the Limits of Attribution

Performing a task within a scam compound does not, in itself, reveal the degree of freedom an individual possesses in carrying it out. Fraudulent operations encompass activities ranging from contacting prospective victims and maintaining communications to technical support and financial transactions, yet similar tasks may be performed under markedly different conditions. Some workers are deceived about the nature of their employment from the outset, while others initially understand that their work involves fraud but subsequently encounter unanticipated restrictions. Confiscation of identity documents, coercive debts, threats, and physical violence can transform an apparently accepted job into a situation where leaving the facility or refusing instructions is no longer possible (OHCHR, 2023, 2026). When trafficked individuals are compelled to commit unlawful acts as part of their exploitation, such circumstances are commonly described as forced criminality.

This distinction between observable conduct and freedom of action presents a particular challenge for investigations based on records of fraudulent activities. Messages, account histories, and financial transactions may assist in reconstructing events and linking activities to specific accounts or devices, but they cannot, without additional evidence, establish who controlled them or whether the individual involved was acting voluntarily. Assessing participation therefore requires attention to recruitment, working conditions, and the ability to refuse instructions or leave, alongside evidence of fraudulent conduct. A dual-victim pattern identified by INTERPOL (2026) illustrates the importance of such distinctions: individuals trafficked into scam centres may be forced to defraud others, who then suffer financial and psychological harm. Recognising both forms of victimisation neither diminishes the harm experienced by scam targets nor implies that everyone working in a compound has been trafficked. It does, however, require a separate assessment of the circumstances in which unlawful activities were carried out.

The conditions under which an unlawful act is committed also have implications for criminal responsibility, particularly when participation results from trafficking and exploitation. In these circumstances, the principle of non-punishment aims to prevent victims from being prosecuted or penalised for activities they were compelled to undertake. Under Article 8 of Directive 2011/36/EU, as replaced by Directive (EU) 2024/1712, Member States must ensure that competent authorities are empowered, in accordance with the basic principles of their legal systems, not to prosecute or impose penalties on trafficking victims for unlawful activities committed under compulsion as a direct consequence of their exploitation. Member States were required to transpose the amending directive by 15 July 2026 (European Parliament and Council of the European Union, 2024). While the provision does not establish automatic immunity, its application requires attention to the relationship between exploitation and unlawful conduct, particularly where indicators of trafficking might otherwise be overlooked and individuals subjected to coercion treated primarily as suspected offenders.

The difficulty of identifying trafficking victims whose activities may also constitute criminal offences has informed regional responses in Southeast Asia. In June 2025, ASEAN introduced guidelines on applying the non-punishment principle, emphasising the need to consider potential trafficking at an early stage of identification without making preliminary protection contingent on formal recognition. Regional efforts continued in August 2026 with the validation of indicators for identifying victims trafficked into forced criminality and accompanying training materials (ASEAN, 2025, 2026). However, the creation of common guidance does not guarantee that identification and protection procedures are consistently implemented across national systems, particularly when individuals are encountered in circumstances that may initially suggest criminal involvement. The gap that can arise between protective frameworks and identification practices is illustrated by research conducted by Amnesty International (2026a) in Cambodia, where none of the 73 survivors interviewed between July 2025 and April 2026 had been formally recognised by Cambodian authorities as a trafficking victim, despite the organisation’s assessment that their experiences met the international definition of trafficking. Although these findings cannot be generalised beyond those interviewed, they show how release from a compound may occur without recognition of the exploitation experienced or access to the protection and assistance associated with trafficking victim status.

Failure to recognise coercion can influence the treatment of individuals, while focusing exclusively on their actions may also obscure the broader organisation of scam operations. Even where individual acts of fraud can be reconstructed, identifying those who organise and sustain the wider operation remains a separate investigative challenge, particularly when recruitment, financial transfers, and territorial protection involve different actors. Investigations must consequently address both the circumstances under which unlawful acts occurred and the organisational relationships that enabled these activities. Maintaining a distinction between these dimensions allows trafficking victims to be identified and protected without presuming responsibility based solely on participation, while also preserving the need to investigate those who exercise control over the wider criminal operation.

From Operational Disruption to Transnational Governance

Identifying who controls a scam network becomes more difficult when its activities are distributed across national borders. Recruitment, exploitation, technological support and financial transfers may take place in different countries, while victims are targeted elsewhere and operational leaders direct fraudulent activities from outside the compounds. Given the international reach of scam-centre operations and their connections with specialised money-laundering networks (INTERPOL, 2026), investigations confined to a single facility may capture only part of a wider organisation. With different functions distributed among criminal groups and intermediaries, closing a compound may interrupt the fraud conducted there without removing the recruitment channels, financial arrangements or external services through which operations can continue elsewhere.

Distinguishing immediate disruption from wider organisational change is particularly important when assessing Cambodia’s crackdown, launched in July 2025. Cambodian authorities reported closing more than 200 scam centres, while evidence of state intervention was documented at 24 of the 86 compounds identified through independent research conducted between July 2025 and April 2026 (Amnesty International, 2026a). As the official total and the independently documented cases concern different sets of locations, the figures cannot be compared directly or used, on their own, to determine the extent of enforcement. Beyond the figures, reports of apparent collusion between some compound managers and police officers, alongside abuses affecting people after interventions, raise questions about how operations were conducted and whether those encountered received adequate protection (Amnesty International, 2026a). Further evidence of the relationships sustaining the compounds emerged in October 2026, with the identification of five private security companies providing services at Cambodian facilities and links involving military and police personnel at at least 22 of the 86 sites examined (Amnesty International, 2026b). By that point, large-scale operations at the compounds investigated appeared to have largely ceased, indicating a reduction in visible criminal activity without establishing whether the commercial and institutional relationships supporting the facilities had also been disrupted. Evaluating the crackdown consequently involves examining both what interventions achieved immediately and whether they affected the specific arrangements through which criminal operations had been sustained.

Questions about the reach and effectiveness of enforcement also extend to European security, given that fraudulent operations originating in Southeast Asia target victims across multiple jurisdictions, including within the European Union. Their intersection with human trafficking, cybercrime, organised crime and financial crime has brought scam centres onto the European security agenda, reflecting the need for responses capable of addressing several interconnected activities (EEAS, 2026). Cooperation through the European Multidisciplinary Platform Against Criminal Threats (EMPACT) can facilitate information-sharing and joint investigations across jurisdictions, while financial enquiries help trace transactions and identify possible beneficiaries. Operations directed at individual facilities address another dimension by seeking to interrupt fraudulent activities on the ground, but neither their closure nor the imposition of targeted sanctions necessarily establishes the circumstances of those found carrying out fraud. Identifying individuals subjected to trafficking and coercion consequently requires procedures that examine their experiences alongside investigations into the organisation of criminal networks. Coordination between investigative and protective measures is therefore essential, particularly since sanctions do not constitute criminal convictions and the existence of victim-identification procedures cannot guarantee recognition or protection in practice.

Where investigative, financial and protection measures remain disconnected, authorities may document fraudulent conduct without adequately examining whether those carrying it out were coerced, or close a compound without reaching the actors controlling the resources that made its operation possible. Both limitations become particularly consequential when criminal networks depend on established political and commercial relationships that can continue to provide infrastructure, financial services and territorial protection even as activities relocate under enforcement pressure. Assessing the effectiveness of an intervention consequently requires following developments beyond the immediate closure of a facility, examining whether the recruitment and financial networks facilitating criminal activities have been disrupted, whether those exercising effective control have been identified and whether people subjected to exploitation can obtain appropriate protection. Establishing these outcomes is more demanding than counting raids or closures, but provides a stronger basis for determining whether enforcement has affected the organisation of the wider criminal economy.

Conclusions: Beyond the Visible Operation

Scam compounds make transnational fraud visible at identifiable locations, yet their operation relies on relationships extending beyond these sites, including access to land and services and arrangements for political or territorial protection. In Cambodia, commercial investment and politically connected business networks have shaped the environments in which some operations developed, whereas in parts of Myanmar, prolonged conflict has enabled armed actors to influence control over territory and revenue. Both configurations suggest that the persistence of fraudulent activities cannot be explained simply by an absence of governance, since criminal operations may become embedded in existing relations of power. Tracing these relationships can help identify those who enable and direct criminal operations, while also raising questions about the responsibility of individuals carrying out scams, whose apparently similar activities may conceal markedly different degrees of autonomy, including circumstances of trafficking and coercion. Assessing the conditions of their participation is therefore essential to understanding how responsibility is distributed, without diminishing the harm inflicted on fraud victims.

Because criminal activities are organised through multiple relationships, closing a compound may interrupt fraud at one site while leaving recruitment channels, financial arrangements or sources of protection available elsewhere. Even when enforcement operations identify individuals sending fraudulent messages, their identification does not necessarily reveal who directed them or whether they acted freely. Evaluating enforcement thus requires linking investigations into organisational control with the identification of individuals subjected to exploitation, ensuring that measures targeting financial and territorial support also consider the circumstances of those found inside the facilities. What matters is what changes after an intervention: whether the relationships sustaining criminal operations have been disrupted, whether the actors exercising control have been identified and whether individuals coerced into fraud can obtain appropriate protection. Moving beyond the visible operation means treating the compound as an entry point into a wider network of control, exploitation and responsibility, not as the boundary of the criminal organisation itself.

This analysis develops research conducted for Episode 8 of Season 2 of the GeopoliticaMI podcast, dedicated to cyber-scam compounds and forced criminality in Southeast Asia.

References

Cover Photo by Bermix Studio on Unsplash

Classification of sources and information:

1

Confirmed

Confirmed by other independent sources; logical in itself; coherent with other information on the topic

2

Presumably true

Not confirmed; logical in itself; coherent with other information on the topic

3

Maybe true

Not confirmed; reasonably logical in itself; coherent with some other information on the topic

4

Uncertain

Not confirmed; possible but not logical in itself; no other information on the topic

5

Improbable

Not confirmed; not logical in itself; contradicts with other information on the topic

6

Not able to be evaluated

No basis to evaluate the validity of the information

Trustworthiness of the source

A

Trustworthy

No doubt about authenticity, reliability or competence; has a history of total trustworthiness

B

Normally trustworthy

Small doubts about authenticity, reliability or competence, nevertheless has a history of valid information in a majority of cases

C

Sufficiently trustworthy

Doubts about authenticity, reliability or competence; however, has supplied valid information in the past

D

Normally not trustworthy

Significant doubt about authenticity, reliability or competence, however has supplied valid information in the past

E

Not trustworthy

Lack of authenticity, reliability or competence; history of invalid information

F

Not able to be evaluated

No basis to evaluate the validity of the information

Riproduzione Riservata Ⓡ

Condividi il post