New York Times: Revealing the Cambodian money laundering empire, the secret assembly line behind the encryption scam

Original title:"The Scammer's Manual: How to Launder Money and Get Away With It"

Author: Selam Gebrekidan & Joy Dong

Compiled by: Deep Tide TechFlow

Every few weeks, the night sky in Cambodia is lit up by fireworks. The scammers set off these fireworks to celebrate their latest "big-making" scam.

When fireworks bloom in the sky, someone's life savings may have gone away. The victims may have been trapped in a fake online dating scam, or invested in a fake cryptocurrency exchange. Regardless of the form of the scam, money has disappeared and has been entangled in a complex money laundering network that flows billions of dollars at a dazzling speed.

The FBI, the Chinese Ministry of Public Security, Interpol and other agencies have tried to crack down on these fraudsters. They are often active on social media and dating apps, tricking people into engaging in fake financial plans or other scams. Telecom companies blocked their phone numbers and banks issued warnings several times.

However, this industry still survives tenaciously, and the money laundering operation behind it is extremely efficient. Unprepared victims around the world lose tens of billions of dollars a year, and these funds must be "cleaned" to cover up their source of crime and eventually flow into the legal economic system. This money laundering system is like a Hydra. When the government strikes it in one place, it will emerge in another place.

This underground world is looming in Phnom Penh, the capital of Cambodia, which is one of the hubs of money launderers around the world. This is even more evident in the coastal city of Sihanoukville, a notorious haven for fraudsters. Scammers conduct fraud business in call centers, which are usually located in heavily guarded buildings or on the upper floors of unfinished tall buildings. In the restaurant by the sea, money launderers and other criminals trade while enjoying spicy Chinese food.

In March this year, outside the Golden Sun Sky Casino & Hotel in Sihanoukville, Cambodia, relevant departments in the UK and the US have linked the casino to online fraud and human trafficking.

We obtained a batch of documents that could be considered a "money laundering manual". At the same time, we interviewed nearly six scammers and their money laundering accomplices. The documents do not point to a specific scam or victim, but reveal an almost unstoppable method of illegal transfer of funds.

From The New York Times

For criminals, money launderers are important like runaway drivers in bank robberies. Without them, the proceeds of crime will not be fulfilled.

Once the scammers succeed in getting the victim to hand over their savings, they need to quickly transfer the funds from one account to another, from one country to another, in order to complete the operation before the victim perceives the scam and calls the bank or police.

Eventually, the money will become "clean" - almost impossible to trace back to the original scam.

So, how is this done?

Tracking this clue, we unexpectedly discovered that it was related to a financial giant in Cambodia called Huione Group.

This is not a small workshop hidden deep in the alley and secretly "cleans money". Huiwan Group is a well-known company that conducts legal business in Southeast Asia and has branches in other regions around the world. Its QR code payment system is spread throughout Cambodia, and consumers can use it to pay bills in hotels, restaurants and supermarkets. Huiwan's advertising is spread across major highways, and its financial services cover banking and insurance businesses.

However, Huione (pronounced "Hu-WAY-wahn") consists of multiple affiliates, but not all subsidiaries are legal. According to the documents, and two anonymous people who have direct knowledge of their operations revealed that part of the group's business provides customized money laundering services. The two people familiar with the matter asked to be anonymous because of concerns about their own safety. The company did not respond to any request for comment on the allegations.

Another affiliate opens up running an online black market that matches criminals and money launderers. While the specific size of the market is almost impossible to measure, analytics firm Elliptic has linked it to $26.8 billion worth of cryptocurrency transactions since 2021. Due to the extreme opaque industry, legal transactions are difficult to distinguish from illegal transactions, but Elliptic notes that the black market is one of the largest illegal Internet markets in the world.

It is worth noting that Hun To, a cousin of the Cambodian Prime Minister, is a director of a subsidiary of Huiwan Group.

According to a study of their cryptocurrency transactions by a scammer, a money launderer, and analysis firm Elliptic and Chainalysis, Huinan Group’s clients include large criminal organizations, such as a gang in Myanmar that profits by exploiting victims of human trafficking.

Huione Group is composed of several affiliates, one of which is headquartered in Phnom Penh, Cambodia.

However, this money laundering network can operate unscrupulously. To date, the organization has never been the target of any government sanctions. While cryptocurrency company Tether has frozen some of the group’s accounts at the request of unspecified law enforcement, and communications app Telegram has shut down some of its channels, none of these measures have had lasting impact.

Here is a detailed description of how it works:

Imagine you are a scammer who defrauds people of their life savings. You need a way to transfer these funds from all over the world, and at this time you need a "middleman".

The so-called middleman is a trustworthy intermediary that can help you transfer the stolen money to your destination safely. A good middleman has a global network called "money mule" that can complete funds transfers in a matter of hours.

The fund mule can be a person or a shell company that controls local bank accounts or cryptocurrency wallets.

When you find a middleman, he will deposit the funds into the escrow account, ensuring that he will not abscond with the money during the transfer of funds.

Now, you are ready to start your scam.

Suppose you successfully tricked someone into transferring money to you $40,000.

Step 1: As the fraud leader, you reach an agreement with the middleman. Taking the American scam as an example, the middleman usually asks for 15% of the gain as compensation for himself and his capital mule.

Step 2: The middleman finds the right fund mule and arranges the transaction for you.

Step 3: The intermediary sends you the bank account or cryptocurrency wallet information of the Fund Mule, and you provide this information to the victim.

Step 4: The victim transfers $40,000 to the Mule’s account.

Step 5: The Funding Mule transfers funds from one account to another and eventually converts them into cryptocurrency.

Step 6: Finally, the fund mule extracts a portion of it as a service fee and transfers the remaining amount to the middleman. After the intermediary deducts his own compensation from it, he will hand over the remaining $34,000 to you.

In this way, the entire money laundering chain is completed, the funds become almost impossible to track, and the scam goes smoothly

"Brick Moving" business

Huiwan Group can make profits at every step of the entire process.

First, a subsidiary of its subsidiary (until recently known as Huione Guarantee) operates a marketplace where scammers can find middlemen. Intermediates are crucial in this system, and their work is so mechanically repetitive that, according to Yanyu Chen, an anthropologist who studies money laundering in Cambodia, the Chinese call this behavior "brick-moving."

This online marketplace consists of thousands of Telegram chat groups.

Some Huione Pay branches also promote currency exchange services, including conversions between Tether and USD.

In these Telegram channels, anonymous users publish ads for money laundering services in almost uncovered language. These posts are public and can be seen by anyone with a Telegram app. Some merchants also sell stolen personal data, applications used to impersonate others, and other services that are crucial to scammers.

One of the channels, called Demand and Supply, has over 400,000 users and has hundreds of messages every day, including advertisements for money laundering services. After we sent questions to Huiwan Group and other relevant parties at the end of February, Telegram said the channel had been deleted. However, another similar channel soon emerged, attracting about 250,000 members in a week.

Huiwan Guarantee did not respond to multiple comment requests, but denied that it had a relationship with the financial group Huiwan Group. The company even changed its name in October last year, removing the word "Hui Wan". However, it told its clients on Telegram that Huwan Group remains one of its "strategic partners and shareholders."

Secondly, this market platform provides guarantees for money laundering transactions. Why? Because the saying that stealing is also true does not apply here, scammers will also deceive each other. In order to prove their credibility, the middleman and the fund mule need to pay a deposit to Huiwan Guarantee, which will be escrowed. This assures the scammer that no one will abscond with the money (or that person will lose his or her own deposit even if someone does).

The price of money laundering is determined by the type of crime that is obtained. For example, scams that impersonate government officials are more costly because victims are more likely to call the police or notify the bank.

Geographic location will also affect the price of money laundering. In China, the cost of money laundering can reach up to 60% of the stolen money. This is because since 2020, China has strengthened fund control, launched a nationwide crackdown, arrested thousands of people and frozen a large amount of funds.

China and Cambodia have reached a cooperation agreement to jointly carry out law enforcement actions, which have led to the arrest of several criminals, but most of the arrests are low-level criminals. These measures have not had a substantial impact on the fraud and money laundering industries.

Although the middleman’s transactions are conducted privately, the group itself is making money. It profits by selling ads in public groups, charging maintenance fees to private groups, and drawing small commissions from transactions. Most transactions are denominated in Tether cryptocurrency, but some are also in cash, gold or bank transfers. (Even last year, the market issued its own cryptocurrency.)

The market denies any criminal activity in its disclaimer published on its website and Telegram channels. One post said: "All businesses in public groups are provided by third-party merchants and have nothing to do with Huione Guarantee."

Third, Huione International Pay, another subsidiary of Huione Group, has participated in money laundering activities more directly. According to internal company documents and two people familiar with its operations, Huiwan International Payment itself is a middleman.

These documents and people familiar with the matter revealed that Huiwan International Payment is as efficient as a legal professional bank. Its headquarters is located in a glass and concrete building in Phnom Penh, with two panda statues standing at the entrance of the building.

According to two people familiar with its operations, Huiwan International Payment operates within the group's headquarters in Phnom Penh.

One department within the company is responsible for providing customer relationship services to scammers and other illegal actors; another department is responsible for monitoring Telegram channels; and another department tracks fund mule accounts distributed in at least a dozen countries, all of which are from internal documents we review.

Huiwan's company operates in a "legal cloak" in a "country with extremely loose regulation or even almost non-existent". John Wojcik, a threat analyst at the United Nations Office on Drugs and Crime (UNODC), said the complex and opaque ownership structure of Huywan Group poses challenges to targeted law enforcement actions.

But he also pointed out that even if Huiwan is closed, other operators will soon replace it.

"We have seen competitors actively lay out," Voichik said.

The National Bank of Cambodia, the department responsible for overseeing financial institutions, said the government is committed to ensuring "security and transparency of financial transactions." At the same time, the government is working hard to comply with relevant international anti-money laundering recommendations.

The State Bank also stated that its relevant license in Cambodia has not been renewed because Huiwan’s payment service (i.e., payment system with QR code) failed to meet the renewal requirements. In response, Huiwan quickly announced plans to register its business in Japan and Canada.

Tracking Fund Mule

Money mules are those responsible for operating bank accounts and digital wallets.

According to Elad Fouks, an expert at Chainalysis, a company responsible for monitoring on-chain fraud, some fund mules open bank accounts by using fake identities, and advances in artificial intelligence have made it easier to fake identities.

The fund mule will spread deposits and withdrawals to reduce the risk of being noticed by the bank. For example, transactions with a amount below $10,000 are often not easy to attract attention. Most accounts and virtual wallets used for money laundering are only active for weeks or months.

However, the ones with the highest real risks are not the middlemen or scammers, but these funding mules. They are most likely to be caught.

A U.S. court case reveals the specific mechanisms of this operation. Daren Li, the principal defendant in the case, runs a funding mule network, who registered 74 U.S. shell companies to launder nearly $80 million. These companies open accounts at institutions such as Bank of America. When the victim remits funds to these accounts, the funds are quickly transferred to a bank in the Bahamas. The funds were then used to purchase Tether cryptocurrencies held on Binance Exchange.

Within a few days, the funds will be transferred to another virtual wallet.

According to records we reviewed, Darren Lee has worked with Huiwan International Payment to conduct money laundering activities. But the FBI and Secret Service both refused to confirm the relationship. Darren Lee pleaded guilty to conspiracy to launder money in November last year.

Payday

Imagine again, you are the leader of a fraud group. Something went wrong: your fund mule was arrested; the bank freezes his account; or he might have absconded with the money.

In these cases, your intermediary will intervene in mediating the dispute.

If it is the fault of the Fund Mule, the intermediary will help you get the deposit back from the escrow account and return it to you. If no one is responsible, these losses will be considered part of the operating costs.

But if everything goes well, you will have a "payday", which is usually paid in Tether. And you can convert these Tethers into US dollars through the casino or Huiwan payment company.

British authorities said the building near the Golden Sun Sky Casino & Hotel in Sihanoukville has accommodated large-scale fraud.

You can use these funds to pay employees’ wages.

Today, fraud operations imitate the operation model of professional institutions, with marketing, sales and human resources departments, employing thousands of people. Often, many employees are actually victims of human trafficking and are forced to commit fraud against distant targets. Some fraudulent organizations even mimic the 19th-century corporate town model, paying wages only after employees have completed a season of work. Before this, employees could only use the company's credit limit to spend.

These wages in turn nourish restaurants, casinos and brothels in the enclosed areas where scammers are located, which make a lot of money from employees who are restricted from freedom.

In addition, the scammers' payroll includes attractive models who are hired to participate in video calls and trick victims into paying money. Some of these models even use artificial intelligence face swapping technology.

Like everyone else, scammers also need to pay rent—not only for living, but also for "protection."

In addition, behind-the-scenes services for fraud also require payment, and many services can be purchased through Huiwan's "market". Scammers pay software developers create websites that mimic investment platforms. They need the internet and computer infrastructure. They will also pay thieves to steal personal data from potential victims: including national ID numbers, credit card information, location data, and even detailed records of previous hotel stays.

Some of the funds will go to dealers selling luxury cars, and some of the funds will be used to purchase real estate in places like London and Dubai.

Of course, there is also a portion of the funds used to buy fireworks.