Only two of the 17 jurisdictions that answered a survey by the Asia/Pacific Group on Money Laundering (APG), or 12% of respondents, consider themselves successful at tracing and seizing the proceeds of cyber scam hubs. The figure appears in the asset recovery findings on page 39 of the APG's Cyber Scam Hubs and Human Trafficking Report 2026, which the regional anti-money laundering body released on 7 July 2026. The report itself is dated May 2026.
Indonesia and the United Nations Office on Drugs and Crime co-led the work. It describes compounds that run large-scale online fraud with a workforce that has often been trafficked, deceived and held against its will, and it sets out how money moves through and out of these operations.
"By understanding how these cyber scam hubs operate, it disrupts and disempowers the criminal networks behind them," said Dr Chris Black, Executive Secretary of the Asia/Pacific Group on Money Laundering.
What the report draws on
The APG collected questionnaire answers from 17 member jurisdictions and 156 private sector firms, mostly financial institutions and payment service providers, across 14 jurisdictions. Four blockchain analytics firms (Chainalysis, Crystal Intelligence, Elliptic and TRM Labs) and the exchange Binance also contributed. Its authors compiled 33 case studies from 13 jurisdictions, including China, Cambodia, Myanmar, the Philippines, Thailand and Singapore, all listed on page 46.
Drawing on various published estimates, the APG says the hubs generate tens of billions of US dollars a year and have claimed victims in more than 100 jurisdictions.
Where the hubs operate and why they persist
The report places the heaviest concentration in the Philippines and in the frontier regions where Thailand, Myanmar, Lao PDR and Cambodia meet, with more along the Myanmar-China border. Several special economic zones are named, including Dara Sakor and Henge Thmorda in Cambodia, the Golden Triangle zone in Lao PDR, and the Clark Free Port Zone in the Philippines. The APG says casinos and hotels hit by pandemic lockdowns were repurposed as scam premises, and that the Philippines' Anti-POGO Act of 2025 had a significant and immediate effect on hub activity there.
Three conditions recur across the evidence: the misuse of special economic zones, beneficial ownership hidden behind gatekeepers, and corruption. Among responding members, 65% pointed to complex corporate structures and shell or front companies as a main laundering channel, 76% reported gatekeeper involvement, and 41% cited corrupt or complicit local authorities.
How people are trapped and how the money moves
Fake job and business offers were the most common recruitment method, cited in 71% of member responses. Once inside, the price of release is estimated at between US$3,000 and US$20,000. Some are offered a "headcount" alternative instead, which means luring two or more new recruits to take their place. The APG lists several revenue lines beyond the scams themselves, including ransom and release fees, the resale of workers between compounds, debt bondage, and fake "recovery agents" who target already defrauded people.
Laundering relies on familiar tools. Members reported mule accounts (76%), virtual asset service providers and cryptocurrency (71%) and illegal or unlicensed remittance channels such as hawala and hundi (59%). On the virtual asset side, the APG flags layering, peer-to-peer transfers, over-the-counter brokers and deposits into crypto ATMs as emerging methods. Anyone tracking how scam networks move money across borders will find echoes in our earlier look at the sanctions and allegations involving Chen Zhi.
A detection gap for financial institutions
The findings are blunt about where cases come from. Victim reports and complaints triggered investigations in 82% of member responses, against 59% for suspicious transaction reports, and fewer than 30% of surveyed members had received any suspicious transaction report about scam hubs at all. Cross-border complexity was a key obstacle for 76% of members, difficulty tracing funds through crypto platforms for 71%, and a shortage of specialist expertise for 65%.
Operations are also scattering: roughly a third of members (35%) have seen big compounds give way to smaller, less visible set-ups spread across homes, hotels, short-stay lets and office buildings. Artificial intelligence is spreading quickly too: 82% of members reported deepfakes, 65% chatbots or AI-generated replies and 59% voice cloning. The APG suggests AI could change the economics of forced labour inside these operations, potentially requiring fewer or different workers.
What the blockchain data adds
Chainalysis, one of the firms that fed into the APG work, reaches a similar picture from on-chain data in its 2026 Crypto Crime Report. Its human trafficking chapter shows the trend moving fast. In 2025, the value of crypto reaching services the firm suspects of trafficking grew by 85%, to a level it describes only as hundreds of millions of dollars, and most of those services are based in Southeast Asia. Recruitment is sold almost like a service. By Chainalysis's count, recruitment deals usually change hands for somewhere between US$1,000 and US$10,000. Little of that money is hidden away: most travels through well-known exchanges and services built for institutional clients, while Telegram guarantee markets, Tudou and Xinbi among them, carry the rest. A familiar name also surfaces in the data. Chainalysis says it found an administrator account linked to the Fully Light Group, which comes from the Kokang area of northern Myanmar, in one of the recruitment channels it examined. The United Nations Office on Drugs and Crime had already mentioned the group in earlier work on illegal gambling and money laundering.
The firm's scams chapter records at least US$14 billion received by crypto scams on-chain in 2025, a total it projects could pass US$17 billion as more wallets are identified. Scams with on-chain links to AI vendors took in US$3.2 million per operation, against US$719,000 for those without, roughly 4.5 times more. Separately, Chainalysis estimates that Chinese language money laundering networks processed US$16.1 billion in 2025, about US$44 million a day.
Chainalysis sets out its own warning signs for compliance teams: large, regular payments to labour placement services alongside cross-border transfers, wallet clusters active across several types of illicit services, and concentrated flows into regions known for trafficking.
What the APG wants to see
The APG's recommendations centre on the following:
- Professional, holistic financial analysis backed by continuous training.
- Fast, specific interagency coordination at home, including task forces and shared analytical tools.
- International cooperation quick enough to involve authorities outside the anti-money laundering system, such as those responsible for trafficking victims.
- Stronger public-private partnerships, awareness campaigns and enhanced due diligence.
- Legal and institutional changes where current frameworks do not fit how the hubs work.
Dedicated anti-scam centres in Australia, Indonesia and Singapore are cited as useful models. Our reports cover Singapore's approach to the domestic end of the problem, including its new Scams Bill and a recent police sweep of suspected scammers and money mules.
"These measures are critical to the detection, disruption and prosecution of cyber scam hub operators and the protection of victims worldwide," said Mitsutoshi Kajikawa, Deputy Vice Minister of Finance for International Affairs at Japan's Ministry of Finance and Co-Chair of the Asia/Pacific Group on Money Laundering.
The APG also opened up a searchable typologies library, built with a Griffith University financial crime academy, that brings together upwards of 10,000 cases from two decades of its research and country assessments. For compliance teams at banks, payment firms, and virtual asset service providers, the practical message is that suspicious transaction reporting on scam hubs remains thin, and the typologies and red-flag indicators in the report give them material to change that.
