After linking up with dozens of workers “asking to be saved” and breaking into scammers’ computers, a notorious ex-hacker now working for the Vietnamese state cybersecurity agency called for “prompt intervention” to get thousands of victims out of Cambodian compounds.

A report compiled mostly last year by Ngo Minh Hieu — previously jailed in the U.S. for a massive identity-theft scheme involving the personal data of 200 million people — documented familiar allegations that have been raised by Chinese, Thai, Malaysian and other nationals about global scam operations based in Cambodian compounds marked by detention, debt slavery and violence.

For months, foreign workers have alleged being lured to come to Cambodia then held at compounds and forced to work on global online scams. Foreign governments have issued warnings about the situation, but the scam compounds have continued to operate.

Split into seven documents with dozens of links to further files inside, the cybersecurity researcher’s report, provided to VOD, contains a range of technical and personal documentation taken from inside Cambodian scam operations:

• Information about 31 workers who were allegedly “asking to be saved to go back to Vietnam,” including 22 of their ID cards and detailed correspondence with some about their locations and work.
• An estimated 14,000 messages from scam operations’ Telegram group chats that span about a month mid-last year, discussing runaway workers, fake investment documents, scam victims’ desperation and daily minutiae.
• Admin logins to scam websites, backdoors to computers inside compounds and archives of source code.
• Audio, video and written instructions from inside the operations, where managers describe investment scams as games.

Most of the report’s documentation dates to the middle of last year, but includes updates from January this year. VOD attempted to reach 17 of the workers or their family members who had contact details listed in the report. Many of them could not be reached or declined to speak, but two families said relatives were still trapped in Cambodia and wanted help.

The documents show both sides of the criminality in the enterprises: the trafficking and detention of foreign workers in Cambodia, and the workers then perpetrating scams against people in their home countries. The documented scams are largely false investments that show the illusion of large profits, pushing victims to put in more money and pay repeated fees when they try and fail to cash out.

Conversations Inside

Hieu writes that he received an “urgent message” from a Vietnamese national trapped inside Cambodia in late June last year. The man had been lured by a job-ad promising high salaries across the border in Cambodia, he told Hieu, providing GPS locations, a link to the ad and photos of the Cambodian compound — Moc Bai casino in Bavet city.

As the man gathered information for Hieu, he secretly recorded a meeting inside the operation, which called itself Vant6, and provided access to archived messages from Telegram group chats that were used both internally and for perpetrating scams.

“And he’s very cooperative with me, he is also willing for me to inject a backdoor to the computer which he is working on, so I can monitor and gather all the data needed for further investigations,” Hieu writes in his report, showing the administrative pages of a fake investment platform he infiltrated.

The trove of Telegram chat archives from inside Vant6 — an estimated 14,000 messages — shows scammers actively pursuing targets in Vietnam to invest in fake financial products, and also contains explanations and warnings about runaway workers.

“Thank you everyone for helping me make a fake bill. Hahaha got scammed? Only the people who make the fake bill know,” one user writes in an internal chat just after 11 p.m. in late June 2021, apparently celebrating a successful scam.

A couple hours later, at nearly 2 a.m., another user, Ruby, who appears to be a member of the management for sending regular announcements about day-to-day operations, writes a message of a different tone. “Everyone, don’t worry. Now Mr. Hoang was locked for two weeks and now he has been sent back to Vietnam. Nobody fought him. Just wanted to sanction him for trying to run away. The company has its own rules. If everyone follows the correct thing, this story doesn’t happen. My husband said this. I was just worried that everyone was concerned about him, so I came to send this message,” Ruby says.

A worker responds with some concern. “The company is a man, not a dog. It is not mindless… It shouldn’t just punish and throw them away,” the worker says.

But Ruby continues to downplay the incident. “This time when he was chased, the beating didn’t result in bleeding.”

The Workings of a Scam

Vant6’s active scam at the time was to lure Vietnamese nationals into fake investment platforms, which scammers describe as games, the documents show.

Scammers work in groups, bringing victims into dedicated group chats that pursue investments led by a “teacher.”

“Hello everyone to this group of investors,” begins one group chat, named “The Key to Success 2021.”

“[I’m a] new member,” someone replies. “Me too,” says another.

“Everybody did you eat rice,” a third user asks. “I’m also a new member, hello everybody,” says a fourth.

The “teacher” then explains that the earnings of everyone’s investments will be announced three times a day, at 3:30, 7:30 and 9:30 p.m.

“From tomorrow onward,” the teacher says.

The next day, as 3:30 p.m. rolls around, the teacher posts a series of graphs of rising investments.

“Everyone calculate,” the teacher says, followed by 31 replies from users about the gains they are seeing in their accounts.

The pattern continues for several days, a routine in which the group chat’s participants boast of expanding wealth in the Vant6 investment platform.

In mid-July, one user pipes up about cashing some of the money that has accrued. “The second and third time withdrawing, it must be over 5 million right,” the user says — a remark that points at one of the scam’s primary mechanisms for cheating people out of money as revealed in other documents.

A set of messages, which Hieu describes as instructions sent to new workers, outlines two options for finding customers: creating fake social media accounts to chat directly with people about making easy money, or posting online advertisements to get people to join fake social media groups where they will be encouraged to invest. The latter can find more people, but nets little in revenue, the messages say.

The general scam is explained: People make a small investment, and receive an initial return. They are then pushed to invest more money and are shown an illusion of massive gains online, but they must make further payments to withdraw their earnings.

“After getting all the money, abandon them,” a message says, calling the scammed investors variously “customers” and “players.” “If the customer has no ability to play anymore, drop them.”

The messages also describe investment group-chats being planted mostly with scammers among a handful of scam victims. “To build confidence with the clients, persuade them to join our groups,” one message says. The scammers are to flaunt their earnings and project an archetypical appearance of a successful person in their social media profiles such as using a profile picture of them wearing a suit, and entice victims to put in more money.

Scam Victims

In the internal Telegram chat, scam workers share screenshots of conversations with scam victims.

One conversation shows a victim being locked out of their account after depositing 20 million dong, or about $850. The platform tells them they have earned 300 million dong, about $13,000, through the investment, but they can’t access it.

The victim is told they will have to pay a fee to withdraw the money. Sounding desperate, the victim says yes.

Another conversation has a scam victim asking the “teacher” about fees.

“Teacher, are there any other fees apart from this 5% fee so the money can be sent to my account?” the victim says.

“No, this is the final fee. Do you think I will cheat you, while you and I have come together this far?” the teacher says.

Emotional manipulation continues in several of the conversations, with one telling a victim that they are in love and should live together — even as the victim realizes their loss.

“You go and scam one person after the next, you are all hypocrites, god has eyes, soon or later the law will intervene,” a victim says.

“Love you,” a scammer replies.

“You love me but you hurt me to a point where I have no pants to wear,” the victim says with hyperbole.

Desperation grows among some of the victims. One sends a photo of a bicycle saying that is all they have left after pawning their household registration book.

“I’m telling you I’m almost dying,” another says. “My spirit will not spare you… you scam me, you take one dong from me then you will vomit a lot of blood. I will not only haunt you I will also haunt your family. You scam me. You read this entire chat history from the beginning. I will not say much more with you. You have to take the consequences. Now every night you will see me. You watch out.”

But in the group chat, the scammers try to brush off the desperation.

“What day is it today that customers curse at us so much,” one says.

“Endure it. Saturday there will be beef to eat so we have more blood [energy] to continue to listen,” another says. “[The clients] curse me very convincingly but I will not fucking listen.”

At one point, a user tells workers to stop messing around in the group chat and focus on sending “bills” worth over 100 million dong, or about $4,000.

Trafficking Victims

Last month, a father in Vietnam spoke about his son being forced to work scams in a Cambodian compound. The son had contacted Hieu, the researcher, for help last year. The father said his son was still entrapped despite reaching out to Vietnamese authorities for help.

“My son said he was beaten once or twice. There were times when people staying in the same room with him were electrocuted,” the father told VOD. Names are being withheld for potential trafficking victims.

The son was recruited online to work at a casino, and didn’t need to fill out any paperwork before going to the Cambodian border early last year, the father said.

When the son arrived, roommates cried to him saying that he had been cheated. He would be placed under constant supervision and made to work scams, the father said.

“Sometimes they let him out to hang out on the pavement, but most of the time he stays in the room where there are guards.”

The story echoes many accounts given by foreign workers who have faced detention and debt slavery in Cambodia. Many, including some underage trafficking victims, say they were trapped in compounds and forced to work.

“I tell people in my village to not trust anybody on Facebook,” the father said.

The trafficking of Vietnamese nationals to Cambodian compounds has also caught the attention of Vietnamese authorities. On Tuesday, the government used their official Facebook page to warn their citizens about job advertisements on social media about “light work, high salaries” in Cambodia, a common phrase often seen in dubious recruitment posts. It also says the victims’ ages range from 18-35 and they are forced to work 12-16 hours a day. Some families are asked to pay between $3,000 to $30,000 to save the victims, Vietnamese authorities said.

In the first six months this year, Cambodian and Vietnamese authorities rescued 250 Vietnamese people from these scam operations, but the statement noted that the trafficking and exploitation of Vietnamese citizens in Cambodia still continues. 

Last week, seven Vietnamese nationals were arrested in Vietnam’s southern Dong Nai province for brokering illegal migration to Cambodia for 200 Vietnamese people. A source at an anti-trafficking organization in Vietnam who has been briefed by Vietnamese police said both traffickers and victims come from different provinces in Vietnam. This corresponds with the hometowns of victims’ IDs that scammers shared in their Telegram group chats.

Hieu, the researcher, also shared his interactions with trafficking victims. Like many foreign workers whom VOD has spoken to, one man wanted to provide information and find a way out, but was fearful of what might happen to him if the operation found out.

“I have to go back. If security knows I will be punished,” the victim tells the researcher in a message. “I will die.”

The man sends photos from inside an office-like area, as well as views from windows — clearly showing the KB, or Kaibo, area of Sihanoukville’s Chinatown. He also sends a GPS location in the KB block of buildings.

“Delete conversations. If careless, I die,” he says, as the researcher sets up fake social media accounts for them to continue their conversation.

In a voice call, the man says there are around 95 people in his dorm, with Vietnamese accents from all parts of the country. He has been told that if he does not work well, he will be sold off.

“I’m not allowed to go out,” the man says, as Hieu replies that the trafficking needs to be stamped out.

“We must save our Vietnamese people,” Hieu says. “We care about saving Vietnamese people in the casinos.”

“I believe and hope that prompt intervention is needed because thousands of victims are suffering,” he writes in his report.

Duality

Hieu told VOD on Wednesday that the scam operations had not changed much since he last updated the report.

“The situation is just getting worse and worse, day by day,” Hieu said. “More and more victims are being lured to Cambodia.”

He added that the report was done for his agency, Vietnam’s National Cyber Security Center, which had taken the situation seriously and was trying to rescue people.

“However, it’s really difficult since those dangerous places in Cambodia are being controlled by Chinese [criminals],” he said, adding that he hoped more media attention would help to free trafficking victims and eliminate Cambodian scam operations.

Other documents compiled by Hieu in his report include bank information, IP addresses and records of scam calls:

• Screenshots of financial transactions, and workers’ logs of attempts to contact thousands of Vietnamese phone numbers.
• More than 50 Vietnamese bank account details allegedly linked to the operations.
• Job ads and a recorded conversation of attempted recruitment, in which an agent promises transport to Cambodia, meals, accommodation, salaries and benefits.
• Over a dozen videos and images of violence obtained from social media.

Among them, the 580-megabyte archive of Telegram chats portrays the duality of the Cambodian scams and detention.

Workers complain about someone not flushing the toilet, and assign a toilet team leader. One user ribs two men for snoring. A special dinner order for 120 people — crab hotpot, lotus salad with shrimp and pork, stir-fried snails with butter, beer-steamed shrimp, and jelly for dessert — runs up a bill of $2,500, according to “Ruby.”

Then a man with the user name Tony sends a photo of a woman alongside a voice message that says she has left the company and is now speaking out about being punished by the company. Tony explains that she was caught using drugs and that’s why she was not allowed to continue working.

He then asks everyone in the group chat to use fake accounts on social media to share the image of her, which appears to show her holding a small packet of cocaine.

Others in the group chat, following Tony, share pictures of her passport and ID card, and make mocking memes using her photo.

Clarification: An additional introductory paragraph was added to this article linking to VOD’s ongoing investigation into debt slavery at scam compounds.