Scam Inc has a new weapon

Ambar Nigrum, 52, works as an accountant for charities in Yogyakarta, Indonesia. Last year she received a message from someone claiming to work for the country’s tax office, asking her to update her details. She followed a link and downloaded an app that imitated a government one used for paying taxes. Ms Nigrum (not her real name) did not realise the software was capturing her thumbprint. It also gained access to her bank accounts, phone camera, photographs, microphone, contacts and notes. By the time a friend warned her it was a scam, more than 450m rupiah ($26,500) belonging to the charities had been stolen—enough to cover the salaries of ten staff for a year.

Online fraudsters have long caused misery from compounds in poorer parts of South-East Asia. They have relied mostly on low-tech, labour-intensive tricks: investment cons and romance scams that require victims to be groomed over weeks or months before they are robbed. Now investigators find that these gangs are turning to much more sophisticated types of cyber-crime. Criminals who manage to steal a victim’s phone contacts using spyware can target everyone in their network. “It’s a much faster-moving attack than a traditional scam,” says Jeremy Douglas of the United Nations Office on Drugs and Crime. “There’s potential for millions of devices to be infected.”

The spyware used in the attack on Ms Nigrum was detected by Infoblox, a security firm, and appears to have been in operation since at least 2023. It seems to have been used on targets in more than 20 countries, including by people working from a notorious scammers’ compound in Cambodia. The criminals are not building this kind of technology themselves. Instead they appear to be buying it from Chinese-speaking vendors who do business over messaging sites such as Telegram.

South-East Asia’s scammers are part of an internet fraud industry that generates more than $500bn a year, on a par with the illegal-drugs trade. Their compounds are commonly found in industrial districts in countries such as Cambodia and Myanmar. They are often protected by high walls, security cameras, barbed wire and armed guards. The United Nations estimates that the leaders of these gangs have forced hundreds of thousands of people to work for them. As well as impersonating Indonesian tax officials, criminals have posed as immigration officers in South Korea, police in South Africa and staff at India’s Supreme Court.

That fraudsters are adopting increasingly sophisticated techniques suggests the scam business could become more disruptive yet. Infoblox has found evidence that scammers are experimenting with AI chatbots and deepfake voice tools, and are testing ways to evade facial-recognition systems. Coming generations of malware may prove harder to detect than the old sort—and even more convincing. ■