Cambodia's Scam Compounds: The Ledger That Named the Floors

You have probably seen the aerial footage: high walls, barbed wire, a drone circling a block of buildings while a voice guesses at what is happening inside.

The guessing is no longer necessary. On 14 October 2025 the United States unsealed an indictment in a federal courtroom in Brooklyn, and it describes those buildings from the inside — not from a survivor’s account, but from the operator’s own paperwork. Prosecutors allege that the man who ran them kept records for each one, and that one of those ledgers tracked which fraud was being run out of which building and which floor.

That is the document this article is about. Everything below comes from the court record: the indictment (No. 1:25-cr-00312-RPK, E.D.N.Y.), the civil forfeiture complaint (No. 1:25-cv-05745), and the same-day statements from the U.S. Treasury and the British government. An indictment is merely an allegation. All defendants are presumed innocent.

The case

Almost nobody arrived at those buildings in chains. They answered a job advert.

The indictment puts it in one sentence, and the order of the words carries the whole story: thousands of migrant workers travelled to Cambodia and elsewhere seeking job opportunities and were, prosecutors allege, trafficked and forced to work in scam compounds, often under the threat of violence. The job comes first. It is real enough to leave another job for, real enough to borrow money for, real enough to cross a border for. It becomes something else after arrival.

What they arrived at, according to the government, was a set of buildings with dormitories inside, surrounded by high walls and barbed wire, functioning as forced labour camps. Prosecutors say there were at least ten of them, and they name three: a compound tied to a hotel and casino at Sihanoukville, on the coast; a site called Golden Fortune Science and Technology Park at Chrey Thom; and one called Mango Park, in Kampong Speu province.

They had names the way an industrial estate has names. They also had construction histories. The indictment says the group built and operated them, and names an executive who, in 2019, helped oversee the construction of one. That detail changes how the rest of the case reads. These were not derelict hotels that someone squatted in. Somebody drew the plans, somebody costed them, and somebody decided how high the walls needed to be.

The company that owned them was not hiding either. On paper the Prince Group was a conglomerate — real estate, banking, tourism, logistics, technology, food and drink — with more than 100 registered entities across more than 30 countries. It owned a bank. Its subsidiaries had ordinary names and ordinary business: an estate agency, an entertainment and hospitality group, two property developers. Each of them, prosecutors allege, doing legitimate work, and each available when it was needed to move money that had come from somewhere else.

Hold that number — more than a hundred companies — because it is what turns a compound behind a casino into a building in central London.

What the ledger said

Prosecutors allege that the chairman was directly involved in managing the compounds and maintained records associated with each one. Not summaries. Operating records, of the kind kept by someone who is running something.

Two details in that paragraph do the work.

The first is the vocabulary. The records did not use a code word for the business. According to the indictment, they explicitly referenced sha zhu — pig butchering, the industry’s own term for fattening an animal before slaughter. The man in charge, prosecutors allege, had no euphemism for his own operation.

The second is the granularity. One ledger, the indictment says, tracked the various fraud schemes run from one of those parks, as well as which buildings and floors at the park were responsible for each. Not which team. Which floor. And the schemes were filed by the nationality of the person who was going to be robbed: the listed categories included Vietnamese order fraud, Russian order fraud, and what the records called European and American jingliao — a reference to investment scams.

Consider what kind of document that is. It is not evidence smuggled out by a witness, and it is not a confession. It is a management report. Somebody upstairs wanted to know which floor was performing.

The same paragraph of the indictment describes the machinery. The chairman also kept documents describing what the government calls phone farms — automated call centres. Two particular facilities had been completed, and between them they held 1,250 mobile phones, controlling 76,000 accounts on a popular social media platform. Seventy-six thousand strangers who could message you, sitting on twelve hundred handsets, on two floors of a building with a postal address.

A separate fact in that same paragraph, and it should not be added to the others: in 2018, one of the executives had been buying millions of mobile telephone numbers and account passwords from an illegal marketplace. The accounts were bought before they were used. None of this was improvised.

The compound was not hidden. It was being managed.

How it works, step by step

The indictment lays the method out in four stages. This is the victim-facing shape of it — what happens to the person receiving the message, and why each stage works on people who are not naive.

1. The wrong number. Contact arrives under a false identity, very often as a message that appears to have been sent to you by mistake. It works because it does not ask for anything. There is no link, no offer and no request — only a small social obligation to reply and correct the error. A pitch can be refused. A misdirected message invites politeness.

2. The friendship. Days, sometimes weeks, of ordinary conversation before money is ever mentioned. It works because the length of it is the proof. Nobody believes a stranger who asks for money on day one; almost anybody will listen to a friend of three weeks. On the other side, this is a shift measured in patience — which is why the ledger’s unit is a floor and a month, not a call.

3. The platform. The conversation moves onto an app or site the other side controls, where a small first deposit shows a profit. It works because you can see the number go up, and because you are allowed to withdraw the small amounts early. The screen is not a market. It is a display.

4. The disappearance. The moment for a larger deposit arrives — or a withdrawal is requested and a fee, a tax or a “verification” payment appears in front of it. It works because the extra payment feels like the last step to recover what you already believe you own. There is a word in the records for the conversation that carries all of this: jingliao, scripted chat. Nobody on those floors was improvising. They were reading.

Put a person back at that desk, because the ledger implies one on every line. Someone woke in a dormitory behind a wall, was assigned a floor, and was handed a script written for a stranger in a country they had never been to, in a language that may not have been theirs, and told to be a friend.

The limit

The indictment describes what happened to people on those floors who caused problems, and it is worth reading exactly as written rather than paraphrasing.

An associate messaged the chairman about beating a person who had “caused trouble” at one of the compounds. Prosecutors say he approved of the beating and instructed that the individual not be “beaten to death.” He added: “we must keep an eye on them and not let them run away.”

Read that for what it is. It is not rage. It is administration — a ceiling on damage and a note about retention, written the way a rule for staff is written. The same document describes another occasion on which two people reported missing were found by police inside one of the parks.

Notice what the instruction assumes: that there is value in that person, that they are worth keeping alive and worth keeping.

Where the money goes

There was a second ledger, and it tracked bribes and luxury purchases.

In 2019, prosecutors say, one of the executives bought a yacht worth more than $3 million for a senior official of a foreign government. The chairman is alleged to have bought luxury watches worth millions of dollars for a different official. Elsewhere in the case there are private jets, holiday homes, and a Picasso bought through a New York auction house. About a mining operation used to launder some of the proceeds, the chairman is quoted in the indictment saying that “the profit is considerable because there is no cost.”

No cost. The operating capital was money taken from the people the phones were calling.

Then, in 2020, according to the indictment, one of those officials helped him obtain a diplomatic passport — which he used to travel to the United States in April 2023, while American agencies were already investigating him. He landed, and he left. Sit with the two halves of that: the people inside the buildings could not walk through a gate, and the man who owned the buildings was carrying a document issued by a state, arranged by an official he had allegedly bought watches for.

Prosecutors say the corruption was not incidental to the business. It was part of how it survived — bribes to public officials in more than one country, specifically so that law enforcement would not interrupt the work.

And then the money surfaced, in the two places you would least expect a Cambodian compound to end.

In New York: prosecutors say one of the networks working on the group’s behalf operated out of Brooklyn, moving millions of dollars taken from more than 250 victims in New York and across the country. The compound was in Cambodia. The people who lost the money were not.

In London: many of the group’s companies, British officials said, had been incorporated in the British Virgin Islands. On the same day as the U.S. action, the U.K. froze a £12 million mansion in north London, a £100 million office building in the City of London, and 17 flats. The buildings behind the casino had turned into buildings in London.

One Tuesday

The case had been under construction for about a decade before any of it became public, and then it arrived in a single day.

On 14 October 2025 the indictment was unsealed in Brooklyn. Two counts: wire fraud conspiracy and money laundering conspiracy, carrying up to 40 years. The same day, the U.S. Treasury sanctioned 146 targets connected to the group and formally designated it a transnational criminal organisation, calling it the largest action it had ever taken against cybercriminal networks in Southeast Asia. The same day, U.S. regulators finalised a Section 311 rule cutting a Cambodian financial conglomerate off from the U.S. financial system entirely. The same day, Britain froze the London property. And the same day, prosecutors filed to seize approximately 127,271 bitcoin.

The language officials used was unusually plain for a press conference. The Attorney General and her deputy called it one of the most significant strikes ever made against human trafficking and cyber-enabled fraud. The Assistant Attorney General for National Security described what the group had allegedly built as a criminal enterprise founded on human suffering, running online scams on an industrial scale. Those are prosecutors describing their own case, and they carry the same caveat as everything else here: an allegation, not a verdict.

The work behind it was done by people who mostly do not get named — a drug enforcement division in New York, two separate FBI units, the National Crime Agency in Britain, and a money-laundering team on the Isle of Man.

One day, two governments, 146 sanctions, $15 billion, and a paragraph at the bottom of the press release reminding everyone that an indictment is only an allegation and that the defendant is presumed innocent. Nobody was standing in that courtroom to hear it read.

What the agencies counting these have actually published

Six large figures circle this story and only the first is the loss in this case. Each one belongs to a different body and a different scope, and mixing them is the most common error in coverage of it.

• $15 billion — the value of approximately 127,271 bitcoin the United States moved to seize in the civil forfeiture complaint. The Justice Department calls it the largest forfeiture action in its history. This is a seizure, not a victim-loss tally.
• 146 sanctioned targets — U.S. Treasury, same day, designating the group a transnational criminal organisation in what Treasury called its largest ever action against cybercriminal networks in Southeast Asia. On the same day, U.S. regulators finalised a USA PATRIOT Act Section 311 rule cutting a Cambodian financial conglomerate, the Huione Group, off from the U.S. financial system.
• At least $10 billion, up 66% — what Americans reported losing to Southeast Asian scam operations in 2024 alone, per Treasury. Regional category, not this defendant.
• More than $16.6 billion — total U.S. losses to online investment scams, per Treasury. Broadest of the categories.
• $5.8 billion — losses to cryptocurrency investment fraud reported to the FBI’s IC3 in 2024, cited by the Justice Department. Different agency, different definition, different year.

According to TRM Labs, whose analysis is a private-sector estimate rather than a court filing, the clustered wallets associated with the network handled on the order of $14 billion, and the operation was moving roughly $30 million a day as early as 2018.

How to spot it

Each of these has a counter-test that takes about thirty seconds.

The conversation started by accident. A wrong number, a mis-sent invitation, a reply to a story you never posted. Counter-test: ask yourself who benefits from the mistake. A genuine wrong number ends when you say “wrong number.” This one continues.

The friendship is unusually patient. Weeks of talk with no ask, from someone with time for you at the same hour every day. Counter-test: propose a live video call at short notice. The excuse that follows is the answer.

The investment platform is one you were introduced to. Not one you searched for and chose. Counter-test: search the platform’s exact name plus “withdrawal” and read what comes back from people who are not on it.

The small withdrawal worked. It was allowed to work. Counter-test: try to withdraw everything, not a slice. A platform that permits £200 out and stalls at £2,000 has already told you what it is.

A fee stands between you and your own money. Tax, verification, insurance, “unlocking.” Counter-test: there is no counter-test. No legitimate market charges you an entry fee to remove your own balance. This one is definitional.

The urgency arrives late. Everything is relaxed until a window is closing. Counter-test: say you will decide in 48 hours and watch what happens to the tone.

What to do if it already happened

In order of urgency, because the first hours decide how much is recoverable.

1. Stop paying. Including — especially — any payment presented as the way to release funds you can see on a screen. The fee to unlock the withdrawal is the last stage of the scam, not the first stage of recovery.
2. Call your bank or card issuer now, by the number printed on your own card. Card payments can sometimes be charged back and transfers occasionally recalled if the receiving account has not yet emptied. This is the only step with a clock measured in hours.
3. Report it. In the United States: ic3.gov, the FBI’s Internet Crime Complaint Center, and ReportFraud.ftc.gov, the FTC’s consumer intake. In the United Kingdom: Action Fraud. IC3 is where investigators aggregate wallet addresses and victim accounts across cases — the raw material of forfeiture actions like this one. The FTC feeds enforcement and the public data series. Neither returns money directly, and both need the transaction details.
4. Preserve the record before it is deleted. Screenshot the profile, the chat, the platform balance and every transaction ID. Accounts vanish when a compound rotates them.
5. Refuse the second approach. Victim lists are traded, and the follow-up arrives as a recovery service or an investigator offering to trace your funds for a fee. Nobody who charges you upfront is going to recover anything.

How to not be next

One rule covers most of it: do not send money to someone you have never met in person, no matter how long you have been talking, and no matter how ordinary the request has become.

Two habits underneath it. Keep investing decisions inside institutions you found yourself — a broker you searched for, not a platform introduced to you in a chat. And treat any balance you cannot withdraw in full, today, as a number on a screen rather than money you own.

There is a third thing, and it is not a safety instruction. When one of those accounts messages you — the wrong number that becomes a conversation, the friendly stranger with an investment tip — there is a real chance the person typing is not free to stop. That does not change what you do. It changes what you understand about who is at the other end.

The indictment is meticulous about money. It counts the bitcoin to the single coin. It names the buildings, the floors, the schemes, the yacht, the watches, the passport. It does not say what happened to the thousands of people who were inside those buildings on the day it was unsealed — not because anyone hid it, but because that is not what a forfeiture complaint is for. The seizure is about the $15 billion. The people were the labour that produced it, and the document that finally described their working conditions in detail was written to recover the money.

The man named as chairman has not been arrested. He was at large when the indictment was unsealed, and he remains at large.

Watch the full documentary

The job advert, the ledger that filed fraud by the nationality of the person being robbed, and the instruction that set a ceiling on a beating: watch it here.