Six in the Evening, Dubai Time

The case

“6PM-6AM Dubai time.” Six in the evening to six in the morning: that is how a member of one team described the hours for what he called the “US market”. The line is quoted in a sworn statement by an FBI agent, filed in federal court in San Diego in April 2026. On the U.S. East Coast, the agent writes, that is eight in the morning to eight at night. A night shift in Dubai is the working day of the person on the other end of the phone.

On 29 April 2026 the U.S. Justice Department announced what it called unprecedented cooperation between the FBI, the Dubai Police and the Chinese Ministry of Public Security: at least 276 people arrested and at least nine scam centers dismantled, all used for cryptocurrency investment fraud. The same day, three court documents were unsealed in the Southern District of California. Four of the people arrested in the operation were charged there, the Justice Department said on 29 April.

This article reads those documents: an 8-page indictment and two criminal complaints of 37 and 29 pages, each built on an FBI agent’s sworn statement. They say far more than the announcement did: how the shift was organised, who was hired, the paragraph pasted to three victims, and the fee that appears at every withdrawal.

None of it has been proven in court: it is what prosecutors allege, and the Justice Department says the defendants are innocent unless and until proven guilty. No defendant or victim is named here; companies are, because they are the method.

Are there scam centers in Dubai?

Yes, and the FBI says so in writing. Both complaints contain the same sentence: “Since at least 2021, numerous scam centers perpetrating CIF have operated out of the United Arab Emirates (UAE), many of which are part of, or have connections to, scam companies headquartered in Southeast Asia.” CIF is the agent’s shorthand for cryptocurrency investment fraud.

The two complaints are about two of those companies. The first, which the Justice Department calls Sanduo Group, operated from what the agent describes as a scam center in the Al Khawaneej 2 neighbourhood of Dubai. The second, Giant Company, operated from Ajman, which the agent describes as near Dubai. The Justice Department names a third, Ko Thet Company, and puts the word “companies” in quotation marks itself.

The documents date the conspiracies from “at least since 2022” (Sanduo) to “at least since 2024” (the indictment). The targets were residents of the United States and, the indictment adds, Canada.

How it works, step by step — the night shift

The schedule

The Sanduo complaint quotes the schedule directly: “do US market we do 6PM-6AM Dubai time”. Another team, the agent writes, targeted the Europe market and worked “2PM-2AM Dubai time.” The East Coast conversion is the agent’s; by our arithmetic it is off by an hour or two depending on the season, but the shift is plainly built around American daylight.

When a manager was told a model did not want to work nights, the answer was: “We work night shift now.”

The job title “model”

“Model” is a job in these papers. The Sanduo complaint says scam centers like this one hire people who “can engage in phone or video calls, and provide pictures of themselves” to victims. Then the agent adds the sentence that matters most for anyone reading this: in his experience, “engaging in these phone or video calls was a major reason why those victims had a hard time identifying the communications as a scam.”

One chat sums it up: “like video call the clients and send real pics?” — “yes sister […]”

The pay sheet

The house kept a document with a title: “SANDUO AMERICA AND EUROPE MARKET”. The complaint reproduces it as an image on page 12. It sets out a base salary for employees, an unpaid seven-day internship, and a commission that, the agent writes, “is based off deposits of the cryptocurrency Tether (USDT)” — the money victims put in.

One line on that sheet explains how every story in these papers ends. It comes further down.

The recruiting

The complaint quotes a job advertisement from May 2023. Age maximum 35. “Can communicate with fluent English and Mandarin.” “Live in a private villa.” “Private cheff.” “Visa tickets are covered by the company.” The Treasury describes the same demand in Southeast Asia: operators “specifically look to recruit individuals with English language skills to target American victims.”

One recruiter wrote, in the FBI’s translation from Indonesian, that he had been told to go to the Sanduo Center — “But I need to find 6 people first.” Other messages are blunter: “come to dubai”, “be a scam too”.

What they called it

Inside their own chats, nobody in these papers pretends. Asked “what’s your work there sister?”, one member answered: “Scam hahaha”. Another wrote, in the FBI’s translation: “The scam is in Dubai .. Here, I scam US people.” A third worried about the future: “My CV is all filled with scam companies, what should I do?”

Those messages were read under court warrants on Facebook and Instagram accounts.

What does it look like from the victim’s side?

A message that seems to be a mistake

The indictment lists the doors: “dating applications, social media, such as Facebook and Instagram, telephone, and messaging applications, such as WhatsApp”. Both complaints add the classic opening: “seemingly misdirected text messages” — the wrong-number text.

The profile uses someone else’s face. The indictment says the conspirators “used fake personae, including by using photos of models”. In the Giant Company case the agent is more specific: the photos sent to victims were not of the person typing, “and may not even be of the same woman.”

The agent names the scheme: “pig-butchering,” a term derived from the Chinese-language word “sha zhu pan”, because the scammers “concoct elaborate stories to ‘fatten up’ their victims.” Our pig butchering explainer covers the scheme in general.

Then, a romance — or two

In the Sanduo complaint, one victim is called “husband”, with talk of a future marriage. With another, the two “discussed how they plan to raise their children.” That complaint calls every victim “he”, “regardless of their gender”, to protect their anonymity; so does this article.

The same paragraph, three times

This is the part that should change how you read your own messages. The Giant Company complaint follows three victims. The investment talk began after about five days of messaging with one, about two weeks with another, about six days with the third. And each received the same paragraph, word for word:

“Okay so as you can see these are the currency pairs that we choose to trade…”

The agent calls it what it is: “the similar messages and explanations given to all three victims are the result of [the accused] utilizing a script.” And he adds that “scammers often utilize scripts provided to them by their managers.” It is not a person falling for you. It is a procedure, and our piece on how scammers choose their victims shows the same pattern in another case.

A trading site that is two buttons

The “platform” is almost nothing. The Giant Company complaint describes buttons marked “Buy Up” and “Buy Down”, with timed trades of 30, 60 or 120 seconds, and explains why: the scammers “use a simplified trading interface … to make the trades easy for victims to follow.” One victim received a screenshot with a circle drawn around the Trades button and an arrow pointing to it.

The sites are clones. In the Sanduo complaint, one platform “shares the same layout as” another, “merely changing the title in the top left corner.” In the Giant Company case, the agent found a screenshot of the team’s group chat with the current fake site — Trustbase.vip — pinned at the top, and explains why: they pin “their current malicious investment platform” so employees know where to direct victims, and they “cycle through platforms often to avoid negative online reviews and detection from law enforcement.” Our article on why the scam app has a different name follows the same trick from the name on the screen.

The ones who don’t invest

Meanwhile, in the team’s chats, translated by the FBI from Indonesian: “The scam alert is still high.” “Take it to Canada.” And: “I haven’t met any stupid people yet.” In the Sanduo complaint, a victim who would not invest is written off as “a man who doesnt hit my standard”.

Where the money goes

Three boxes

Both complaints draw the route. The diagram in the Sanduo complaint has three steps: the victim wires money from his bank account to his own new account at a real cryptocurrency exchange; from there, the victim transfers cryptocurrency to the fake investment platform; and at that point, in the diagram’s words, “Victim funds are now under the complete control of criminals.” After that, the agent writes, the funds are “passed through a series of cryptocurrency addresses” as the conspirators try to launder them.

Victims were told to move money “a little at a time to avoid the limits set by cryptocurrency exchanges.”

One victim, from the first win to the last demand

The Sanduo complaint follows one victim through the whole arc.

First, a win. He was told he had made a profit of 1,012 USDT.

The next day, a loan. He was advised to take out a personal loan to put more money in — and coached on the form: “just put bigger babe, like 95k so they will give you good offer”, and for the purpose, “you can put Large Purchase.” He was approved for $29,300, with a $2,000 fee. The reply: “That’s okay babe, just take first my Love.” With another victim, the instruction was “Make it 85k baby your annual income […]” — and a loan of $13,000 was suggested to cover a deposit of less than $11,000.

Then, the exchange warned him. He passed the warning from Coinbase to his contact. The answer: Coinbase “always issues warnings to all Coinbase accounts.” The next day he sent another screen — “Crypto sends are still disabled now” — and the answer was: “Nothing will happen to you, and you are fine so don’t stop what you are doing babe.”

Then, the screen paid. His balance on the platform climbed to about $2,800,000. That money did not exist. To withdraw, he was told to pay a security deposit of 3% of his balance — roughly $87,000.

And then he did the thing that ends these stories. According to the complaint, he “notified family members and then contacted local authorities.”

A tax, a deposit, a penalty

The names of the fee change; the direction does not.

• In the Sanduo case, another victim was told he needed to pay about $25,000 in taxes, then a security deposit of about $15,000. His total loss: about $73,500.
• In the Giant Company case, a victim paid something the platform called his “NIIT tax”. Then came a message: the payment was seven days late, so there was “a penalty of $100 per day, amounting to $700.” And: “Once the $700 penalty Is paid, we will proceed with processing your withdrawal.” A late fee, on a withdrawal that was never going to be processed.
• Another victim who had put in about $5,600 received an email: before any withdrawal, he had to invest an additional $20,000. He was also told the platform was about to be shut down and he needed to withdraw immediately. The agent notes that this “only caused” him “to grow more suspicious.”

The line on the pay sheet

Here is the line from the Sanduo pay sheet, sitting in parentheses under the heading for monthly commission rewards, just above the 4%, 5% and 6% tiers:

“Cash profit equals to the total deposit minus total withdrawal of the client”

Read it from the victim’s side. Every dollar a victim takes out comes off the house’s profit — so there is always one more fee. The agent describes the same pattern in his own words: “Even when victims procure enough funds to pay these ‘taxes,’ the subjects will continue to concoct new excuses to delay payment and invent new fees for victims to pay.” The FBI’s 2025 IC3 report says the same about the whole category: when victims try to withdraw, “they will be charged taxes and fees as a final attempt to exploit money from the victims.”

Where it ended up

In the Giant Company case, $9,656.44 in USDC left one victim on 2 June 2025. Two days later, the complaint says, the same funds were transferred to an account at the exchange Binance belonging to a member of the team. From that one account, the FBI identified about 27 accounts belonging to U.S. persons. Agents spoke with or read the reports of seven of them: all reported being victims, of “hundreds of thousands of dollars” together.

In the Sanduo case, the agent traced money from at least nine accounts registered to U.S. persons into one manager’s exchange account, and from at least three into another. “The majority of the IP access logs for both of these Binance accounts geolocated to UAE.” The indictment asks the court to forfeit three Binance accounts.

How did the FBI trace a scam center in Dubai?

It started with people who reported it. The Justice Department says FBI agents identified “numerous victims around the United States through complaints filed with the FBI’s Internet Crime Complaint Center (IC3).” Then came the warrants on Facebook and Instagram accounts, and the department says Meta Platforms, the parent company of both, “provided critical information for this investigation.”

In one Giant Company report, the victim said he had lost $65,000; his own screenshots showed sixteen transactions totalling about $97,000. Records are more precise than memory.

Then the operation. The Dubai Police statement, published by the UAE’s state news agency on 29 April, named it Tri-Force Sentinel and described a strike against three criminal syndicates and nine fraud centres behind high-yield investment scams, pig-butchering schemes and virtual currency fraud. “The suspects are mainly from Southeast Asian countries,” it said. The Justice Department says the crackdown was spearheaded by the Dubai Police, and gives the count: 275 arrested by Dubai authorities, and one more by the Royal Thai Police.

Who ran the night shift?

The papers answer in layers. Managers, who, the agent writes, are often the source of the scripts scammers use. Recruiters, like the one who had to find six people first. Team members who did the chatting. Models, paid to be on camera. And above them, the three “companies” the Justice Department names: Ko Thet Company, Sanduo Group and Giant Company.

Six people were charged in San Diego. According to the Justice Department’s announcement, all six are charged with conspiracy to commit wire fraud; the two named in the indictment are also charged with conspiracy to launder money. The maximum penalty for each is 20 years in prison. Four were arrested — three in Dubai, one in Thailand — and two were listed as fugitives when the charges were unsealed. None of them is named here.

The papers do not say that anyone has been convicted, that any defendant is now in the United States, or what happened to the other 272 people arrested. For its own conspiracy, the indictment says only “losses totaling millions of dollars”; for the operation as a whole, the Justice Department says investigators have identified millions of dollars in losses so far.

How much did the victims lose?

The complaints end with tables of victims — just a U.S. state and an amount. The Giant Company table lists 8 reports and more than $475,000. The two Sanduo tables list 10 victims, from $150 to $348,000, and 16 more with a reported amount, from $8,760 to $246,704. By our own count, the three tables add up to about $1.94 million from 34 victims.

That is not the size of the scam. The agent says it “likely represents just a small fraction of U.S. victims”, that “a minority of victims of financial frauds will actually report their incident”, and that because these schemes “often have a romantic angle to them, they can cause victims embarrassment, which makes CIF victims even less likely to file reports.”

The national scale is in the FBI’s 2025 IC3 report: cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025, at $7.2 billion reported. The IC3 received 1,008,597 complaints that year, with $20.877 billion in reported losses, according to the same report (FBI summary: “nearly $21 billion”). The UNODC says people from at least 80 countries have been found in the region’s scam compounds, recruited through transit hubs that include the Middle East.

Were the workers victims too?

Be precise here, because the sources are. The FBI’s annual report says these scams “are largely perpetrated by organized criminal enterprises based in Southeast Asia using victims of human trafficking as forced labor.” The Treasury describes “debt bondage, violence, and the threat of forced prostitution” in Southeast Asian scam centers. And the State Department’s 2025 report on the UAE says: “Traffickers exploit foreign national victims in forced labor in online scam operations in the UAE” — recording one case with 31 traffickers and 76 victims. Our piece on Cambodia’s scam compounds reads one of those cases in detail.

The San Diego papers do not allege that. They describe people recruited with a salary and a commission. And one line in the Sanduo chats, in the FBI’s translation, complicates any simple answer: “If anyone wants to quit, I do too.”

How to spot it

A wrong-number text that turns into a friendship. Counter-test: the complaints list “seemingly misdirected text messages” as the opening. A stranger who keeps talking after “sorry, wrong number” is the pattern.

A video call that seems to settle it. Counter-test: in the Sanduo papers, being on camera was a paid job, and the FBI agent says that, in most cases he has seen, it was a major reason victims did not see the scam. A face on a call proves only that someone was paid to show one.

A trading site with two buttons and a timer, explained in a rehearsed paragraph. Counter-test: ask whether the explanation would fit anyone — in the Giant Company case three victims got it word for word — and search the site’s name yourself. These platforms change names to escape bad reviews.

Being told to ignore your exchange or your bank. Counter-test: if someone says your exchange “warns everyone” and you should not stop, that person is the scam.

Coaching on a loan application. Counter-test: in these papers, the advice to inflate income came from the scammers.

A fee to withdraw your own money — a tax, a deposit, a penalty. Counter-test: the FBI agent’s rule, from the Sanduo complaint: “no legitimate investment platform would require a customer to deposit a security fee in order to withdraw their own funds.”

What to do if it already happened

Stop paying, now. In the agent’s words, paying one fee does not end it; new fees are invented.

Keep every record. Transfer confirmations, exchange statements, screenshots, chat exports. Records are what let agents follow cryptocurrency to an exchange account.

Tell your exchange and your bank. Their warnings are real: in these papers, the exchange warned a victim twice. And they can see where your transfers went.

Report it to the FBI at ic3.gov, typed into the address bar yourself. That is where agents found the victims in this case. The Justice Department says the FBI’s Operation Level Up had notified almost 9,000 victims and saved an estimated $562 million by April 2026 — and the FBI’s 2025 report says 78% of the victims it notified that year did not know they were being scammed.

Tell someone. The victim who stopped in the Sanduo papers told his family first.

Expect a second approach. The FBI warns that victims are also targeted by recovery scams, which claim to help recover lost funds. Our piece on who reviews a petition for remission explains how the official remission process works when the government has seized funds.

How to not be next

The lesson is not about Dubai. It is the shape of the thing on your screen: a night shift awake for your morning, a job called “model” that makes a face on a call worth nothing as proof, a paragraph three strangers received word for word, and a pay sheet on which a withdrawal is, by definition, a loss for the house.

If a platform asks for money before you can take out your own, the conversation is over. That is not the way out of the scam. It is the scam.

Everything here comes from the public record: the Justice Department’s announcement, the Dubai Police statement, the indictment and two complaints unsealed in the Southern District of California, and reports by the FBI, the Treasury, the State Department and the United Nations. No defendant or victim is named, and nothing in the charges has been proven in court.