How Scammers Chose Their Targets: The Instructions in the Filing

Key facts

The case

Most reporting about fraud describes what the messages said. This filing describes something else: what the operation told its own staff to do.

In October 2025, United States prosecutors filed an indictment in the Eastern District of New York against the chairman of a Cambodian conglomerate, alleging that the group built and operated scam compounds staffed with trafficked workers. Part one of this series covered that: the buildings, the high walls, the people who answered a job advert and could not leave, and the forfeiture action the Justice Department calls the largest in its history.

This part is narrower and, in one specific way, stranger. The same filing quotes the group’s own internal documents. Not messages sent to victims — instructions issued to workers. And read in order, those instructions describe a conversation being manufactured: the account acquired first, the room assigned second, the tone specified in writing, and the person at the other end reduced to a category before a single word was typed.

An indictment is merely an allegation. All defendants are presumed innocent. What follows is what the government says its evidence shows, and every factual claim below is attributed to a numbered paragraph of that document.

The account existed before the conversation

Prosecutors allege the compounds were designed — that is the filing’s word, designed — to maximise profits, and that the people running them personally ensured each site had the infrastructure to reach as many victims as possible.

Infrastructure is an odd word to attach to a friendship. It becomes less odd when you see what it was made of.

In or about 2018, according to paragraph 33, one of the co-conspirators was involved in procuring millions of mobile telephone numbers and account passwords from an illicit online marketplace. Millions of them. Not taken one at a time from people who had been selected, but bought in bulk, from a market that exists to sell them, years before any of those identities said a word to anyone.

Put the sequence in order, because the order is the whole thing. The account that eventually messages somebody was not created by a person who had chosen them. It was acquired earlier, in a batch, by somebody who had never heard of them and never would. The account came first. The target came second. The conversation came last — and by then the expensive part was already done.

That changes what a first message actually is. It is not somebody reaching out. It is a piece of inventory being allocated.

It also explains something that never quite made sense about these openings. People often report that the first message was strange: a name that was not theirs, a plan they had never made, a photograph of a meal in a city they had never visited. The usual reading is carelessness — a scammer who did not do his homework. The filing suggests something duller and worse. There was no homework to do, because at that moment nobody had looked you up. The account was simply switched on and pointed somewhere.

Twelve hundred and fifty phones

The indictment says the chairman himself maintained documents describing and depicting what it calls phone farms — automated call centres. And it says those documents detailed the completion of two particular facilities.

Between them: 1,250 mobile phones, controlling 76,000 accounts on a single social media platform.

Those two figures belong in the same sentence of the same paragraph, and they are worth holding separately from the bulk purchase above. The millions of numbers and passwords were bought in 2018, from an outside marketplace. The 1,250 phones and 76,000 accounts describe two facilities the documents say were completed. Adding them together produces a number the filing does not support, and it is the most common error in coverage of this case.

Divide one of those figures into the other and you land on roughly sixty-one accounts for every handset. That arithmetic is ours, not the Justice Department’s — but both numbers are theirs.

Sixty-one identities, running on one phone, on one shelf, in one room. None of them people.

And this is the part that is genuinely hard to hold. The message that felt like an accident — the wrong number, the misdirected hello, the one that made somebody smile and reply out of politeness — was not typed by a person who made a mistake. It was produced by a room, on equipment bought for the purpose, using an identity that had been sitting in stock.

Note the word the filing uses about those two facilities: completed. That is a word you use about construction, not about crime. Completed implies a plan, a budget, and somebody signing off at the end. Nobody completes two facilities by accident, and nobody completes them alone. Somewhere there was a decision that two was the right number, a person who made it, and a day when the second one was finished and reported as finished.

That is what separates this from what most people picture when they hear the word scam. Almost nothing about it was improvised.

What the instructions actually said

Paragraph 34 is the centre of this piece, and it is worth being exact about, because it would be easy to overstate.

Prosecutors describe additional internal documents belonging to the group. They say those documents included instructions on building rapport with victims. They say they included guidance on how to register social media accounts in bulk. And they say they included a direction to use profile photos of women who were not — this is the phrase that appears in the filing — too beautiful, so that the accounts would appear genuine.

Somebody sat down and thought about the face. Somebody worked out that a striking face invites questions and an ordinary face does not. Somebody concluded the operation would perform better with plainer photographs. And then somebody wrote it down as an instruction, so that other people would do it the same way, in rooms they would never visit, to people they would never meet.

The face that was shown to you was chosen to survive your judgement of it. It is the same economy of appearances that turns up when a stolen face is rented to sell things — the photograph does the work the words cannot.

That inverts the advice most of us have been given. The familiar warning is to distrust the profile that looks too good — the model’s photograph, the impossible holiday, the watch, the celebrity crypto giveaway deepfake. Prosecutors allege the internal guidance said the opposite, and said it in writing, because ordinary reads as real and real is what converts.

One line drawn deliberately in front of you rather than behind you: we are not going to explain how the bulk registration worked. That part is described in the filing and it is staying there. This site exists to make fraud easier to recognise, never easier to run. What matters is not the technique. It is that a technique existed in writing, and that somebody was expected to follow it — which tells you the person typing was not the author of the conversation. They were performing one.

The operation had a word for that performance. Paragraph 20 gives it, and translates it: jingliao, or scripted chat. The indictment notes the term was commonly associated with cryptocurrency investment fraud schemes. By the time you have read the ledger, it stops sounding like jargon and starts sounding like a job description.

The ledger, and the column that is not there

Part one of this series ended by promising you one more column in that ledger: the one recording what each floor was supposed to earn.

We went looking for it. It is not there.

The ledger itself is real and it is in the filing — prosecutors say the chairman saved it, and the indictment reproduces the page. But it has two columns, not three. On the left, a room code. On the right, the kind of fraud that room was responsible for.

A2001. Vietnamese order fraud. B2004. Taiwanese scripted chat. B3004. Russian order fraud. B3005. Chinese brush order. And it keeps going: B2001, European and American market. B2002, Chinese scripted chat. B2005, Vietnamese loans. B2008, Chinese stocks. Then a whole floor of C rooms — C1001, C1005, C1006, C1007 — running the same categories again, for the same set of countries.

Read the left-hand column on its own and it is an office directory: room numbers, in order, floor by floor. Read the right-hand column on its own and it is a list of places on a map.

So the ledger was not measuring what each floor earned. It was recording who each floor was going to rob.

We are saying this plainly rather than quietly dropping the earlier promise, because a correction is worth more than a tidy story. And what the paragraph actually describes is better than what was promised: a building organised by nationality. Not by product. Not by shift, not by team, not by performance. By where the person at the other end of the message happened to have been born.

One ledger, from one park, described in one paragraph, in a case that has not been tried. Held at that weight, it still means that before the first word arrived on anybody’s phone, a decision had already been made about them. Not about who they were — nobody in that building knew who they were. About where they were.

The number, and its three warnings

The filing gives one figure for what the operation produced, and it needs three warnings attached, because numbers like it travel without them.

It is a boast, from a co-conspirator, not an audit. It is about the entire group, not one floor or one room. And it refers to 2018, not to now.

With all three in place: in the summer of 2022, prosecutors say, one of the co-conspirators boasted that back in 2018 the group had been earning over $30 million a day from these schemes and related illicit activity.

Here is the detail that stops that from being the end of the story. 2018 is also the year the phone numbers were bought, in that same period. So the figure describes the operation as it was before most of what this piece has been describing existed. And the indictment says that in or about 2019, a co-conspirator helped oversee construction of a further compound. A year after that number, they were still building.

Whatever $30 million a day was, it was not a ceiling. It was a stage.

The other ledger

The ledger on the floors sorted rooms by the nationality of the people those rooms were going to take money from. The filing describes a second set of records, and it sorted a different group entirely.

Prosecutors allege the same man who saved the room ledger also maintained ledgers of bribes to public officials, tracking hundreds of millions of dollars in reimbursements to associates. We are not going into that side of the case here — it belongs to a later part of this series, and it involves allegations of corruption and violence that deserve their own treatment.

But the pair is worth seeing, because it says something the individual numbers do not. This story has two filing systems, sorting people in opposite directions. Downstairs, people were sorted by what could be taken from them. Upstairs, people were sorted by what could usefully be given to them. Both are just paperwork. Both were kept by the same administration, in the same organisation, as ordinary records of ordinary work.

That is the quiet argument running underneath this entire filing, and it is the reason the phrase “scam compound” undersells it. A compound is a place. What the documents describe is a company: procurement, construction, staffing, standards, categories, targets and accounts payable. The conversation on somebody’s phone was the retail end of it.

What this actually changes

It changes the advice, and not in the direction most people expect.

The standard warning is to watch for the too-perfect profile — the model-grade photograph, the life that looks staged, the watch. On the account of this filing, that warning is upside down. The internal guidance is alleged to have said the opposite, deliberately, so the account would read as real.

Which means judging the person cannot protect you. The person was designed to pass that exact test, by someone who had thought about the test in advance and written down the answer.

There is a second consequence, and it is the one that matters for how anybody talks to a victim afterwards. If the account was acquired in bulk before anybody had been chosen, if the room was assigned by country before a name existed, and if the warmth was produced from written guidance, then nothing about being targeted was a judgement of the person targeted. There was no assessment. There was allocation. People who lose money to this are frequently told, gently or otherwise, that they should have seen it — and this document is the strongest evidence yet that seeing it was never the test they were actually given.

How it works, step by step

This is the shape the filing describes, from the operation’s side rather than yours. It is here so that the sequence is recognisable, not repeatable.

1. The identity is acquired first. Prosecutors allege numbers and account passwords were bought in bulk from an illicit marketplace, years before use. Nobody chose you at this stage. Nobody had heard of you.
2. The account is made to look ordinary. Internal guidance is alleged to have specified profile photographs that would not attract attention — the “not too beautiful” direction — so that the account would read as a person rather than as bait.
3. The room is assigned by nationality. The ledger in the filing lists a room code against the kind of fraud that room ran, by the market it was aimed at. Your country was decided before your name existed to anyone.
4. The conversation follows written guidance. Prosecutors allege documents on building rapport with victims existed and were expected to be followed. The warmth is the product; the person typing is executing it.
5. The ask arrives late, and it arrives as an opportunity. In this category the destination is an investment, run the way a pig butchering scam is run: a screen that shows a balance climbing, and a payment that must be made before anything can be withdrawn.

The reason step 5 works is steps 1 to 4. By the time money is mentioned, the relationship has done weeks of the work.

How to spot it

The uncomfortable finding of this filing is that the usual visual checks were anticipated. So the tests below deliberately ignore the face.

• Judge the ask, not the person. However long it has been, whatever has been shared, an introduction to an investment from someone you have never met in person is the signal. It does not become safer because the person seems ordinary — ordinary was the specification.
• Treat the accidental opening as a category, not an accident. A wrong number, a misdirected greeting, a message meant for someone else: this is a recognised way to start a conversation, and it costs the sender nothing when it fails.
• Watch for the move off the platform. Early pressure to continue somewhere else removes whatever reporting and pattern-detection the first platform had.
• Notice a profile that is plausible rather than impressive. The old advice was to distrust the too-perfect account. Keep it, but stop relying on it.
• A balance on a screen is not money. It is a display, and somebody else types the numbers into it. The test is withdrawal, not the figure.
• Any fee required before you can take out your own funds is the scam, not the solution. This is the last stage of the pattern, and it is the one that turns a loss into a bigger one.

What to do if it already happened

In order of urgency, because the first hours decide how much is recoverable.

1. Stop paying. Especially any payment presented as the way to release funds you can see on a screen.
2. Call your bank or card issuer now, using the number printed on your own card. Card payments can sometimes be charged back and transfers occasionally recalled if the receiving account has not yet emptied. This is the only step with a clock measured in hours.
3. Report it. In the United States: ic3.gov, the FBI’s Internet Crime Complaint Center, and ReportFraud.ftc.gov, the FTC’s consumer intake. In the United Kingdom: Action Fraud. Neither returns money directly, and both need the transaction details. Reports are the raw material of cases like this one.
4. Preserve the record before it disappears. Screenshot the profile, the conversation, the platform balance and every transaction ID. Accounts vanish when an operation rotates them.
5. Refuse the second approach. Victim lists are traded, and the follow-up arrives as a recovery service offering to trace your funds for a fee. Nobody who charges you upfront is going to recover anything.

How to not be next

One rule survives every version of this, and it is the only one that does not depend on judging a stranger correctly: never send money to someone you have not met in person. Not after a week of messages, not after three months, not when the balance on the screen is climbing, and not when one last fee stands between somebody and their own money.

Two smaller habits make that rule easier to keep. Agree a question with your family that only they could answer, and use it whenever money or urgency appears in a message — it is the same defence that works against an AI voice clone family emergency call. And treat any investment introduced by someone you met online as belonging to that person, not to you — the moment it cannot be withdrawn on demand, it is not yours.

The people who lose money to this are not careless. They are talking to something that was built, tested and written down, by people who never met them and never intended to.

Watch the full documentary

The full case, with the ledger and the instructions read out from the filing, is in the video at the top of this page — watch it here. Part one, on the compounds and the forfeiture, is linked below.