Four Callers, One Script

The case

In December 2025, a person in La Jolla — we will say California — began sending money to companies they had never heard of. Over nine weeks there were four wire transfers: $595,000, then $589,000, then $414,000, then $100,369.36. Three different shell companies received them. A shell company, as the affidavit defines it in a footnote, is a corporate entity with no online or physical presence that does not appear to do business beyond moving funds.

Together the four come to about $1.7 million. It began with a phone call about a credit card.

The caller said they were from a bank’s fraud department, and that a card issued in this person’s name had been used to buy firearms — from a real American gun retailer, named. Somewhere in the hour that followed, the person was told that their status could change from “suspect” to “victim” only through full cooperation with the caller. Later, someone posing as a prosecutor explained that a “manual review” of their investment funds was required, and demanded they cash out their 401k.

None of the people on that call improvised any of it. They were reading.

We know because in March 2026 someone walked into a United States government office of their own accord and described where the script came from. They had not been paid and asked for nothing. Between 18 and 25 March, investigators interviewed them. What they described was a compound in the Anlong Veng district of Oddar Meanchey Province, in northern Cambodia, on National Road 67, directly across the street from a large casino — where about twenty people worked twelve-hour shifts reading pages someone else had written, watched to make sure they did not deviate.

They had got there by answering a job advertisement.

How it works, step by step — the four phases

The affidavit sworn on 22 April 2026 sets out the script in order. Each phase is a different institution, and each exists to make the next request sound reasonable.

Phase one — the bank

The caller poses as an employee of a major American bank’s fraud department. The opening fact is specific and alarming: a credit card in your name has been used to purchase firearms, through the website of a named, genuine gun retailer.

Why it works: it is not a request. It is a warning, delivered by the institution you would expect to warn you, about a purchase you certainly did not make. Your first reaction is to help. And the specificity — a real vendor, a real product category — does the work that a vague claim could not.

Phase two — the police

You are transferred to law enforcement, usually the New York Police Department. This voice helps you file a police report and, in filing it, collects personal details. It then asks for a video call, on Microsoft Teams or WhatsApp, to verify your identity.

Why it works: filing a report is the correct instinct, and it is the one moment in the whole sequence where you feel you are doing something right. The video call is the tell almost nobody reads as one: it converts a voice into a face, which makes the operation feel institutional — and it is also why the recruiting advertisements asked for applicants with no visible tattoos, marks or braces, and a preference for fluent American English.

Phase three — the federal agency

Another bank is brought in, and the story widens: your accounts are linked to a money laundering investigation being conducted by Homeland Security Investigations. This phase collects your personal bank account information.

Why it works: the frame has now flipped. In phase one you were a victim of a card fraud. Here you are a subject of a federal investigation, and the line about “suspect” and “victim” lands in this stretch of the call. Everything asked from this point is offered to you as a chance to clear your name.

Phase four — the court

You are transferred to what is described as a court facility, sometimes called the “Supreme Court of New York”. Here you are told you must pay fines to “cooperate” and avoid criminal charges.

🔴 The worker interviewed by investigators did not have access to the script for this phase. Somebody more senior handled it. That detail is worth holding: the part of the operation that actually takes the money was kept off the page that the person in the compound was allowed to read.

Why it works: by now the caller does not have to be persuasive. Forty minutes of escalation has done the persuading. A court is the one institution that can plausibly demand a number that large — and the demand arrives as the way out.

The same script, four different endings

The strongest evidence that this is a document rather than a talent is what happens at the end. The affidavit follows several people, and the shape is identical while the closing move changes to fit whoever is on the line.

A person in Texas was told they were, in fact, the suspect in a money laundering investigation, and that they would be arrested and taken from their family. Three transfers followed in about two weeks — $50,000, then $120,000, then $121,000 — all to the same shell company. The threat was domestic and personal, and the payments were fast.

A person in California got the version described above: a “manual review” of their investments, an order to cash out a 401k, and four wires over nine weeks to three different companies. The threat was procedural, and the money came out of long-term savings.

A person in Utah sent money to two accounts held at different financial institutions in Hong Kong — a reminder that “where the wire went” is often not where anybody involved is.

A person in Illinois was told there was an extradition order sending them to a detention centre in Shanghai for a sentence of up to two years. When they said they did not want to go to China, the caller sent a “bail letter” and asked for $300,000 in cryptocurrency.

Read those four together and the machinery shows. The opening is fixed; the fear is fitted. Arrest for a parent, ruin for a saver, exile for somebody the caller judged would believe it. And the payment instrument changes with the story — wire for a “court fine”, cryptocurrency for “bail” — because the instruction that sounds natural is the one that gets followed.

This is also why “it wouldn’t work on me” is a weak defence. It was not designed to work on everyone. It was designed to be re-run, cheaply, until it works on someone, by people who do not have to be persuasive because the page already is.

Why does the call keep being transferred?

Because each transfer buys authority that the previous voice could not have claimed. A bank’s fraud department cannot credibly ask you to liquidate a retirement account; a court, to someone an hour into the worst phone call of their life, can. The relay is not theatre — it is the mechanism, and it is what separates this from the single fake call that our piece on the fake bank fraud alert describes.

It also solves a problem for the operation. No single caller has to be good at everything. One reads the opening, one reads the police page, one reads the federal agency page, and the phase that asks for the money is handled by someone else entirely. The script is modular because the labour is disposable.

And the monitoring is explicit in the filing: supervisors and project leaders directed and monitored the scamming communications to ensure adherence to the scripts, and failure to comply could result in punishment. The person talking to you is being watched to make sure they do not leave the page.

Who is actually on the other end?

Often someone who cannot hang up.

The worker described in this filing answered an advertisement offering salaries, commissions, travel expenses and meals — posted in a public Telegram channel with 6,564 members, carrying vacancies in customer service, telemarketing and casino work in Malaysia, the Philippines and Cambodia. Some of the listings asked that applicants have no visible tattoos, marks, or braces. The affidavit explains why: the job involves video and telephone calls with victims.

On arrival, compound leaders confiscated identification documents, money and personal belongings, which is how a border becomes a wall. Roughly twenty people worked twelve-hour shifts. Many were foreign nationals recruited under similar false pretences, and some appeared unaware of the true nature of the work before they arrived. Those who failed to comply faced threats and physical abuse. The compound, the affidavit says, has been a place of torture, abuse, and extortion.

The scale is not small, and the affidavit says so with attribution. The United Nations human rights office estimates that criminal gangs hold at least 220,000 people from more than forty countries in scam centres in Cambodia and Myanmar alone. A U.S. government funded study it cites puts around 300,000 people in the trade across the Mekong region, many held in prison-like conditions, and estimates the revenue at more than $12.5 billion a year — which it notes is nearly half of one country’s formal economy.

There is also a number that says how industrial one building can be. Investigators identified two accounts with an American internet provider operating from that location — the accounts that had been asking people about their employment and investment accounts, and steering them onto WhatsApp or Microsoft Teams. The provider then identified at least 35 more accounts conducting similar activity at the same address.

Thirty-seven positions, minimum, in one compound across the road from a casino. The worker’s twelve-hour shift was one desk of many.

None of that makes the person on the phone harmless to you. It does mean that hanging up is not a moral problem, and that the person who profits is not the person speaking. The affidavit is explicit about how this particular account reached investigators: the worker contacted the Department of Justice of their own volition, has not been compensated, and has not asked for any benefits.

Where does the money go after the wire leaves?

Into a route built to be expensive.

Secret Service analysts who specialise in cryptocurrency tracing followed it through token-swapping — converting bitcoin into a dollar-pegged token — and chain-hopping, moving value between blockchains through bridging. The affidavit’s own observation is the useful one: this requires an otherwise unnecessary and costly number of transactions. Nobody does that for efficiency. The cost is the product: each hop buys distance from the wire that started it.

Along the way the funds touched marketplaces that governments had already named — one designated by the United Kingdom’s Foreign, Commonwealth and Development Office in March 2026 as an illicit marketplace, and another that the U.S. Treasury had declared a primary money laundering concern the year before.

One address in the chain was later blocklisted by the token’s issuer at law enforcement’s request. That stops the balance moving. It does not send it home — a distinction we take apart in how stolen crypto gets frozen.

The door, not the wall

The compound cannot be raided by an American court. What can be reached is the advertisement.

On 22 April 2026 a magistrate judge in the District of Columbia authorised the seizure of the recruiting channel itself. The mechanics are mundane and that is the point: the company that operates Telegram is registered in the British Virgin Islands and has generally agreed to accept service of law enforcement process through its web portal, so the warrant is served there; the host then restrains and locks the channel, and a notice is displayed saying it was seized under a warrant issued by that court.

The Justice Department announced it the following day as a first-of-its-kind seizure of a Telegram channel used to recruit people to travel under false promises of high-paying employment — alongside criminal charges against two managers of a compound in Burma, the seizure of 503 fake investment domains, and $701,962,392.15 in cryptocurrency restrained with the stated goal of returning funds to victims. A major American bank, Microsoft and Meta each took internal measures after being told the fraud was running under their names.

A wall keeps people in. A door lets them be brought in, and a door has an address.

How to spot it

Each of these takes under a minute, and none of them is done on the call you are suspicious of.

The call gets transferred to another agency. Counter-test: hang up. Then call the institution back on a number you looked up yourself — from the back of your card, or the agency’s public site. Real institutions never mind. The relay only survives if the line stays open.

Someone says you are a suspect, and that cooperating will fix it. Counter-test: no counter-test needed. No investigator anywhere offers to reclassify you in exchange for compliance. That sentence is the script announcing itself.

A request for a video call to “verify your identity”. Counter-test: no bank, police force or federal agency verifies identity by video call with a stranger who phoned you.

Any instruction to cash out a retirement account, or to move money to “protect” it. Counter-test: stop there. This is the single instruction most reliably associated with a total loss.

A payment to resolve a legal matter — fines, bail, a bond. Counter-test: courts do not take payments over the phone from people they have just called, and no American court resolves a criminal exposure by wire to a company you have never heard of.

The caller cannot leave the path. Counter-test: ask something ordinary and off-topic — which branch, which precinct, what their case number format is, what the weather is where they are. A person reading a page will loop back to it.

What to do if it already happened

Stop the sequence, even mid-call. There is no social cost you owe someone impersonating a court. Hanging up is the whole defence.

Call your bank on a number you look up yourself, and say the words wire fraud and I was told to send this. Speed matters here more than anywhere else in this article: a wire that has just left has a small, real chance of being recalled, and that window is measured in hours.

Report it at ic3.gov, with the strings. The IC3 is the FBI’s intake, and reports there are the database agents actually query — in this case, querying IC3 for the pattern is how investigators found approximately 267 people describing the same scheme. Give it the phone numbers, the account and wallet details, the company names on the wires, and the platform each call moved to.

Write down the sequence while it is fresh. Which institution claimed to call first, when it was handed over, which app they moved you to, the exact sentences that frightened you. The relay is the signature, and a description of the relay is worth more to an investigator than a description of the loss.

Tell someone today, not eventually. This script is built to make you feel implicated, and shame is the thing that keeps it working. The person who took your money read it from a page; you are not the first to be read it.

Never pay anyone who contacts you afterwards offering to recover the money. Recovery offers arriving after a loss are the second layer of the same trade.

How to not be next

You cannot tell a real institution from a fake one by how the caller sounds — the operation selects for fluent American English and rehearses the pages. What you can do is refuse the one condition the script depends on: an unbroken call that you did not start.

So the rule is short. Nobody legitimate needs you to stay on the line. Hang up, look the number up yourself, and call back. Every phase of this script — the bank, the police, the federal agency, the court — dies at that moment, because not one of them survives being checked from the outside.

And if a job offer arrives the same way — a channel, a chat app, a promise of salary, commission, travel and meals, with the visa handled later — apply the affidavit’s own sentence to it: legitimate and reputable companies do not typically rely on Telegram as a primary means of recruiting applicants.

Everything above comes from a public federal court filing and a published government announcement. That filing accuses no named person — it is a seizure of property, brought against numerous unknown individuals — and nobody in this article is named.