By Kristina Amerhauser | Audrey Thill 

  Cyber scam operations in Southeast Asia rely heavily on information and communications technology, financial fraud, trafficking for forced criminality, corruption and elite capture. This creates what can be described as ‘compound crimes’, reflecting how cyber scam operations are both based in physical compounds and involve multiple criminal markets. While estimates vary, the scale of funds defrauded from scam victims each year is in the tens of billions of US dollars and trending upward. In addition, illicit proceeds are generated from exploitation of trafficked persons, illegal gambling and corruption. The scale of illicit financial flows represents a clear threat to national economies, governance and international security. Cyber scam operations and their enabling networks operate at scale across Southeast Asia and beyond. They have reportedly trapped hundreds of thousands of people inside compounds where they are forced to conduct scams. Some operations retain workers through debt bondage, psychological coercion and financial incentives. Significant diversity in operational models – from high-security compounds to thousands of smaller operations located in apartments and other small premises – creates varied patterns of financial flows across jurisdictions. The money laundering process is part of a sophisticated financial service ecosystem. Most concerning is how networks of actors operate at scale and at the intersection of legitimate and illegitimate economies by using licensed crypto exchanges, registered fintech platforms and traditional banking services. Some are ‘crime as a service’ providers, explicitly providing money laundering services to cyber scam operations and doing so with corporate efficiency. This means that moving and laundering money has evolved into a marketplace-type structure where actors remain anonymous to others within the network. Governments, the private sector and civil society actors have sought innovative responses to disrupt the illicit industry. These include initiatives that ‘follow the money’ and disrupt the money laundering networks used by cyber scam operations. While some work has begun to explore illicit financial flows stemming from scam operations, notably related to cryptocurrencies, important gaps persist. Less is known about the wider set of financial flows, the mechanisms used to transfer proceeds in and out of the region and the networks involved. This policy brief seeks to help fill this gap by mapping wider related payments and providing insights into how money is moved and where it ultimately ends up. It concludes by providing actionable policy recommendations for Southeast Asian governments as well as regional and global financial service providers. Crucially, these recommendations identify entry points for disrupting the operations of the transnational organized crime groups that run cyber scam operations. The key findings include: Actors involved in cyber scams and trafficking for forced criminality often use cryptocurrency to move illicit money. They also use cash, fintech – such as peer-to-peer (P2P) payment apps – gaming or gambling platforms, bank transfers, shell and front companies, credit cards and pre-paid cards. The role of the formal banking sector in these financial flows appears significant, as many scam-related transfers are initiated by the victim from their own bank accounts before being converted into cryptocurrencies at different steps of the laundering process. While most financial institutions likely process these transactions unwittingly, evidence suggests they may be enabled by regulatory loopholes such as weak know-your-customer (KYC) requirements and/or excessively high minimum thresholds for reporting suspicious transactions. After being laundered and converted back into fiat currency4 from cryptocurrency, illicit funds are also likely to be moved again through the formal financial system.

Many of the fintech and cryptocurrency platforms that money laundering networks use to convert cryptocurrencies back into fiat are registered companies and hold financial service licences. Some owners of these platforms have close connections to the political and business elites in the countries of registration, suggesting influence over financial regulation and an interest in maintaining a policy environment amenable to the large-scale laundering of criminal proceeds. Transnational organized crime groups in Southeast Asia generate highly lucrative profits. This creates a vicious cycle: greater profits enable these groups to expand their influence, including over public officials and the financial sector, which in turn reduces scrutiny of cyber scam compounds and related suspicious financial transactions. With their growing wealth, these criminal networks invest further into other types of crime and crime-as-a-service infrastructure, generating additional profits that allow them to strengthen their influence and market position   
Geneva: Global Initiative Against Transnational Organized Crime. 2025. 44p.

By Suleman Lazarus  · Peter Tickner  · Michael R. McGuire1

 We discuss cybercrimes against senior citizens from three standpoints: (a) online fraudsters often target senior citizens because of their age, which results in the propagation of ageism. Thus, we explicitly defne ageism in the context of cybercrime, characterising it as the intentional targeting or prioritisation of senior citizens as potential victims of online fraud. (b) Senior citizens are vulnerable to online fraud schemes for physiological (e.g., cognitive decline), psychological (e.g., elevated fear of cybercrime), familial (e.g., insider fraud), and sociocultural (e.g., isolation) reasons. (c) Cybercrimes against older adults predominantly fall under the socioeconomic category driven by a common fnancial motive. We argue that ageism serves as a weapon used by online offenders to target older adults, whilst the concept of the ideal victim acts as society’s shield in response to these reprehensible actions. This framework invites closer attention to how age-based targeting in cyberspace reproduces broader social, economic, and moral asymmetries.  Future empirical studies are warranted to substantiate these claims beyond the theoretical realm.

Security Journal (2025) 38:42 

By Winnona DeSombre Bernsen

If the United States wants to increasingly use offensive cyber operations internationally, does it have the supply chain and acquisition capabilities to back it up—especially if its adversary is the People’s Republic of China? 

 The Cyber Statecraft Initiative’s new report from CSI nonresident fellow Winnona DeSombre Bernsen, Crash (exploit) and burn: Securing the offensive cyber supply chain to counter China in cyberspace,  is the first to conduct a comparative study within the international offensive cyber supply chain, comparing the United States’ fragmented, risk-averse acquisition model with China’s outsourced and funnel-like approach.

 Strategic competition between the United States and China has long played out in cyberspace, where offensive cyber capabilities, like zero-day vulnerabilities, are a strategic resource. Since 2016, China has been turning the zero-day marketplace in East Asia into a funnel of offensive cyber capabilities for its military and intelligence services, both to ensure it can break into the most secure Western technologies and to deny the United States from obtaining similar capabilities from the region. If the United States wishes to compete in cyberspace, it must compete against China to secure its offensive cyber supply chain.

Washington, DC: Atlantic Council, 2025. 44p

By Hal S. Stern and Daniel L. Cork, Editors

Cybercrime poses serious threats and financial costs to individuals and businesses in the United States and worldwide. Reports of data breaches and ransomware attacks on governments and businesses have become common, as have incidents against individuals (e.g., identity theft, online stalking, and harassment). Concern over cybercrime has increased as the internet has become a ubiquitous part of modern life. However, comprehensive, consistent, and reliable data and metrics on cybercrime still do not exist - a consequence of a shortage of vital information resulting from the decentralized nature of relevant data collection at the national level.

Cybercrime Classification and Measurement addresses the absence credible cybercrime data and metrics. This report provides a taxonomy for the Federal Bureau of Investigation for the purpose of measuring different types of cybercrime, including both cyber-enabled and cyber-dependent crimes faced by individuals and businesses, and considers the needs for its periodic revision. This report was mandated by the 2022 Better Cybercrime Metrics Act (BCMA).

Washington, DC: The National Academies Press., 2025. 160p.

By Mark Button  · Vasileios Karagiannopoulos  · Julak Lee  · Joon Bae Suh  · Jeyong Jung

Introduction The nature of crime has been changing globally with technological and other societal developments fuelling a growth in fraud and cybercrime (Button and Cross 2017). The diversity and rapid evolution of a broad range of scams has led to millions across the globe becoming victims of fraud (Federal Trade Commission 2019; ONS 2023a, 2023b). A common belief often promoted in policy circles and some research is that older adults are more vulnerable to fraud (James et al. 2014). This is not so clear cut, however, as in terms of victimisation, the middle aged have been most at risk (see Fig. 1 later). This is changing and there is evidence older adults (65+) are fast becoming the one of the most at risk categories and that they also tend to lose much more than other age groups (see Table 1 later). Indeed, there are a variety of trends fuelling a potential explosion in fraud and cybercrime among older adults unless serious action is taken to reduce the risks that we will shortly explore. It is for this reason we conceived this special edition and the research project that underpins it. To set the context for this edition, it is important to examine the factors fuelling the growth in fraud and cybercrime victimisation among older age groups. We will do this using data from the UK and South Korea. The reason for the selection of these countries is simple. The funding for the project stimulating this edition came from ESRC funding aimed at developing relationships with these two countries 

  Security Journal (2025) 38:40

By Mark Button  · David Shepherd  · Chloe Hawkins  · Jacki Tapley

This paper explores older adults who are largely over 75 and their experience of fraud, based upon research with the clients of a UK charity working with this age group. The researchers used a postal questionnaire yielding almost 2000 responses, supplemented with interviews with clients and key staf. The research found higher rates of fraud victimisation than national rates for this age group as well regular attempted frauds, largely through the telephone. The experience of fraud and attempted fraud has a devastating impact on some of the lives of older adults, causing fear, anxiety, and related issues, which afects their quality of life. This is the frst study to illustrate that fear of fraud is a major problem amongst older adults, particularly females living alone.  

Security Journal (2025) 38:44

By Cassandra Cross  · Thomas J. Holt 

Using the premise of a genuine relationship, romance fraud ofenders deceive victims for monetary gain. Research on romance fraud has grown, but limited work explores the demographic correlates of victimisation. An assumption exists that older persons are more susceptible to fraud, though this dynamic is not consistently evident in the literature. This article analyses 2686 romance fraud complaints to Scamwatch, an online Australian fraud reporting portal, to identify correlates between being 65 years and older and their risk of victimisation. The fndings illustrate that seniors were not more likely to sufer monetary losses to romance fraud and were less likely to lose personal information compared to victims in other demographic groups. This study afrms the challenge of using demographics to predict romance fraud victimisation and emphasises the need for additional research in this area 

  Security Journal (2025) 38:46

By Katalin Parti  · Faika Tahir  · Pamela B. Teaster 

Cyber victimization targeting vulnerable populations, particularly older adults, has become increasingly prevalent in the digital age. Grounded in the Bioecological Systems Framework (Bronfenbrenner in The ecology of human development: Experiments by nature and design, Harvard University Press, Cambridge, 1979), this research explores the factors contributing to victimization, including the ease of exploitation, the situational factors setting up victims for scams, their vulnerabilities, the dynamics within their environments, and the challenges victims face in recognizing scams. Using semi-structured interviews, we asked scam victims (n=19) aged 60 years and above about their personal and structural circumstances as well as their individual assessment of the impact of their being victimized. Despite high levels of education and computer literacy among our sample, their victimization occurred far too frequently, which prompts a call for the revision of existing approaches toward helping older adults overcome scam victimization.  

  Security Journal (2025) 38:49

By Marcelo F. Aebi Stefano Caneppele Lorena Molnar (Eds.)

  Cybercrime has become part of everyday life. We live in hybrid societies, fl uctuating between the material and the virtual world, and we are hence confronted with online, offl ine and hybrid offences. However, the few victimisation surveys conducted in Europe reveal that victims of online crimes seldom report them to the police. Consequently, cybercrimes – which according to the best estimates represent between one third and more than half of all attempted and completed crimes in Europe – seldom appear in national criminal statistics. The State seems powerless to prevent them and private security companies fl ourish. During two days, experts from all over the continent gathered together in the framework of a virtual conference organized by the Council of Europe and the European Union to discuss what we know, what we do not know, and what we could do to improve our knowledge of crime in our contemporary hybrid societies, develop evidence-based criminal policies, provide assistance to crime victims, and implement realistic programs in the fi eld of crime prevention and offender treatment. This book presents their experiences, refl exions, and proposals  

The Hague: Eleven Publishing, 2022. 150p.  

By Graeme R. Newman and Ronald V. Clarke

In Superhighway Robbery, Graeme Newman and Ronald Clarke provide a grounded, pragmatic analysis of how the digital revolution didn't necessarily create new types of criminals, but rather provided them with a much more efficient set of tools. They move away from the sensationalized "hacker" myths of the early 2000s to focus on the cold reality of Situational Crime Prevention. The book's central thesis is that the internet acts as a vast infrastructure—a superhighway—that significantly reduces the effort required to commit traditional crimes like theft, fraud, and piracy while increasing the potential rewards and lowering the risk of being caught.

By applying their famous CRAVED model to the digital world, the authors explain that data and software are the ultimate targets because they are easily concealable, removable, and available. They argue that the most effective way to stop cybercrime is not to wait for a change in human nature, but to change the digital environment itself. This involves "designing out" crime by making digital targets harder to reach and less profitable to exploit. Ultimately, Newman and Clarke strip away the mystery of the "Information Age" to reveal that cybercrime is essentially a matter of opportunity, and by closing those digital windows of opportunity, we can make the superhighway a significantly safer place.

In the digital realm, the CRAVED model explains why certain data or media becomes a prime target for "superhighway robbery." Concealability is at an all-time high because digital files take up no physical space and can be hidden in encrypted folders or behind innocuous filenames, making them easy to possess without detection. These files are incredibly Removable because they can be copied or moved across the globe in milliseconds, allowing a thief to "steal" an item while the original remains in place. The Availability of these targets is virtually limitless; once a movie or piece of software is uploaded to a server, it is accessible to anyone with a connection, twenty-four hours a day.

The Value of digital goods remains high because they often represent thousands of hours of professional labor or sensitive personal information that can be sold on the dark web. These items are also highly Enjoyable, as they often consist of popular entertainment, games, or high-end tools that people naturally want to use. Finally, they are perfectly Disposablebecause there is a massive, ready-made market of willing buyers or downloaders, ensuring that a criminal can quickly offload their "loot" for profit or social capital without the logistical headaches of physical fencing.

Cullompton, Devon. UK. Willan. 2003.

By Megan M. McNally and Graeme R. Newman

From the cover: There has been a glaring lack of scholarly attention to the crime of identity theft, according to the editors. The chapters in this volume attempt to fill some of this gap by exploring theory and research on identity theft, as well as situational measures to prevent its occurrence.

The editors' introduction outlines several key issues related to the definition, extent and commission of identity theft. The chapter by Graeme Newman applies the opportunity perspective to the study of identity theft. Megan

McNally uses the "script" approach to examine the meaning and mechanics of identity theft in all of its forms. Henry Pontell, Gregory Brown and Anastasia Tosouni present new findings on how identity theft affects victims, based on data collected by the Identity Theft Resource Center. Heith Copes and Lynne Vieraitis describe how a sample of identity theft offenders viewed their crimes. Michael Levi recounts the evolution of identity fraud and its control in the U.K. Russell Smith presents a framework for evaluating preventive measures, particularly document-based systems, biometric technologies and identity cards. Sara Berg considers how information technology can be used within a situational crime prevention framework to fight identity theft. Robert Willison examines the use of situational crime prevention to protect sensitive personal information in the context of information systems security.

Crime Prevention Studies, volume 23. Willan Publishing. Culmcott House, Uffculme, Cullompton Devon EX 15 3AT, U.K. 2008. 195p.

By Sophie Davies | Manon Roberts | Amber Evans | Freya Smith | Alex Murray,

Fraud is now the most commonly experienced crime in the UK, making up over 40 per cent of all recorded crime. Instances of fraud have risen substantially over the last decade, from 510,403 offences recorded in the year ending 2013 to 1.16 million offences recorded in the year ending 2023, with online fraud contributing significantly to the increase (the Crime Survey for England and Wales estimates that over 60 per cent of cyber incidents take place online). Yet our understanding of online fraud in particular — its typology, scale and impact — is limited. Crest Advisory, in partnership with the Police Foundation and Birkbeck, University of London (Institute for Crime and Justice Policy Research), and with funding from the Dawes Trust, is carrying out a large research project into tackling online fraud. The first part of our project focuses on developing a better understanding of the impact of online fraud on victims and the wider public. In September 2023, Crest published findings from large-scale online surveys of the public and small and medium enterprises (SMEs) which explored public perceptions and experiences of online fraud. This report presents the findings from interviews with 20 victims and 12 focus groups (with 96 members of the public) to build on the survey findings and deepen our insight and knowledge of online fraud victimisation and its impact. It addresses a key gap as most existing studies do not distinguish between online and offline fraud victimisation, in part because many fraudulent activities combine offline and online elements. Key findings from the interviews and focus groups are set out below.

London: Crest Advisory, 2024. 36p.

By The Better Business Bureau

CRIMINALS ARE FINDING NEW METHODS WITH THE CRYPTOCURRENCY MARKET, LIKE BITCOIN AND ETHEREUM, TO STEAL FROM UNSUSPECTING INVESTORS OR VICTIMS OF COMMON SCAMS. | Cryptocurrency Scams As Bitcoin and other types of cryptocurrencies gain attention in the news for their volatility, novelty and celebrity investors, scammers are quickly discovering how to use people’s lack of knowledge about the system to rip off investors and dress up old scams. Early entrants into the market made enormous amounts of money, and later others rushed in with hopes of similar gains. The total value of all bitcoins in the world is estimated at $1.03 trillion. A single bitcoin, worth $2,000 in 2017, reached an all-time high of $67,549 in 2021. But Bitcoin is volatile, and the value can swing wildly. After hitting a high in 2021, it declined to $35,484 in early 2022. Purchasing power of a bitcoin can vary day-to-day. Nonetheless, cryptocurrency — a digital payment system that does not rely on banks to verify transactions — has now grown into a major worldwide industry. New York, Arkansas, Brazil, and Puerto Rico expressed interest in becoming attractive locations for the cryptocurrency industry. However, in the spring of 2021 China banned cryptocurrency. It was the second largest country using cryptocurrency. A virtual tug of war exists between the legitimate and fraudulent use of cryptocurrency. This study examines digital currencies and the scams that use them. It provides background on key terms and concepts, examines cryptocurrency’s susceptibility for large-scale scams, and notes the risks and provides tips for common investors and others using cryptocurrency as a payment method.

Washington, DC: BBB, 2022. 18p.

By EUROPOL and Basel Institute on Governance,

These recommendations follow the 6th Global Conference on Criminal Finances and Cryptocurrencies on 1–2 September 2022. The conference was hosted by Europol at its headquarters in The Hague, the Netherlands, together with the Basel Institute on Governance through the Joint Working Group on Criminal Finances and Cryptocurrencies.

The Recommendations are intended to highlight broad approaches and best practices. They are designed to help public and private actors stay one step ahead of those seeking to abuse crypto assets (also known as virtual assets) and services to make, hide and launder illicit money.

The main message is that as the use of crypto assets expands into practically every country and sector, so does its abuse to commit new forms of crime and launder criminal proceeds. Yet with the right tools, capacity and cooperation, the unique characteristics of blockchain-based technologies offer an unprecedented opportunity to investigate organised crime and money laundering networks and to recover stolen funds.

The five recommendations cover:

1. Breaking down silos between “traditional” and “crypto”

2. Regulating broadly and make full use of existing laws 

3. Taking advantage of the blockchain to disrupt organised crime 

4. Raising crypto literacy through capacity building and clear communication 

5. Increasing public-private cooperation

EUROPOL and Basel Institute on Governance, 2022. 6p.

By Jack Nicholls; Aditya Kuppa; Nhien-An Le-Khac

Machine Learning and Deep Learning methods are widely adopted across financial domains to support trading activities, mobile banking, payments, and making customer credit decisions. These methods also play a vital role in combating financial crime, fraud, and cyberattacks. Financial crime is increasingly being committed over cyberspace, and cybercriminals are using a combination of hacking and social engineering techniques which are bypassing current financial and corporate institution security. With this comes a new umbrella term to capture the evolving landscape which is financial cybercrime. It is a combination of financial crime, hacking, and social engineering committed over cyberspace for the sole purpose of illegal economic gain. Identifying financial cybercrime-related activities is a hard problem, for example, a highly restrictive algorithm may block all suspicious activity obstructing genuine customer business. Navigating and identifying legitimate illicit transactions is not the only issue faced by financial institutions, there is a growing demand of transparency, fairness, and privacy from customers and regulators, which imposes unique constraints on the application of artificial intelligence methods to detect fraud-related activities. Traditionally, rule based systems and shallow anomaly detection methods have been applied to detect financial crime and fraud, but recent developments have seen graph based techniques and neural network models being used to tackle financial cybercrime. There is still a lack of a holistic understanding of the financial cybercrime ecosystem, relevant methods, and their drawbacks and new emerging open problems in this domain in spite of their popularity. In this survey, we aim to bridge the gap by studying the financial cybercrime ecosystem based on four axes: (a) different fraud methods adopted by criminals; (b) relevant systems, algorithms, drawbacks, constraints, and metrics used to combat each fraud type; (c) the relevant personas and stakeholders involved; (d) open and emerging problems in the financial cybercrime domain.

IEEE Access ( Volume: 9), 2021, 22p.

By David B. Hinchman,

Ransomware is a malicious software that encrypts files and leaves data and systems unusable. With ransomware attacks, hackers gain entry into a system, lock out users, and demand payment to regain access.

Homeland Security, FBI, and Secret Service help state, local, and other governments prevent or respond to ransomware attacks on systems like emergency services. Most government entities said they're satisfied with the agencies' prevention and response efforts. But many cited inconsistent communication during attacks as a problem. We recommended that the federal agencies address cited issues and follow key practices for better collaboration.

Washington, DC: U.S. Government Accountability Office, 2022. 70p.

By Mark Button · David Shepherd · Jeyong Jung

This paper explores the use of fake social media accounts for economic espionage. It focuses solely on the first step of the recruitment process, the link requests. There has been very little research on economic espionage and none on the use of fake social media profiles as a means of recruitment. The methodology is built upon an inductive approach based on a survey of 2,000 UK professionals who use social media for professional purposes to provide practical and theoretical insights into the problem drawn from a Qualtrics panel. The results illustrate that a quarter of professionals are ill-prepared for the threat of fake social media profiles for the purposes of espionage because they either do not check link requests or accept them even with risky attributes. It further finds a substantial minority are carelessly indifferent to information security and computer network security, and are so indifferent to the identities behind link requests that they auto-link with everyone. The paper also explores the homophily-heterophily orientation of professionals. It argues that homophily-orientated professionals tend to reject profiles with espionage characteristics, whilst heterophily-orientated professionals are susceptible because they embrace social difference. The practical implications are that employers need to strengthen their information security training programmes, the security services need to be more explicit in characterising the threats, and regulation is required to force the social media companies to focus on tackling the fake profle problem.

Security Journal (2025) 38:30

By Michael Skidmore and Beth Aikenhead

This study aims to improve our understanding of the most serious fraud offences perpetrated in the UK, specifically the diversity of methods for committing these crimes, the characteristics and pathways of offenders involved and where applicable, how the groups or networks of offenders operate. This is an exploratory study which used qualitative data taken from the documents compiled by police practitioners in 25 separate criminal investigations. The cases included in this analysis do not constitute a representative sample of frauds in England and Wales during this period. The selection of cases reflects the choices made by the research team to incorporate a diversity of methods, offenders and settings to capture the breadth of fraud. Furthermore, the sampling frame is the product of practitioner choices over which crimes to assign investigation by specialist teams; these are a limited resource and due to the challenges of international investigation, will likely prioritise offending that has a footprint in the UK. Furthermore, in focusing on frauds that were perpetrated (at least in part) from within England and Wales it does not represent fraud offending that emanates from other countries. The specific fraud cases were serious for different reasons; high financial losses (£100,000 or more), high volume offending (50 or more known victims) and high victim impact (assessed by the victim and/or police practitioner). These dimensions of harm reflect those used in practitioner assessments for deciding which frauds are high harm and a priority for intervention. Only three cases satisfied all three harm criteria, all of which involved the mis-selling of investments. Twelve cases satisfied only one criterion and those linked to each dimension of harm were associated with different methods and victims; all cases that fulfilled the high financial loss criterion had defrauded businesses, and two out of three that fulfilled the high-volume criterion involved taking advance payment from consumers In five cases the scale of victimisation and impact was hidden, but they were included because they involved high-risk offenders suspected of being engaged in serious and complex offending. There was considerable diversity in the methods for perpetrating serious fraud and this study borrows from a typology of acquisitive crime developed in a previous study (Naylor, 2002). This model provided a good fit for distinguishing serious frauds on the basis of two overarching models of offending, and this delineation simultaneously revealed distinctions in the situational context, victim and offender profiles: • Commercial frauds: perpetrated from within a legitimate or pseudo-legitimate business setting and included the sale of investments or the mis-selling of products or services online or face-to-face, and nearly all had victimised individual members of the public. • Predatory frauds: involved theft by impersonating legitimate individuals or organisations, mostly by offenders operating from outside of a business setting and without the pretence of a legitimate commercial exchange. The victim profile was more varied, and over half had victimised businesses (for example, payment diversion fraud). There was divergence in the types of fraud offence encompassed by each category of fraud.

London: Police Foundation 2023. 39p.

By Eurojust and Europol

This report is a collaborative effort between Eurojust and Europol that addresses persistent and emerging challenges in cybercrime and investigations involving digital evidence. Key challenges include management of massive volumes of data, legal uncertainties following the invalidation of the Data Retention Directive, and technologies that create barriers to accessing data.

Just like in the previous edition, this 2024 review identifies and categorises challenges from both the law enforcement and judicial perspectives. However, this report includes a second part focusing on legislative tools that could alleviate those challenges and their practical application.

Europol, 2025. 18p

By Emily Ferrguson and Emma Schroeder

Following decades of cyclical insecurity in Myanmar, conflict reached a new level following a coup d’etat in 2021 during which Myanmar’s military, the Tatmadaw, deposed the democratically elected National League for Democracy government. Meanwhile, criminal syndicates, entrenched primarily in Special Economic Zones (SEZs) like Shwe Kokko within Myanmar’s Karen state, have expanded and evolved their criminal operations throughout this evolving conflict. The Tatmadaw forces have intertwined themselves in complicated and carefully balanced alliances to support the ongoing conflict, including with the Karen State Border Guard Force (BGF) . As the Tatmadaw and BGF look to sustain themselves and outlast each other, they have found allies of convenience and alternative funding sources in the criminal groups operating in Karen state. In the last two years, organized criminal groups in Myanmar have expanded their activities to include forms of profitable cybercrime and increased their partnership with the BGF , which enables their operations in return for a cut of the illicit profits. Since roughly 2020, criminal syndicates across Cambodia, Myanmar, Laos, and Thailand have largely lured individuals with fake offers of employment at resorts or casinos operating as criminal fronts where they are detained, beaten, and forced to scam, steal from, and defraud people over the  internet The tactics—kidnap-to-scam operations—evolved in response to the pandemic and to the Myanmar civil war, allowing criminal groups to build on existing networks and capabilities. These operations do not require significant upfront investment or technical expertise, but what they do need is time—time that can be stolen from victims trapped in the region’s already developed human trafficking network. The profits that these syndicates reap from victims around the globe add fuel to the ongoing civil war in Myanmar and threaten the stability of Southeast Asia. These groups entrench themselves and their illicit activities into the local environment by bribing, partnering with, or otherwise paying off a key local faction within the Myanmar civil war, creating an interconnectedness between regional instability and profit-generating cybercrime. What is unfolding in Myanmar challenges conventional interpretations of cybercrime and the tacit separation of criminal activities in cyberspace from armed conflict. The criminal syndicates, and their BGF partners, adapted to the instability in Myanmar so effectively that each is financially and even existentially motivated to perpetuate this instability. This paper explores the connectivity between cybercriminal activities and violence, instability, and armed conflict in a vulnerable region, exploring how cybercrime has become an effective vehicle through which nonstate actors can fund and perpetuate conflict. The following section examines the key precipitating conditions of this case, traces the use of cyber scams to create significant financial losses for victims across the world, sow instability across Southeast Asia, exacerbate the violence in Myanmar, and, finally, considers the risks that this model could be adopted and evolved elsewhere. This paper concludes with implications for the policy and research communities, highlighting the ways in which conflict can move, unbounded, between the cyber and physical domains as combatants and opportunists alike follow clear incentives to marry strategic and financial gain.

Washington, DC: Digital Forensic Research Lab (DFRLab) at the Atlantic Council, 2023. 16p.