Disrupting a Cambodia-based criminal scam operation

Introduction

Earlier this year, we disrupted a Cambodia-based scam operation that used ChatGPT to support investment, romance, gambling, and law enforcement impersonation schemes. We began investigating this activity following a lead from our peers at WhatsApp and have since shared additional threat signals with industry partners and relevant authorities.

The operation illustrates an important reality about modern scam networks: organized criminal groups rarely restrict themselves to a single type of scam. Instead, they opportunistically employ whatever narratives, personas, and tactics they think will be most effective to deceive victims. In our investigations we routinely observe actors moving between scam types, or combining multiple scam techniques within a single operation.

Some users in the network also generated content suggesting links to human trafficking and forced criminality. These observations are consistent with extensive public reporting⁠(opens in a new window) describing⁠(opens in a new window) organized crime groups in Southeast Asia that recruit workers with promises of legitimate employment before trapping them in systems of debt bondage and coercion. While we cannot independently determine the circumstances of every individual involved, the activity serves as a reminder that the people conducting scams can themselves be victims of exploitation.

Actor

We banned a coordinated network of ChatGPT accounts that very likely originated in Cambodia, and was likely operating in or around Poipet, a city in Banteay Meanchey province that public reporting⁠(opens in a new window) has repeatedly⁠(opens in a new window) linked⁠(opens in a new window) to online scam compounds and trafficking operations.

The network used our models to create and support the operation of fake online personas, generate and translate messages sent to scam targets, create promotional content for their fraudulent schemes, and assist with day-to-day operations.