493 Cases of Sextortion Against Children Linked to Notorious Scam Compounds

Over the past decade, organized crime gangs working out of Southeast Asia have scammed people out of billions of dollars. Operating giant scam compounds—where experts estimate around 200,000 victims of human trafficking have been forced to run scams 24 hours a day—the criminal enterprises have used an array of romance, cryptocurrency investment, and impersonation fraud to target thousands of people around the world. Now new research reveals that the already chilling scam compounds may have an even darker underbelly.

Nearly 500 reports linked to child sextortion made over a two-year period to the National Center for Missing and Exploited Children (NCMEC), a US child safety organization, have been tied back to scam compounds operating in Southeast Asia, according to new research exclusively shared with WIRED by the anti-slavery organization International Justice Mission. Another 18,000 child exploitation reports made to NCMEC also contain IP addresses used by devices at known scam compound locations, the research says.

At least 40 of 44 previously identified scam compounds in Cambodia, Myanmar, and Laos can be linked to the child sextortion reports, says Eric Heintz, a global analyst at the IJM who focuses on combatting forced scamming and was part of the team behind the study. Heintz says it is the “first clear evidence” that the forced scamming operations are “likely” linked to global instances of child sextortion. “It was surprising how widespread it was,” he says, adding that the wider data also indicated the locations of previously undiscovered scam compounds.

The findings directly linking scam compounds to the reports of sexual exploitation of children and young people come as sextortion cases have exploded in the past few years. Sextortion often involves criminals tricking someone into sharing sexually explicit images, which they then use to blackmail that person into making payments. While all cases of sextortion can be devastating, criminals have increasingly targeted children, and dozens of teenage boys have reportedly taken their own lives as a result. Many sextortion cases against children have been linked back to Nigerian Yahoo Boy scammers and other West African fraudsters.

The new IJM research, which was funded by child safety group Safe Online and the Thomson Reuters Social Impact Institute, reviewed data from more than 1.1 million “online enticement” incidents—including 3.1 million IP addresses—that tech companies reported to NCMEC between January 2022 and August 2024. Tech companies and electronic service providers in the US are required to report online child exploitation incidents to NCMEC’s CyberTipline.

The data was cross-referenced with IP addresses known to be used at the location of 27 scam compounds in Cambodia, 16 in Myanmar, and one in Laos. In total, 18,017 of the child exploitation reports to NCMEC contained IP addresses used at the scam compounds. To establish a stronger link between the potential sextortion cases and the scam centers, the IJM researchers also obtained mobile phone advertising data from data brokers and compared it against the data from NCMEC. Taking all of their analysis together, the IJM concluded that at least 493 of the reports made to the NCMEC are “likely” directly connected to forced scamming locations.

“There are limitations to what we can see with this data, but what we have so far is accurate,” says Heintz. “If anything, I think it’s undercounting the scale of the problem.”

The data the researchers obtained is only a snapshot of some alleged sextortion activity linked to scam centers. For instance, advertising industry mobile data is incomplete, the NCMEC data does not contain all possible reported sextortion cases, and tech companies reporting data to NCMEC likely skew toward American firms.

In its report, the IJM points to multiple reports of scam centers being linked to wider sextortion against adults. The report does not rule out that children are being deliberately targeted with sextortion crimes but notes that children may also get caught in schemes targeted at adults if they are using parents’ or other caregivers’ devices. Now that this research has demonstrated a link, the researchers emphasize that further research is needed to strengthen authorities’ understanding of the connection between child sextortion and scam compounds and determine whether children are being specifically targeted. NCMEC did not immediately respond to WIRED’s request for comment.

Often run by Chinese organized crime groups, scam compounds have exploded across Southeast Asia since roughly 2019. Criminals have trafficked thousands of people from more than 70 countries into the compounds, where they are usually held captive, have their passports taken away, and are forced to scam people online. If they refuse, they can be beaten and brutalized. Initially targeting Chinese speakers, the scam centers have deployed so-called “pig butchering” scams, alongside various other forms of investment and romance scams. With vast flows of illicit cash, the criminals have increasingly opened scam compounds in the Middle East, West Africa, Latin America, and Eastern Europe; they have targeted scams against people across the world and altered the ways they scam people.

“Scam centers and cyber-enabled fraud networks in Southeast Asia have rapidly diversified their business lines and scope of targeting, increasingly integrating sextortion as well as malware, deepfakes and pornography into their operations,” says John Wojcik, a senior threat researcher focusing on Asia at the cybersecurity firm Infoblox. An October 2024 report into the growth of scam compounds from the United Nations Office on Drugs and Crime, which was partially authored by Wojcik, who worked at the organization at the time, pointed to the increase in sextortion cases against adults and the use of AI.

Wojcik says the IJM research is consistent with reports from law enforcement agencies within Southeast Asia that there has been a “steady rise” in financial sextortion cases against children.

Hieu Minh Ngo, a reformed criminal hacker and now cybercrime investigator at the Vietnamese nonprofit scam-fighting organization Chongluadao, says he has seen sextortion efforts targeting young people and adults in Vietnam in the past few years, and these “operations trace back to scam compounds” located along the Vietnam-Cambodia border. “The tactics are consistent: Bad actors pose as attractive individuals on social media, build trust with victims, then coerce them into sharing sensitive images or videos,” Ngo says. The use of AI deepfakes is also increasing, he adds. “This trend shows clear links between regional scam compounds and organized sextortion targeting children and vulnerable populations.”

“It’s likely only a matter of time before they scale up operations in other parts of the world, as they have done in the past,” Wojcik says.

While some efforts have been made to shut down the operations of scam compounds—including thousands of alleged arrests, internet and power shutdowns, and sweeping political declarations—the scam compounds are still operational and appear to be continually expanding. Criminal organizations have flourished as a result of local corruption, weak enforcement of laws, and the ability to use Big Tech services to run scams, such as creating social media accounts that are used to trick people and using web hosting infrastructure to run scams.

Heintz says that governments and tech companies need to do more to tackle the many crimes linked to the scam compounds—including human trafficking, fraud, money laundering, and now, following the IJM’s research, evidence that children are likely being harmed. “Everyone is treating this just as a financial crime or a fraud crime, where the tools that everyone can use are limited to that type of crime,” Heintz says. “Now that you have internet crimes against children, then that should open the door for more tools that both tech companies and governments can use.”