New data reveals the mechanisms of operation of two alleged fraudulent centers in Palau, a small island nation in the Pacific Ocean. These documents highlight how the local elite and ineffective laws contribute to the growth of cyber fraud even in the most remote corners of the world, reports occrp.org.
In January, police conducted a raid at the Cocoro hotel in Koror, the country's main city, and discovered a situation that starkly contrasts with the usual image of Palau as a paradise.
This state of affairs is becoming a troubling norm in the Asia-Pacific region.
As a result of the operation, clear signs of an online fraud center were identified, fueling a brutal cyber fraud industry in Asia, primarily run by Chinese criminal groups.
These centers often exploit victims, including human trafficking and forced labor, deceiving people online through a combination of romantic schemes, gambling, and investment projects. According to estimates, victims lose more than $60 billion annually. These fraudulent schemes are known as "pig butchering," which implies a process where scammers first gain the trust of their victims and then steal their money.
Cyber fraud concentrated in Southeast Asia has become such a serious problem that in mid-October, the United States and the United Kingdom imposed sanctions against alleged scammers and conducted a record seizure of $15 billion in bitcoins linked to Chen Zhi, CEO of Prince Group, a Chinese national recognized by the U.S. as a transnational criminal syndicate. Prince Group denied these allegations, calling them unfounded.
Images found on Chen Zhi's phone allegedly show abuses by employees of the fraudulent centers of Prince Group.
While the new sanctions primarily targeted Cambodia, they also affected seven individuals linked to an investment project in Palau, indicating that this island nation has become a center of criminal activity.
Documents obtained by OCCRP provide detailed information about operations at the Cocoro hotel and a similar operation uncovered at another hotel, Beluu Sea View Resort. They contain reports of investigations conducted by the Palau security agency, results of digital forensics, and internal files of the scammers.
The investigation revealed a complex business model in which about twenty employees from China and Vietnam, some of whom apparently worked under coercion, used pre-prepared scripts to lure victims through Chinese gambling sites. Jay Hunter Anson, a cybersecurity expert from the Palau Ministry of Finance, reported that one operation generated at least $200,000 per month, with funds being transferred abroad using cryptocurrency.
Despite this data, it remains unclear whether authorities are actively investigating these centers. Inquiries to the Palau National Security Coordination Office, the Immigration Agency, and the Bureau of Public Safety went unanswered regarding potential prosecutions.
Anson noted that fraudulent schemes in Palau are "becoming increasingly reckless," yet the resources to combat them are extremely limited for the island nation.
"The country lacks laws regulating cybercrime," he added. Although at least 12 workers were detained during the raids, they were simply deported as there are no legal avenues for criminal prosecution.
There is also the issue of local intermediaries who, according to Anson, "use their position to facilitate, conceal, or legitimize illegal activities." One center managed to go unnoticed for two and a half years in this small nation with a population of just 18,000.
Documents indicate that many workers at the centers that were raided had work visas sponsored by construction and IT companies owned by the local political and business elite, including the owner of the Cocoro hotel, Vance Polikarp, who previously served on the board of Palau's banking regulator. He did not respond to requests for comments, and there is no additional evidence of his involvement with the fraudulent site.
Aerial view of Palau.
As previously reported by OCCRP and local media, this is not the first time prominent residents of Palau have been involved in facilitating the entry or settlement of foreigners later arrested during raids against alleged fraudulent schemes.
What new information did the obtained documents reveal?
"Under Close Surveillance"
During the January raids, evidence was collected confirming that workers at the suspected centers were from China, Malaysia, and Vietnam. Some were assigned Chinese nicknames such as "Shark," "Tall and Elegant," and "Little Hero."
According to spreadsheets from seized devices, 21 individuals were listed as "employees" of the operation at the Cocoro hotel, starting from 2023 or earlier.
Cocoro hotel in Koror, Palau.
All of them had work visas sponsored by companies owned by Polikarp and former Vice President Elias Camsek Chin.
At another fraud center in the Beluu Sea View Resort, two suspects were also detained who had visas sponsored by Polikarp's companies, according to documents obtained by OCCRP.
Chin, who reportedly also sponsored visas for eight Chinese nationals arrested during an alleged fraudulent operation in 2020, denies any wrongdoing, stating that the workers he sponsored ended up in the raid zone because they were visiting friends at the hotel.
"They were not involved in fraud. They were in a place where the raid was taking place, but they were not scammers. They were there because their friends were staying at that hotel," he said.
Former Vice President of Palau Elias Camsek Chin.
No investigations are currently being conducted against Chin, and he has not been charged.
Experts conducting forensic examinations of the seized devices noted that the staff at the Cocoro hotel were "carefully monitored" using a "sophisticated personnel management system."
The report does not specify who exactly is behind this operation, but it mentions internal files that allegedly indicate a "structured transnational criminal organization operating under the guise of various IT and construction companies." All companies listed as employers in the reports were owned either by Polikarp or Chin, according to the corporate registry of Palau.
In response to requests for comments, Chin stated: "My employees have not been and are not being charged with gambling or illegal activities, as you indicated, so I cannot comment since I know nothing about these allegations."
The report prepared by the Palau National Security Office states that the detained workers, most of whom were around 20 years old, "confessed that they had not left the building for the past months, and sometimes years, while working there." These testimonies are corroborated by observations of food deliveries from a Chinese restaurant over eight months.
This isolated existence is characteristic of "pig butchering" schemes, according to Erin West, founder and president of the global nonprofit organization Operation Shamrock dedicated to fighting fraud.
"The fact that people are not allowed to leave the building for months or years is absurd," she told OCCRP. "This is an incredibly long time for them to be stuck, and it aligns very well with what we see elsewhere."
Copy-and-Paste Fraud Methods
According to forensic experts, files on the computers of the alleged scammers revealed that these centers are part of a network of online gambling operations banned in mainland China, as well as engaging in cryptocurrency fraud.
On one of the devices seized at the Beluu Sea View Resort, files and applications for conducting and promoting an online lottery called "6688 Caipiao," aimed at Chinese-speaking clients, were discovered.
Source: Ciberseguridad 720
Screenshot from a forensic report showing one of the images related to the online lottery platform found on computers used at the Beluu Sea View Resort.
According to a report prepared for the Palau government by analysts from a private cybersecurity company, the documents contained instructions in Chinese directing workers to use victim attraction and psychological manipulation tactics, as well as possibly rigging betting results.
One such document described "two methods of deceiving customers":
"Offer an attractive bonus, then change the terms of obtaining it after the customer has deposited money."
"Use emotional tactics to manipulate the customer and convince them to deposit more money."
Image of chat windows on one of the computers found during one of the raids.
Analysis of blockchain records also revealed a "complex and coordinated cryptocurrency fraud scheme," according to a cyber forensics report prepared by the country's financial intelligence. The scammers allegedly deposited negligible digital tokens into the wallets of over two million users of the popular cryptocurrency platform Tron. Users attempting to exchange tokens lost confidential information and funds from their accounts.
According to Anson, over eight months, this scheme brought the scammers from Palau at least $1.6 million.
According to the report, the seized files from the Cocoro hotel, some of which were encrypted and required hacking by investigators, show that the center used detailed instructions for attracting victims to gamble on various websites. The report does not disclose the names of the organizers of the operation, but it recommends that Palau authorities coordinate with international law enforcement agencies.
According to OCCRP, the scammers managed the websites from the backend, allowing them to alter account balances, offer unrealistic bonuses, and hide losses to create the illusion of successful gambling for users.
In conclusion, the report states that the files "clearly indicate that the individuals managing these devices were behind a coordinated criminal network disguised as an online gambling enterprise."
"There is reasonable suspicion that their activities went beyond illegal gambling," the statement adds. "It likely involved the use of malware potentially used to infect victims' systems, commit fraud, and expand the criminal network through unauthorized access."
Jarod Baker, co-founder of the consulting firm Pacific Economics, which works with the government of Palau, stated that both operations operate on a similar principle as other fraudulent centers allegedly run by Chinese organized crime uncovered in recent years in Palau.
"Illegal gambling, cyber fraud, cryptocurrency laundering, identity theft, and labor exploitation are common features of Chinese transnational criminal groups," he added.
Baker noted that the fraudulent schemes identified in January appear similar to those uncovered in 2020, whose workers also received visas from former Vice President Chin.
"We see that in Palau the same intermediaries bring these people in or hire them as IT specialists for their companies. These are the same people, just working under different company names," he clarified.
Investigators using digital forensics to trace the flow of money from the hotel in Beluu were able to track payments sent through the cryptocurrency platform Tron. OCCRP found that one of the digital wallets receiving funds was linked by independent researchers to Huione Group, a Cambodian financial conglomerate recently sanctioned by the U.S. for allegedly laundering proceeds from "pig butchering" schemes in Southeast Asia.
Huione did not respond to requests for comments.
Global Market Expansion
Despite the sanctions imposed by the U.S. and the U.K., as well as increasing pressure from Southeast Asian authorities, the fraudulent centers operating under the "pig butchering" scheme continue to expand their operations beyond the countries of the region.
Source: Jorge Santos/Wikimedia Commons
According to a report by the United Nations Office on Drugs and Crime, authorities found evidence of an alleged fraud center in Oecusse-Ambeno, an exclave in East Timor.
In an April report, the United Nations Office on Drugs and Crime (UNODC) described the spread of fraudulent schemes worldwide, noting that syndicates from East and Southeast Asia are expanding beyond the region into new markets, including Batumi in Georgia.
In September, the agency issued a threat warning indicating that organized crime groups had begun to infiltrate East Timor, referencing an August raid during which evidence of an alleged fraud center was found in the remote exclave of Oecusse-Ambeno.
The report also indicated that a gaming company based in this region is part of a network of enterprises linked to fraudulent operations in Cambodia and with a sanctioned Chinese organized crime figure, Wang Guokui, who has conducted business in Palau.
"The movement into East Timor demonstrates the resilience of the industry and its ability to strategically adapt and expand into new markets and conflict zones as needed," the report states.
Due to limited law enforcement capabilities, Palau remains an attractive location for organized crime groups.
"The threat from organized fraudulent schemes persists and continues to evolve in Palau," Anson said. "As we found out after the raids, these networks largely depend on access to insider information and protection to maintain predatory investments and conceal the flow of funds."
