Cyber-scam centres linked to trafficking for forced criminality are no longer confined to Southeast Asia, where they first drew sustained international attention. Transnational organised crime groups are today moving victims of trafficking, scam centre infrastructure and criminals themselves across borders on an increasingly global scale. Compounding this challenge, the illicit service industry that has developed around cyber-scam centres now packages and sells the expertise, tools, and infrastructure of the trade—from scamming guides and white-label software to jailbroken AI, fraudulent documentation and money laundering services—to support crimes and criminal networks beyond the scamming industry itself. People smuggling networks are among those drawing on these services, now in some cases using the same platforms and payment channels to advertise, coordinate and move people along irregular routes, including by sea.
In response, the Regional Support Office of the Bali Process (RSO) and the Ministry of Public Security (MPS) of Viet Nam co-hosted the Technical Workshop on Building Capacity to Address Organised Crime Syndicates’ Use of Emerging Technologies and Social Media, bringing together 20 law enforcement and criminal justice officers from eight South and Southeast Asian countries for four days in Ho Chi Minh City.
With trafficking, cyber-scam and smuggling networks now operating through the same online platforms and services, the workshop centred on open-source intelligence (OSINT), and social media intelligence (SOCMINT) in particular, as a shared investigative foundation across crime types. It also worked to deepen networks and support informal information sharing across regions, as good practices and lessons learned in addressing cyber-scam centres’ online operations within Southeast Asia become useful more broadly.
Over four days, participants developed practical skills such as setting up secure OSINT workspaces, using sock puppet accounts safely, tracing fraudulent job advertisements through advanced search techniques, and geolocating images and video along trafficking and smuggling journeys. Participants applied these skills to case studies drawn from trafficking for forced criminality and people smuggling operations across South and Southeast Asia and took part in group discussions on improving cross-border coordination, effective joint investigations, and how they could apply what they had learned on returning to their workplaces.
Participants also presented case studies of how their departments were already applying OSINT to similar cases, giving counterparts a view of what is working in practice. Asked what they had directly observed in their own investigations, the majority reported seeing trafficking and smuggling recruitment at scale on social media, while many had also increasingly observed the use of other technologies such as cryptocurrency and AI deepfakes to facilitate and expand trafficking, smuggling and related crimes.
The workshop’s inter-regional format reflected how these crimes now operate. Cyber-scam centre operations are expanding beyond Southeast Asia, smuggling routes span both regions, and the officers investigating them increasingly encounter the same platforms, payment channels and recruitment methods. Bringing South and Southeast Asian officers together facilitated expertise to share across regions, inter-regional trends to be discussed and established working contacts that will support information sharing and joint investigations following the workshop.
1. The footprint of cyber-scam centre operations continues to widen
Participating countries described shifting roles as source, transit and destination countries, discussing how trends have moved over the past year alongside the broader geography of the scam centres themselves. While trafficking recruitment continues to take place on a global scale, the growth of physical scam centre infrastructure into new regions means prevention now needs to focus not only on trafficking recruitment online, but also on stopping new centres from developing and becoming entrenched, still within Southeast Asia but also increasingly into regions such as South Asia.
2. Technology is layered across every stage of transnational crime’s operations
Participants reported regularly encountering trafficking and smuggling being facilitated online, and the majority had seen cyber-scam centre related activity on social media in their own investigations, with transnational organised crime operations found to have a large footprint concentrated across a relatively small number of major platforms. Around half noted that cryptocurrencies, AI chatbots and AI deepfakes had featured in their recent investigations, prompting active discussion throughout the workshop on the growing role of these technologies and the investigative challenges emerging as a result.
The breadth of technologies in use, the diversity of ways they are being applied, and the speed at which criminals are innovating led to requests for continued training and upskilling for law enforcement and investigators to better keep pace with evolving criminal modus operandi.
3. The national picture is increasingly uneven
Participants’ observations of nationals trafficked into cyber-scam centres varied considerably, with roughly equal numbers reporting increases, decreases and no change in the number of victims of trafficking originating from their countries over the last 12 months. Compared with RSO workshops in 2025, where most participants reported rising numbers, this points to a more varied picture across countries, an increasingly complex response landscape, and reinforces the need for reliable national-level data and information sharing to understand where recruitment is taking place, as well as the geography of scam centre operations themselves.
4. The cyber-scam centre industry has developed a criminal service economy now serving a much wider range of crimes
The scale of the cyber-scam centre industry has created demand for a whole criminal economy of supporting services, from money laundering networks and deepfake tools to fraudulent travel documents, much of it advertised and sold over publicly accessible social media channels. These criminal service marketplaces were built in many cases to serve cyber-scam compounds, but they are today being used by organised crime networks, facilitating a broader range of crimes and have made illicit services more accessible than ever before. Efforts are therefore needed to disrupt this criminal service economy, not only for the cyber-scam centre response but also to address people smuggling and a wide range of related crime types.
The RSO will continue to work with Bali Process Member States to build OSINT capacity, and over the coming year will begin providing extended support to select Member States to develop dedicated OSINT units, allowing for longer-term skill development and the facilitation of coordination and information sharing. The RSO will also soon publish several pieces of related research to support information sharing and evidence-based responses to cyber-scam centres, both using OSINT as a research method and drawing from Member State insights gather through related workshops and dialogues.
