Inside The Crypto Human Trafficking Rings In Myanmar, Cambodia & Laos

Crypto scams are changing. Or rather, the operatives are. It is still about grabbing big bucks from people by luring them to invest in fake crypto schemes that promise the stars. But those sitting at the other end may not be a gang of hackers or organised cybercriminals as we tend to believe. Many of them are unsuspecting jobseekers who have been trapped in cyber slavery and forced to commit online scams.

In fact, thousands are held hostage and tortured – beaten up, starved or ‘Tasered’ – if they fail to comply, a couple of Indian nationals will tell you.

For Harish and his friend Girish (name changed), it was nothing short of living a nightmare.

The duo was in Dubai, UAE on a three-month visa and looking for high-paying opportunities as the pandemic had wiped off millions of jobs at home and layoffs are still rampant in the wake of an economic slowdown.

But Lady Luck seemed to be on their side.

Soon enough, they were approached by an IT company and offered jobs in Thailand as data entry operators. The duo flew to Bangkok. Some locals received them upon their arrival to the Thai capital and took them to Mae Sot, an SEZ in western Thailand lying on the Thailand-Myanmar border.

The job hunt story took an ugly twist from then on. The duo was trafficked from Mae Sot to Myawaddy (the capital of Myanmar’s Kayin state) without visas or entry permits. Their passports and mobiles were seized by those posing as company officials. Eventually, they found themselves in a hostage situation with no choice of turning back.

There was only one way out. Each one was asked to pay a ransom of INR 8-10 Lakh, but neither of them had the money to pay for their freedom.

Harish and his friend were not the only victims.

Hundreds of people from different countries have been trafficked similarly and forced to carry out illegal work. They make fake profiles on social media to win trust, get people to share personal and financial data and perpetrate crypto scams. If the hostages refuse to do it, they are physically assaulted or even body-shopped to other companies.

“Ours was a small company where 400-500 people were held captive and forced into crypto scams and online betting-related work. But in Myanmar, there are at least 2-3K entities like that. Some of them are really big, and thousands of people work there,” Harish told NDTV.

Harish spent a harrowing four months, first working for the criminal group in Myanmar and then being held by the Thai army.

The Myanmar saga unveils the many tentacles of online frauds and their offline transnational underbelly. This is not a new phenomenon, though, and going on for some time. Companies allegedly run by Chinese nationals have trafficked people like Harish from India, Bangladesh, Nepal, China, Malaysia, the Philippines and other countries.

Apart from the Chinese ‘companies’, the North Korean Lazarus Group is allegedly at the centre of this web of fake jobs.

Lazarus is a cybercrime group operated by North Korean individuals. The group has been behind some of the biggest cybercrimes globally, including the Wannacry ransomware attack in May 2017.

In its short but chequered history of crypto scams, India has witnessed quite a few shockers. While the GainBitcoin scam involved more than INR 90K Cr, this particular story of human trafficking and cyber slavery seems even more chilling and heinous. It is worse than victims losing money as unsuspecting civilians are now trapped by criminal rackets to perpetrate these scams.

Tracing The Origins

“The Chinese companies lure people from India, Nepal, Bangladesh, Malaysia and even China. The Indians in these companies are largely from Tamil Nadu, Uttar Pradesh, Telangana and Haryana,” said another victim, who flew from Bengaluru to Bangkok for a job and met a similar fate.

Typically, crypto scam companies identify targets using job portals such as Naukri.com, Monster.com and other job portals. Through SMS/WhatsApp messages, they even promise to offer INR 3-6K per hour or INR 1-6 Lakh every month. In a job crisis, this will attract almost everyone, and people like Harish, who are desperate for jobs, will easily fall into the trap.

The Three-Tier Modus Operandi

These companies appear to have been operating on three levels.

1. First, they lure people in the name of job offers and keep them hostages in countries like Myanmar, Cambodia and Laos.
2. Next, they force the victims to manage fake social media profiles and collect personal/financial data from more people who can be potentially trapped in crypto fraud or online betting.
3. Finally, these companies reach out to their potential victims on WhatsApp, Telegram, Facebook Messenger and Twitter, trapping them in fraud crypto investments and online betting.

When the jobseekers are brought to Myanmar or other ‘base’ countries, they are asked to manage fake social media profiles on Facebook to honeytrap others from across the world and get their personal details. The hostages must chat with their ‘targets’ to build trust. However, these chats with their targets on WhatsApp, Telegram and Facebook Messenger are heavily monitored.

Once trust has been established, the company operators start luring people into crypto investments or online betting.

“People are asked to download the Binance wallet and invest in crypto through some fake apps. They will first show how others benefit from these fully automated apps. But most of these are fake and internally managed when demonstrated to targets,” said another victim.

This is exactly what Inc42 unearthed a massive crypto fraud in November and December 2021. We found several WhatsApp groups where hundreds of people were first added (mostly without their consent) and then lured into crypto investments. By promising 100% accuracy in investment advice and huge profits in record time, the operators literally robbed hundreds of investors from India. (The stories can be found here, here and here.)

Based on the investigative reports by Inc42, Delhi and Mumbai Police registered complaints, but the probe is still on.

When we showed the screenshots of the WhatsApp scams to the victims of the Myanmar racket, we were told that their job was quite similar.

“Such scams are being run from Myanmar, Cambodia and Laos,” said the unnamed victim quoted earlier.

Crypto Scams Meet Human Trafficking

Crypto scams have been around in some form or the other in Southeast Asia and South Asia for many years. According to Vietnam-based cybersecurity expert N Anh, hackers from China and Vietnam have been at the centre of crypto-related cyber attacks since 2013.

Then in 2017, Vietnam banned crypto which forced thousands of these hackers to go underground. One year later, Vietnam police detained hundreds of people tied to online gambling who were using crypto as a medium.

“One of these scams was to the tune of $4 Bn. As Vietnam cracked a whip on crypto, certain Chinese, North Korean operators and other local hackers moved to neighbouring countries including Thailand, Cambodia and Laos for some time,” Anh told Inc42.

Anh believes that local law enforcement agencies in these countries are not well-versed in how crypto scams are conducted. Even before Covid hit these countries, crypto scam operations had grown massively, and the pandemic only allowed them to further spread their wings.

For instance, the Myawaddy area of Myanmar is largely controlled by a rebel group of ethnic Chinese. “The rebel group gets arms as well as tech support from the Chinese army,” he claimed.

Anh raised the real possibility that intelligence officials under China’s Ministry of State Security may have colluded with officials in Thailand and neighbouring countries.

This could also be the case, victims second this. Harish, who was rescued by the Myanmar army was not handed over to the Indian officials but to the Thailand Army. In Thailand, he alleged that he was not only assaulted in custody but was also pronounced guilty of crossing the Thailand-Myanmar border illegally.

Is The Indian Government Doing Enough?

So far, over 150 people are believed to have been rescued in a similar fashion from crypto scam operators in Myanmar, Cambodia and Laos. On September 24, 2022, the Indian government issued an advisory regarding fake job offers abroad.

Despite the advisory, there’s no clarity as to how many Indians are trapped in this human trafficking and crypto racket.

During a media briefing on October 7, Arindam Bagchi, the Ministry of External Affairs spokesperson, said that the government was looking into the matter on the Myanmar side, which has a land border with India. The MEA is said to have issued advisories through embassies in Yangon (Myanmar) and Bangkok about the dubious job offers since extracting individuals involves a lot of complications.

“I think about 80-odd people [from Cambodia] have been rescued over the last few weeks, months maybe. Of course, we don’t know exactly how many are still there because this is an evolving number. But 70 or 80 people had been rescued and brought to Thailand,” added Bagchi.

Besides India, other countries have also rescued their citizens from these situations. Malaysia’s foreign minister Saifuddin Abdullah said the government had rescued 273 people out of 401 reported missing in Cambodia, Laos, Myanmar and Thailand.

Cybercrimes and attacks are a growing problem in the Indian context, given the number of new-to-internet users in the past couple of years. Plus, the pandemic has forced a lot of transactions to happen digitally, which has further allowed cybercriminals to target unsuspecting individuals.

As per official statistics, India recorded 3.9 cybercrime incidents per one lakh population. From 44,735 cases in 2019, the number of reported cybercrime cases grew 15% in 2021 to 52,974 cases. The state of Uttar Pradesh alone has seen more than 70K cases in the past two years.

In order to tackle these, the Indian government has launched the National Cyber Crime Reporting Portal (www.cybercrime.gov.in) to enable the public to report incidents pertaining to all types of cyber crimes, with a special focus on cyber crimes against women and children.

The Indian minister of state, Home Affairs had earlier said in the parliament, “To strengthen the mechanism to deal with cyber crimes in a comprehensive and coordinated manner, the Central Government has taken steps for spreading awareness about cyber crimes; issuance of alerts/ advisories; capacity building/training of law enforcement personnel/ prosecutors/judicial officers; improving cyber forensic facilities; etc. The Ministry of Home Affairs has established the Indian Cyber Crime Coordination Centre (I4C) to provide a framework and ecosystem for LEAs (law enforcement agencies) to deal with cybercrimes in a comprehensive and coordinated manner.”

“This does not work,” Manish Gupta, a victim of the WhatsApp crypto fraud earlier told Inc42. The online complaint never moved beyond the complaint status. “For the FIR, I kept running from one police station to another, they never registered an FIR, despite such big money involved,” he said.

A former RAW officer, who used to work for National Technical Research Organisation, told Inc42 that Indian law enforcement agencies and police have a bias for clearing smaller cases to pump up stats.

“Instead of trying to solve one big case, they tend to solve small frauds that could keep the number of cases resolved up. How many cybercrime cases with roots outside India have they solved so far? This has only boosted the morale of these fraudsters, making them feel untouchable,” he told Inc42 on the condition of anonymity.

According to him, India needs to take a global approach to solve crypto scams. Stronger bilateral agreements with other countries will enable law enforcement to take action promptly.

But even by redoubling law enforcement efforts, crypto scams cannot be totally eliminated. “If you bust one scam, they shift to another. It does not end, it won’t.”

This can only be done if the Indian law enforcement agencies act fast. “There is no dearth of data and information. The question is about their processing and possible utilisation that LEAs seldom do,” he added.

The Bottom Line

Multiple distress signals have been floating on social media platforms. Pravin Kalaiselvan, founder and director of SaveThem India Foundation, who calls himself a scam hunter, recently tweeted:

Such incidents need to be probed and resolved at multiple levels. To begin with, India must be part of a broader clampdown and collaborate with other national agencies to extricate its citizens from the web of trafficking and cyberscams. It is not an easy task, given that Indian embassy officials are not even allowed to visit Myawaddy due to the rebel group’s control over the area. Hopefully, the country can mount pressure at a diplomatic level, much like Beijing is doing in Southeast Asia.

India’s cybercrime intelligence agencies can also take the investigation to the next level by cracking fake crypto apps and job scam websites. If these platforms get busted regularly, kingpins may find it difficult to set up new tools frequently.

More importantly, people must be alerted to the dangers lurking behind lucrative but unauthenticated job offers and the promise of a better lifestyle. Harish and thousands of job hunters like him take the plunge because they are desperate. But only a lucky few can escape that dark net. The sooner we realise that, the better.

Note: We at Inc42 take our ethics very seriously. More information about it can be found here.