(Phnom Penh): Victims do not necessarily begin by transferring tens of thousands of dollars to someone they have never met. It can start with an ordinary conversation, a new friendship and the gradual building of trust. Only later does the subject turn to cryptocurrency investment.
The first step may involve as little as $500, with the investment system appearing to show a profit. As trust grows, victims are encouraged to put in more of their own money. According to preliminary findings by Cambodia’s Anti-Corruption Unit (ACU), some cases may involve investments exceeding $200,000.
When victims try to withdraw their money, they may be told to pay an additional “tax.” They can then be blocked and lose the money they have invested.
A relationship that began with a “Friend” has now reached what the scam network itself reportedly calls the “Killer” stage.
More Than a Scam Tactic — A System
The ACU’s preliminary forensic examination of mobile phones, computers and SIM cards linked to an online scam case involving 22 defendants points to something larger than one fraudster deceiving one victim.
According to the ACU, the operation appears to have divided responsibilities among different groups: those who identify potential targets, those who cultivate relationships and trust, those who create fake accounts and supporting comments, those who introduce investment opportunities, and those involved in the final stage of extracting money.
The findings fit a broader global pattern identified by INTERPOL. Its 2026 Global Financial Fraud Threat Assessment warns that low-cost technology, artificial intelligence and growing cooperation among criminal networks are helping fraud operations expand on an industrial scale. Financial fraud is also increasingly intersecting with organized crime, human trafficking and cybercrime.
The key question, therefore, is no longer simply: How is an individual victim deceived?
The larger question is: How are online scam operations organized to turn human trust into money?
Before Taking the Money, Find the Right Target
The ACU findings suggest that the process does not begin with cryptocurrency. It begins with finding people who can be turned into potential targets.
According to the report, one group searches for potential targets through platforms such as Facebook and Google. Those targets can then be passed to others whose role is to establish contact, cultivate relationships and build trust.
More significantly, the scammers do not necessarily spend the same amount of time on everyone. According to the ACU, they have methods for assessing which targets appear more susceptible and worth pursuing. Those considered less likely to respond may be dropped as the scammers move on to new prospects.
In effect, even the scammers’ time is treated as a resource, concentrated on people they believe offer a greater chance of financial return.
This is consistent with warnings from the FBI, which identifies the targeting of potential victims as an early stage in cryptocurrency investment fraud. Scammers may initiate contact through social media, text messages or other channels, establish a relationship, and only later introduce a fraudulent investment opportunity.
The First Thing Scammers Sell Is Not Crypto — It Is Trust
This is one of the most important elements in understanding this type of online fraud. Before scammers can persuade someone to transfer money, they first have to persuade that person to trust them.
According to the ACU, fake accounts may display images suggesting wealth or financial success. Other accounts may post supportive comments, creating the impression that other people are also investing successfully and making money.
The ACU also found scripts used to guide conversations, as well as messages showing characteristics associated with emotional or romance-based scams. Personal relationships can therefore become a tool for lowering suspicion and strengthening a target’s confidence in the person behind the screen.
The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) describes such schemes as digital asset investment scams, also known by terms including “pig butchering,” “romance baiting,” and “cryptocurrency confidence schemes.”
FinCEN says criminals may use fake personas and psychological manipulation to establish relationships and gain trust before directing victims toward fraudulent investment opportunities.
In other words, the apparent friendship or romance is not necessarily the ultimate objective. It can be a means of persuading a target to lower their guard and entrust money to a person or system they have come to believe is legitimate.
Crypto may be where the money eventually goes, but trust is the doorway through which the victim enters. Friendship or romance can become the bridge between emotion and financial loss.
Why Start With $500 and Show a Profit?
The ACU findings also shed light on the psychology behind the investment stage.
According to the ACU, a victim may initially be given around $500 to test an investment. The system then appears to show that the investment has generated a profit.
Why would scammers not simply take the money immediately?
Because the larger objective is to make the victim believe that the system works.
If the first recommendation appears successful, and another transaction also seems profitable, the victim may begin to believe that the person advising them genuinely understands the market.
The FBI has warned that victims of cryptocurrency investment fraud may be directed to fake investment platforms or apps displaying fictitious profits. Those apparent gains are designed to encourage victims to invest increasingly large amounts of their own money.
The FBI’s 2025 Internet Crime Report recorded approximately $7.2 billion in losses associated with cryptocurrency investment fraud in the United States.
The initial $500, therefore, may be more than a trial investment. It can function as a confidence-building mechanism intended to prepare the victim for much larger financial commitments.
From $500 to “Killer”: Build Trust, Then Increase the Money
Once the victim believes the investment is genuine, the scammers can encourage increasingly large deposits.
According to the ACU, some victims may put in more than $200,000, while the system controlled by the scammers continues to display results suggesting that the investment is profitable.
When the amount reaches a level the scammers consider sufficient, the case may move into what the ACU says the group calls the “Killer” stage.
A victim trying to withdraw funds may be told to pay an additional “tax.” For example, someone who has invested $200,000 could be asked for another $20,000 before the funds can supposedly be released. The victim may then be blocked and lose the money.
This pattern helps explain the term “pig butchering.” The objective is not necessarily to take a small amount immediately. Instead, scammers cultivate trust, encourage progressively larger investments and ultimately extract as much money as possible.
The scale of the problem is significant. In September 2026, FinCEN reported that its analysis had identified approximately $12.7 billion in financial activity associated with suspected digital asset investment scams.
What begins as a conversation between two people can therefore be part of a much larger criminal operation capable of generating enormous financial flows.
From One Scam Center to a Cross-Border Network
The ACU’s forensic examination also identified indications of cross-border connections, including telephone numbers associated with companies in Germany, the United States, China, Taiwan and Vietnam.
Those numbers alone do not establish that every person associated with them was a victim or a national of those countries. Further investigation is required. But they provide leads that may help investigators map the wider network.
INTERPOL’s findings show the international scale of the challenge. During Operation First Light 2026, authorities from 97 countries and territories participated in operations targeting social-engineering scams. INTERPOL reported 5,811 arrests, the interception of approximately $293 million in illicit assets, and the identification of more than 142,000 victims.
The difficulty is that different parts of the same crime can operate across different jurisdictions.
The victim may be in one country, the scam operator in another, while the money passes through multiple cryptocurrency wallets and financial systems before reaching its ultimate destination.
That is why shutting down one scam center does not necessarily dismantle the entire network.
Investigators must also follow the money — tracing financial flows to identify beneficiaries, facilitators and the individuals directing the operation.
Conclusion: Shutting Down a Scam Center Is Not the Same as Dismantling the Network
The significance of the ACU’s forensic work goes beyond the phones, computers and SIM cards that were seized. Digital evidence can help expose the chain behind the fraud:
Identify targets → assess them → build trust → introduce investment → increase deposits → “Killer” → take the money.
But understanding the scam method is only one part of the investigation.
The next questions are equally important: Who gives the orders? Where does the money go? And who ultimately benefits?
Closing scam centers and arresting operators are important enforcement steps. But dismantling the wider network requires investigators to move from digital forensics to tracing the flow of money, identifying those directing and benefiting from the operation, and cooperating across borders.
The central lesson is that organized online scams operate as systems. To dismantle them, authorities must break the entire chain — from those who identify and cultivate victims to those who ultimately control and profit from the money.
