Reported by
When police raided the Cocoro Hotel in Palau’s main city of Koror in January, the scene they uncovered was far removed from the tiny Pacific island country’s postcard-perfect image.
It was a sight that has become disturbingly familiar in the Asia-Pacific region.
A crowded room, where young and dazed-looking foreign workers sat around grimy tables cluttered with food, bottles, and laptops.
Some of the workers told authorities they had not left the rundown building for months. Others said they had been inside for years.
According to a report from Palau’s national security agency, it was “immediately apparent” that the group was engaged in activities beyond the scope of their work permits, which listed roles such as "driver" and "site inspector."
Many of these permits, it turns out, had been sponsored by companies belonging to the hotel’s owner — who is also the former deputy head of Palau’s banking regulator.
This operation had the hallmarks of an online scam center — untold numbers of which are powering a brutal Asia-based cyber-fraud industry largely run by Chinese crime syndicates.
Such centers often rely on trafficked and abused workers to target people online with a combination of romance, gambling, and investment schemes, which are estimated to steal over $60 billion a year from victims worldwide. They are most famous for what has come to be known as “pig-butchering” — a reference to scammers’ core technique of building trust with their victims, before going in for the kill and draining their bank accounts.
With its epicenter in Southeast Asia, this cyber-fraud industry has become such a problem that the United States and the United Kingdom in mid-October announced a package of sanctions against scores of alleged scam operators, as well as a record $15 billion forfeiture of Bitcoin linked to Chen Zhi, the Chinese-born CEO of the Prince Group, which the U.S. has designated a transnational criminal organization. (Prince Group has rejected those allegations as baseless, denying that either the company or Chen have engaged in unlawful activity).
Images found on Chen Zhi's phone, allegedly showing abuses of scam center workers by the Prince Group.
While the recent sanctions mostly focused on countries like Cambodia, they also targeted seven people associated with an investment project in Palau, suggesting that the island nation has become a node in this nefarious industry.
A new trove of documents obtained by OCCRP sheds light on how the operation inside the Cocoro Hotel actually worked, along with a similar operation uncovered two weeks earlier at another hotel, the Beluu Sea View Resort. The documents include investigative reports from Palau’s security agency, digital forensic analyses, and internal files from the computer systems of the scammers.
They reveal a sophisticated business model where around two dozen workers from countries like China and Vietnam, some of whom appeared to be working under coercive conditions, used prepared scripts to target victims through Chinese-language gambling sites. One of the operations netted profits of at least $200,000 a month, with proceeds then funneled offshore using cryptocurrency, according to Jay Hunter Anson, the chief information security officer at Palau’s Ministry of Finance.
Despite these initial reports, it is not clear whether authorities are actively investigating the centers. Palau's National Security Coordination Office, Immigration Agency, and Bureau of Public Safety, the national agency responsible for criminal investigations, did not respond to queries about whether the raids had led to any prosecutions or ongoing investigations.
According to Anson, scam operations have been “getting worse, bolder” in Palau — and yet the island nation has few resources to combat the problem.
The country has “zero cybercrime laws or regulations,” he told OCCRP. Although at least 12 workers were detained in the January raids, they were simply deported because the country does not have the laws and capacity to pursue prosecutions, he said.
There is another problem. These scam sites often appear to be “supported by local facilitators who use their positions to enable, conceal, or legitimize illicit activity,” Anson told OCCRP.
One of the recently-busted centers was able to operate undetected for about two-and-a-half years in the close-knit country of just 18,000 people.
The files reveal that many of those working at the centers raided in January had their work visas sponsored by construction and IT companies belonging to local political and business elites in Palau, including the owner of the Cocoro Hotel, Vance Polycarp, who was also a member of the board of Palau’s banking regulator until earlier this year. He did not respond to requests to comment, and there is no further evidence in the files that he had any involvement in the suspected scam site.
Aerial view of Palau.
As OCCRP and local media have previously reported, this is not the first time that prominent Palauans have been implicated in facilitating the entry or establishment of foreigners later arrested in raids on alleged scam operations.
What else does this recent cache of files show?
'Tightly Tracked'
Evidence seized in the January raids showed the workers at the apparent scam centers came from countries like China, Malaysia, and Vietnam. Some were given Chinese-language nicknames such as “Shark,” “Tall and Elegant,” and “Little Hero.”
According to spreadsheets found on their seized devices, a total of 21 people had been listed as “employees” of the operation at Cocoro Hotel since 2023 or earlier.
The Cocoro Hotel in Kokor, Palau.
All of them had held work visas sponsored by companies owned by one of two prominent Palauans: Polycarp and the country’s former vice president, Elias Camsek Chin.
At the other apparent scam center in Beluu Sea View Resort, two suspected scammers detained in the raid also had visas sponsored by companies owned by Polycarp, according to a National Security Coordination Office document obtained by OCCRP.
Chin, the former vice president, who was also reportedly the visa sponsor of eight Chinese nationals arrested in an earlier alleged scam operation in 2020, denied any wrongdoing when reached by reporters, and said the workers he had sponsored were caught up in the raids because they happened to be visiting friends in the hotel at the time.
“They were not involved in scamming. They were in a place where the raid took place but they were not scammers. They were there because their friends were living in that hotel,” he said.
Chin is not under investigation and has not been charged with any crime.
According to a forensic analysis of devices seized in the raid by a private firm contracted by Palau’s security agency, the workforce at the Cocoro Hotel was “tightly tracked” under a “sophisticated HR management” system.
The report did not shed light on who was ultimately behind the operation, but it cited internal computer files that, it said, revealed “a structured, transnational criminal organization operating under the cover of multiple IT and construction companies.” All of the companies listed in the files as employing the site’s staff were owned by either Polycarp or Chin, according to Palau's corporate registry.
Asked for comment on the claims in the report, Chin said: “My employees were not and have not been charged for gambling or illegal activities as you pointed out, therefore I cannot comment as I don't know anything about these allegations.”
Some of the detained workers, who were mostly in their late 20s, “confessed to having never left the building in the past months, and sometimes years, that they have worked there,” Palau’s National Security Coordination Office noted in a report about the raid. It added that this testimony was supported by “observations of food catering being delivered to the location” from a Chinese restaurant over the course of eight months.
This type of isolation is typical of pig-butchering operations throughout the world, said Erin West, founder and president of the global anti-scam nonprofit Operation Shamrock.
“That people weren't allowed to leave for months or years is insanity,” she told OCCRP. “That is a crazy amount of time that they're stuck there, and it's very consistent with what we're seeing in other places.”
Copy-Paste Scam Methods
The files found on the suspected scammers' computers revealed evidence that the centers were part of a network running online gambling, which is illegal in mainland China, and cryptocurrency frauds, according to reports by forensic investigators.
One device seized at Beluu Sea View Resort was packed with files and apps for running and marketing an online lottery, dubbed “6688 Caipiao,” that appeared to target Chinese-speaking customers.
A screenshot of the forensic analysis report showing one of the images associated with an online lottery platform that was found on computers used in the Beluu Sea View Resort.
The documents also included instructions in Chinese that directed workers to use tactics for attracting and psychologically manipulating victims, and potentially rigging bets, according to the report prepared for the Palauan government by analysts from a private cybersecurity firm.
The report describes how one such document presented “two methods for deceiving customers”:
“Offer an attractive bonus and then change the bonus conditions once the customer has deposited the money”
“Use emotional tactics to manipulate the customer and convince them to deposit more money.”
An image of chat boxes on one of the computers uncovered in one of the raids.
An analysis of the blockchain records also revealed “a sophisticated and coordinated cryptocurrency scam,” according to a cyber forensics report produced by the country’s Financial Intelligence Unit. The scammers allegedly deposited worthless digital tokens into the wallets of more than two million users of the popular online crypto platform Tron. Users who then attempted to redeem the tokens would then have their sensitive information extracted and accounts drained, the report said.
In total, the scheme netted proceeds worth at least $1.6 million for the Palau-based scammers in one eight-month period, Anson told OCCRP.
The files seized from Cocoro Hotel, some of which were encrypted and had to be cracked by investigators, show that the center also used detailed instructions on how to attract victims to gamble on a range of websites, according to the report, which did not identify the perpetrators of the alleged scam but recommended Palau authorities coordinate with other international law enforcement in order to do so.
Behind the scenes, the scammers appear to have run such sites from the back end, allowing them to change the amount of money held in an account, offer bonuses that were not real, and hide losses in order to trick users into thinking they were gambling successfully, the report’s author told OCCRP.
The files “clearly indicate that the individuals operating these devices were managing a coordinated criminal network under the guise of an online gambling enterprise,” the report concluded.
“There is a strong indication that the criminal operation extended beyond illegal gambling,” it added. “It likely involved malware deployment, potentially used to infect victims' systems, conduct fraud, and expand the criminal network through unauthorized access.”
Jarod Baker, co-founder of Honolulu-based consultancy Pacific Economics, which advises the government of Palau, described both operations as having the same modus operandi as a string of other scam centers allegedly run by Chinese organized crime that have been busted in Palau in recent years.
“The activities of illegal gambling, cyber fraud, crypto laundering, identity fraud, and workforce exploitation are all hallmarks of Chinese TOCs [transnational organized criminal groups],” he said.
Baker noted that the scams discovered in January appeared similar to the cyber-crime ring busted in Palau in 2020, whose workers had also reportedly had their visas sponsored by former Vice President Chin.
"We see the same facilitators in Palau who are bringing these people over or hiring them as IT specialists for their companies,” he said. “It's the exact same people, they're just operating under different company names."
Investigators who used digital forensic methods to follow the money trails from the Beluu hotel were able to trace payments sent through the crypto platform Tron. OCCRP found that one of the digital wallets receiving the money has been associated by outside researchers with the Huione Group, a Cambodian financial conglomerate that was recently sanctioned by the U.S. for allegedly laundering the proceeds of pig-butchering scams in Southeast Asia.
Huione did not respond to multiple requests for comment.
Going Global
Despite the recent U.S. and U.K. sanctions, and growing pressure from authorities in Southeast Asia, scam centers with “pig-butchering”-style operations continue to spread across borders.
Authorities found evidence of a suspected scam center in Oecusse-Ambeno, an exclave in East Timor, according to a United Nations Office on Drugs and Crime report.
In an April report, the United Nations Office on Drugs and Crime (UNODC) described the proliferation of scam compounds around the world, noting that syndicates from East and Southeast Asia are hedging beyond the region into new markets as far afield as the city of Batumi in Georgia.
A September threat alert from the agency warned organized crime groups had begun infiltrating East Timor, citing an August raid that uncovered evidence of a suspected scam center in the country’s remote exclave of Oecusse-Ambeno. The report also assessed that a gaming company based in the zone was part of a web of businesses that link back to scam operations in Cambodia and the sanctioned Chinese organized crime figure Wan Kuok Koi, who has pursued business ventures in Palau.
“The movement into Timor-Leste demonstrates the resilience of the industry and its ability to strategically adapt and move to new markets and operational theaters as needed,” the report said.
With its limited law enforcement capacity, Palau remains a welcoming location for organized crime groups.
“There is a continuing and evolving threat from organized scam operations in Palau,” said Anson. “What we have found since the raids, is that these networks depend heavily on insider access and protection to sustain predatory investments and obscure the flow of funds.”