Scam Center Strike Force Expands Reach to Target Global Crime Syndicates; Charges Scammers Based in Africa and Tied to China

WASHINGTON - Today, U.S. Attorney Jeanine Ferris Pirro, together with major federal law enforcement and in concert with interagency partners, announced actions taken by the Department of Justice's Scam Center Strike Force to secure America against cyber and cryptocurrency investment scams perpetrated by Transnational Criminal Organizations (TCOs) groups.

The Strike Force announced charges against six Africa-based scammers, with connections to Southeast Asia and China, which targeted Americans with fake Nonfungible Token (NFT) investment scams.

U.S. Attorney Pirro also reviewed the Strike Force's actions to date, noting that it had surpassed $1 billion in cryptocurrency restrained, and announced that the Strike Force has expanded its personnel and its reach to cover a global portfolio, following the expansion of Chinese connected TCOs to Africa and Europe.

Joining in the announcement were U.S. Attorney Michael J. Heyman for the District of Alaska, Assistant Director Heith Janke of the FBI Criminal Division, and Special Agent in Charge Tara McLeese of the United States Secret Service (USSS) Washington Field Office.

"Chinese TCOs are sending scammers into your dating network, your social network, and your messaging applications, all to steal Main Street America's bank accounts. For the last year, the Strike Force has fought hard against the compounds in Southeast Asia facilitating these scammers, to the tune of $1 billion in cryptocurrency restrained," said U.S. Attorney Pirro. "My Strike Force will expand and grow, and follow the scammers to Africa, India, Europe, and wherever they try to plant their operations. We will work with international partners to stop the cancerous spread of TCOs perpetrating scams on Americans."

As alleged in affidavits in support of an arrest of six individuals unsealed today, a criminal group with connections to Malaysia and China opened scam compounds in Madagascar in early 2025, likely having moved those operations from Cambodia after law enforcement action in that country.

In the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments. Once connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims' wallets without their knowledge.

Images of beautiful women, used by scammers to meet U.S. victims on dating sites.

Instructions provided to human models (i.e., fake personas of a real person) to perpetrate the scheme.

FBI investigators identified approximately 74 cryptocurrency wallets associated with victims in Maryland, Oregon, Nevada, and Minnesota who reported financial losses after interacting with fraudulent investment platforms online. The funds stolen from the victims were moved to cryptocurrency accounts associated with Chinese-based actors. Additionally unsealed today was a prior warrant wherein the government seized the websites associated with the scheme.

Among the charges unsealed, Chui Kok Wa, was charged with conspiracy to commit wire fraud, as the leader of the NFT Scheme. Wa's phones contained employment contracts, detailing overnight work schedules in Madagascar corresponding with daytime and evening hours in the United States, and providing employees with bonus payments tied to money stolen. Wa's phones also included "scripts" or guides for what scammers should say to victims, which specifically told the workers that they were committing "an emotional scam, using the [victim's] feelings for us to get him to invest." Wa's phone also had a roster that included the employees' names, passport information, salary, hours, disciplinary actions taken against them, and a list of cryptocurrency wallet addresses for the employees.

"The defendants allegedly operated a sophisticated fraud scheme from Madagascar, exploiting the trust of Americans to steal their hard-earned money," said U.S. Attorney Michael J. Heyman for the District of Alaska. "Operating from overseas does not place those who target Americans beyond the reach of U.S. law enforcement, and we will continue working with our domestic and international partners to aggressively hold those responsible accountable. I'm happy to be joining U.S. Attorney Pirro in collaborating and sharing the work on these important cases."

"Cybercriminals running scam centers wrongly assume they can relocate to escape our reach," said Special Agent in Charge Tara McLeese of the U.S. Secret Service Washington Field Office. "Our agents and investigative analysts continue to show that these criminals can be identified, their money can be seized, and they can be held accountable."

"These scam compounds don't stop at borders - they target Americans' vulnerabilities and hard-earned money," said Assistant Director Heith Janke of the FBI Criminal Division. "The FBI, along with our partners at the Scam Center Strike Force, the Department of Justice, and the Secret Service have shown that there is no safe harbor for scammers who target Americans. We will hold you accountable and justice will find you."

Scammers kept track of their U.S. victims by listing their name, location, work, and other personal details in the Contact Cards on their phones.

U.S. Attorney Pirro also noted that this case is emblematic of the spread of TCO actors from Asia spreading into other regions of the world. In August 2026, the FBI deployed a team to Madagascar at the invitation of the Madagascar Ministry of Justice and the Madagascar National Police (MNP) to assist MNP in the take down of 13 scam compounds and the more 3,200 electronic devices seized therein. After deploying, however, the U.S. government was stymied in efforts to interview the individuals involved, and Madagascar repatriated to China numerous suspects before the investigation was complete. Today, U.S. Attorney Pirro called on the Madagascar government to cooperate with the United States, extradite the six charged defendants, and further noted that the government had obtained a material witness warrant to interview 15 employees of the scheme, who claimed they were human trafficked and abused by Wa, but are believed to be held in jail in Madagascar.

Also today, U.S. Attorney Pirro announced other actions taken by her Office in the last year, all related to efforts to protect Americans from scams and covered by President Trump's Executive Order 14390-Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens:

• The Strike Force has restrained $1,006,460,156.82 in cryptocurrency-related fraud and scams.

• The Strike Force has seized 700 fraudulent crypto investment websites, shutting down pipelines used to lure victims.

• The Strike Force has seized Starlink terminals used by scam centers to maintain internet access. In fact, thousands of Starlink terminals have been taken down.

• The Strike Force conducted the first-ever seizure of a Telegram channel used to recruit human trafficking victims into scam compounds. It also seized two additional Telegram channels hosting the Xinbi Guarantee Network, an illicit marketplace setup to provide websites and money laundering services that allows the scam centers to operate.

• The Strike Force, working with foreign partners, has seized and reviewed tens of thousands of devices used in scam compounds, to include computers, servers, hard drives and cell phones.

• The Strike Force, working in collaboration with private industry, had identified millions of scam accounts on U.S. networks. Meta reports that 17.3 million scam accounts have been deplatformed in the last year.

• The Strike Force is leading a national consumer awareness campaign, together with U.S. Postal Inspection Service (USPIS), FBI, and USSS. As part of that effort, the Strike Force has engaged the Ad Council Research Institute (ACRI), the research arm of the nonprofit Ad Council. ACRI's study will examine how scammers target Americans, especially older adults, and which messages are most likely to help people recognize and avoid fraud. ACRI will share its findings over the coming months to guide the development of the Strike Force's campaign.

• The U.S. Attorney's Office for DC along with U.S. Secret Service and the South African Police Service worked together to charge a prolific sextortionist, Ifeel Simango, in South Africa. Simango is charged with extorting at least 54 victims using sexually explicit images of them, including one victim in Switzerland who committed suicide as a result of the scheme. Simango now faces 52 charges in South Africa, including fraud, money laundering, child sexual abuse, and murder.

• The U.S. Attorney's Office for the District of Columbia, along with the U.S. Secret Service and the Nigerian Police Force - National Cyber Crime Center (NCCC), and pursuant to an investigative referral from Microsoft's Digital Crimes Unit, arrested three key players alleged to be responsible for a global cybercrime conspiracy to manufacture and sell illegal "phishing" kits. These kits facilitated business email compromise, ransomware, and financial fraud targeting hospitals within the American health care industry, and victims around the world resulting in the theft of at least 5,000 credentials from 94 countries, and the disruption of critical surgical care. The phishing kit, named RaccoonO365, provided criminals with a means to mimic official Microsoft communications and branding to steal credentials from users of Microsoft's infrastructure (i.e. Outlook.com). By giving criminals a pathway to gain access to American citizens' inboxes, the kits enabled a range of illicit activity, including business email compromise, social engineering fraud, and other cybercrime.

The Strike Force appreciates the work of Microsoft, Meta, Google, Tether, TRM, Elliptic, Chainalysis, Infoblox, and Block6IQ, who have provided voluntary assistance on specific matters announced today. U.S. Attorney Pirro also announced today that OpenAI has committed to working with the Strike Force to counter this threat.

**********************************************

About the Scam Center Strike Force

The Scam Center Strike Force was officially launched by U.S. Attorney Pirro in November 2025 to address the growing threat posed by Chinese organized crime syndicates operating scam centers primarily in Southeast Asia. The Strike Force targets cryptocurrency investment fraud, cyber-enabled fraud, human trafficking, and money laundering operations that have cost American victims billions of dollars.

According to the FBI's Internet Crime Complaint Center (IC3), cyber-enabled fraud schemes were responsible for almost 85% of all losses reported to IC3 in 2025. Within that category, CIF schemes have continued to grow, and the IC3 calculated the reported losses from CIF scams rose, from $4.57 billion in 2023, to $8.65 billion in 2025, an increase of 89%. These figures, largely based on losses reported by victims, likely significantly under-represent the true loss amounts incurred by Americans, since most fraud victims do not report to IC3, if at all.

On March 6, 2026, President Trump signed an Executive Order directing the Administration to prioritize cybercrime, fraud, and predatory schemes draining American families of their life savings. Through the Executive Order, President Trump is unleashing every available tool to stop foreign-backed criminal networks that exploit vulnerable Americans through cyber-enabled fraud. The Scam Center Strike Force is a critical node in executing the mission outlined in the President's Order.

Founded by the U.S. Attorney for the District of Columbia, the Strike Force has been joined it its work by the FBI, the U.S. Secret Service, Justice Department's Criminal Division, the USPIS, IRS Criminal Investigation, and Homeland Security Investigations-D.C. and Colorado Springs, as well as the U.S. Attorney's Offices for the Districts of Alaska, Hawaii, Eastern North Carolina, Rhode Island, and Western Washington. The Strike Force works in collaboration with other federal agencies, including the Treasury and State Departments, and coordinates with the National Coordination Center (NCC) and Homeland Security Task Force (HSTF). The Strike Force works in strategic partnership with private industry and calls on all U.S. businesses to take more proactive steps to protect users from scam operations.

The Scam Center Strike Force will use every tool available to help secure Main Street Americans from these scams. With its interagency and public partners, it will educate Americans on how to identify these scams, prevent generational wealth from flowing from America into the pockets of Chinese organized crime, and work with unwavering focus to return stolen funds to victims.

Assistant U.S. Attorney (AUSA) Karen P. Seifert for the District of Columbia directs the Strike Force. The Madagascar case is handled by AUSA Seifert and AUSA Mac Caille Petursson of the U.S. Attorney's Office for the District of Alaska, along with the FBI's Honolulu Field Office. The cryptocurrency seizure team is led by DC AUSA Rick Blaylock. From the U.S. Secret Service, these cryptocurrency seizure matters are handled by the Global Investigative Operation Center and Field Offices in San Francisco, San Diego, Memphis, Washington D.C., Nashville and Seattle Field Offices. From the FBI, these cryptocurrency seizure matters are handled by the Cyber Enabled Fraud and Money Laundering Unit and Field Offices in Washington D.C., San Francisco, Memphis, Honolulu, Phoenix, San Diego, New York City and Chattanooga. The website seizures were handled by both FBI and USSS, including through the work of the Level Up Initiative.

The Simango case was handled by D.C. AUSAs Matthew Kahn, Jason Facci, and Caroline Burrell along with U.S. Secret Service's Johannesburg Field Office and the South African National Prosecuting Authority.

The RaccoonO365 case is being handled by D.C. AUSAs Matthew Kahn and Jason Facci, along with the U.S. Secret Service Pretoria Resident Office and the U.S. Secret Service Criminal Investigative Division.

The Office of International Affairs, the U.S. Department of State, the Legal Attaches for South Africa & Madagascar, Thailand, and Cambodia, the South African Police Service, the Nigerian Police Force, and the National Prosecuting Authority of Switzerland all provided substantial assistance related to cases announced today.

**********************************************

(Below) Wa's phones also included "scripts" and instructional guides for what scammers should say to victims, which specifically told the workers that they were committing "an emotional scam, using the [victim's] feelings for us to get him to invest."

Scammers instructed U.S. victims how to connect their cryptocurrency wallet to the scam website, where thereafter the scammers pulled out the fund unbeknownst to the victims.