The scam that stole $15 billion, one text message at a time

In May 2025 a retired man in San Francisco got a Facebook message from a woman called Annie. She said she sold microchips in Japan, that she was lonely, and over the following weeks that she had a way to make money in crypto that she would show him. By the time it ended he had wired about $500,000, including one transfer of $300,000, to accounts in Malaysia and Vietnam. His son had spent months warning him and calling the FBI, the police and the banks. The end came when the platform showed a balance of $6 million and asked for a $25,000 “unlock fee” to release it. He had nothing left to pay it with.¹

Five months later, on 14 October 2025, the United States Department of Justice unsealed an indictment in Brooklyn against the man it says ran the machine that produced Annie and thousands like her. Chen Zhi, 37, chairman of Cambodia’s Prince Group, was charged with wire-fraud and money-laundering conspiracy, and the government moved to confiscate 127,271 bitcoin it said were his, worth about $15 billion that day. It was the largest forfeitureCivil forfeitureA US legal action against property rather than a person: the government sues the assets themselves, here 127,271 bitcoin, and must show they are proceeds of crime.Read in the glossary → in the department’s history.²³ This article is about that case: what the machine was, exactly how it takes a person’s savings step by step, what the last twelve months of arrests and sanctions have and have not changed, and the handful of checks that would have stopped every victim quoted here.

If they contacted you firstVerdict

Every victim in this story was approached, not the other way round: a wrong-number text, a Facebook message, a dating match, a sponsored article. Every one was allowed a small early withdrawal, then asked for “taxes” or “fees” before the big one. Every one wired money to a platform that no regulator had authorised. Three checks defeat the entire industry: never invest with someone who reached out to you, never send money to a platform that is not on your regulator’s register, and treat a request for a fee to release your own money as the end of the conversation.

What the machine was

Prince Group was, on paper, one of Cambodia’s largest conglomerates: real estate, a bank, casinos, an airline stake, a $16 billion “eco-city” near Sihanoukville, and a charitable foundation. Its founder held Cambodian citizenship, a royal honorific reserved for donors of at least $500,000, and an adviser’s title to two prime ministers.⁴⁵

According to the 68-page forfeiture complaint, it was also the operator of at least ten scam compoundsScam compoundA guarded site, often a former casino or hotel, where trafficked workers run online scams under quota, with confiscated passports and physical punishment.Read in the glossary →: walled sites with dormitories, barbed wire and guards, where trafficked workers ran scripted conversations with targets abroad. Three are named, including a complex attached to the Jinbei casino in Sihanoukville. Chen’s own ledgers recorded which building and which floor ran which scheme, using the Chinese term for the fraud, sha zhu pan, “pig butcheringPig butcheringA long-con investment scam: the scammer builds a relationship for weeks (“fattening”), steers the victim into a fake trading platform, then vanishes with everything (“butchering”).Read in the glossary →”. Internal documents describe two “phone farms” of 1,250 handsets controlling 76,000 social-media accounts, with instructions to use profile photos of women who were not “too beautiful”, so the accounts looked real. One associate boasted that in 2018 the group was earning “over $30 million a day”. A laundering cell in Brooklyn alone moved more than $18 million from over 250 American victims in fifteen months.³

The money left the way scam money leaves: wired by victims to muleMoney muleA person, or a bank account in their name, used to receive a victim’s transfer and pass it on, so that the fraud’s bank trail ends with someone who is not the scammer.Read in the glossary → bank accounts, converted to stablecoinsStablecoinA crypto token pegged to a currency, usually the US dollar (Tether’s USDT is the largest). Fast, borderless and dollar-denominated, which is exactly why scam networks settle in it.Read in the glossary →, sprayed across hundreds of wallets, and partly pushed through Prince-controlled bitcoin mining operations in Laos, Texas, China and Iran to come out the other side as freshly mined, clean coins. “The profit is considerable,” Chen wrote, “because there is no cost.” Proceeds bought watches, yachts, private jets, London property and a Picasso through a New York auction house.³⁶

The same day, the US Treasury designated 146 people and companies under OFAC sanctionsOFAC sanctionsDesignations by the US Treasury’s Office of Foreign Assets Control that freeze a person’s or company’s US-reachable assets and make it illegal for US persons and banks to deal with them.Read in the glossary → and cut Huione Group, the Cambodian marketplace that had laundered at least $4 billion for scam networks, off from the US financial system. The United Kingdom froze a £12 million mansion in north London, a £100 million office block in the City and 17 flats.⁷⁸ Treasury also put a number on the damage: Americans lost at least $10 billion to Southeast Asia-based scam operations in 2024 alone, up 66% in a year.⁷

Twelve months later

Twelve months of enforcement against Prince Group

From the US indictment to this week. Hover each point for what happened.

What happened next is unusual for a fraud case: the pressure did not stop. Singapore seized a record set of assets in October. Cambodia revoked Chen’s citizenship in December, arrested him in January 2026 and sent him not to the United States, with which it has no extradition treaty, but to China, where prosecutors have since added a charge of intentional injury that can carry the death penalty.⁹¹⁰ Taiwan indicted 62 people and seized $170 million. The United Kingdom sanctioned the crypto marketplace Xinbi, which had processed $19.9 billion, and the operator of “#8 Park”, a compound built for 20,000 workers. The European Union listed Prince Group in July. The United States sanctioned a second and then a third wave of lieutenants and marketplaces, the last on 9 September 2026, and this week restricted visas for 32 more people.^11121314

Two things have not changed. First, the compounds did not close so much as move: the United Nations counted more than 300,000 people trapped in scam centres across Southeast Asia in July 2026, and reported the model spreading to the Middle East, Africa, Eastern Europe and Latin America in smaller, dispersed sites.¹⁵¹⁶ Second, almost none of the $15 billion has reached a victim. The Justice Department had rejected most claims on the bitcoin by March 2026 and had announced no compensation scheme by September.¹⁷ The man in San Francisco is not getting his $500,000 back from this seizure, and neither is anyone else in this article.

How it works, step by step

The complaint sets out four stages. Victims, regulators and a French reporter who got inside a compound fill in the rest.³¹⁸¹⁹

1. First contact from a fake identity. A text to the wrong number, a Facebook message, a dating-app match, a LinkedIn note. The persona is warm, attractive and slightly too available. The FTC found that nearly 60% of romance-scam losses in 2025 began on social media, with Facebook, WhatsApp and Instagram the costliest platforms.²⁰ Accounts are bought in bulk: one Chinese-language marketplace sells aged Gmail and Tinder accounts specifically “to target pig butchering victims”, with Telegram customer support.²¹
2. Rapport, for weeks. A worker inside a Cambodian compound told franceinfo he received a list of 200 phone numbers every morning and followed “a very precise script”. A French recruit was paid €5,000 a month to translate scripts for French-speaking targets in a building with Spanish, German, Turkish and English-language floors.¹⁸ The United Nations says trafficked workers must add up to fifteen new contacts a day to meet quota.¹⁵
3. The mentor. The persona turns out to trade crypto, or has an uncle who does. The victim is walked through installing an app or opening a website that the scammers control. The dashboard is real software showing fake numbers. The first deposit is small: Pascal, a 60-year-old engineer in Lyon, started with €250, “rapidly tripled on screen”.²²
4. The withdrawal that works. This is the step that converts doubt into trust. A French engineer told franceinfo he “managed to withdraw €1,000”, then made about ten transfers. Pascal was allowed to take out €4,000 “presented as gains” before he moved €195,000 from his Canadian accounts and then money from family and his business.¹⁸²² The FBI notes that scammers also “offered loans to encourage larger investments” and told victims to borrow from friends and family.¹⁹
5. The bank tries to intervene. When a transfer is flagged, the platform coaches the victim on what to tell the bank. In a Massachusetts case charged in January 2026, a Cambridge Tinder user who sent $504,353 was told “how to evade restrictions”.²³
6. The wall of fees. When the victim finally asks to withdraw, the platform invents taxes, “verification deposits” or unfreezing fees. Pascal’s screen showed more than €1 million; when he asked for it, “the interlocutors became aggressive and demanded” more money. He lost €350,000.²²
7. Butchering. “The perpetrator would disengage the victim once the victim’s funds were stolen, generally cutting off all contact,” the complaint says.³
8. The second wave. Victim lists are resold. In August 2025 the FBI warned of fake law firms that contact victims, know the exact amounts and dates of their transfers, cite an invented “International Financial Trading Commission”, and charge a fee in crypto or gift cards to “recover” the money. That is the recovery scamRecovery scamA second fraud aimed at people who have already been scammed: a fake law firm or “regulator” offers to recover the lost money for an upfront fee, paid in crypto or gift cards.Read in the glossary →, and it takes people who have already lost everything for what they can borrow.²⁴

The numbers

The FBI’s Internet Crime Complaint Center received just over a million complaints in 2025 and counted $20.9 billion in reported losses, up 26% in a year. Investment fraud was the largest category at $8.65 billion, and cryptocurrency investment fraud alone, $7.2 billion, was “the highest source of financial losses to Americans in 2025”, which the FBI attributes largely to organised groups in Southeast Asia using trafficked labour.²⁵ The FTC, which counts differently, recorded $15.9 billion in reported fraud losses, half of it investment scams.²⁶²⁷

What Americans report losing to fraud, by year

Billions of dollars reported to the FBI (IC3) and to the FTC. Both series count only what victims report.

Age is the strongest predictor of how much is lost. People over 60 filed 201,266 complaints in 2025 and lost $7.7 billion, an average of $38,500 each; 12,444 of them lost more than $100,000.²⁵ The FTC’s median figures tell the same story from the other end: a typical victim in their twenties loses a few hundred dollars, a typical victim over 80 loses $6,000.²⁸

Who loses the money: 2025 losses by age

Reported to the FBI in 2025, billions of dollars. Grey is all fraud; amber is investment fraud alone.

The older the victim, the bigger the loss

Median individual loss reported to the FTC in 2024, by age of the victim.

Chainalysis, which follows the money on the blockchain rather than through complaints, traced at least $14 billion into scam wallets in 2025 and expects the final figure to pass $17 billion. The average payment to a scam rose from $782 to $2,764 in a year, which the firm reads as fewer, better-targeted, more convincing operations, helped by AI-written scripts and deepfakes.²¹ The United Nations puts total scam losses in East and Southeast Asia, Australia and New Zealand at between $88 billion and $114 billion for 2025.²⁹

France

France has its own version of the industry, and the same fingerprints. The AMF, the markets regulator, warned on 19 August 2026 of a “multiplication” of scams dressed as press articles: cloned pages of franceinfo, Le Monde, TF1 and Le Figaro, reached through sponsored posts, carrying fake interviews with Bernard Arnault and a fabricated confrontation between Élise Lucet and the chief executive of BNP Paribas, all steering readers to a platform called BitKelTrade that holds no authorisation anywhere.³⁰³¹ Pascal’s €350,000 started with exactly this: a sponsored deepfake of the actor Jean Reno.²²

The Paris prosecutor, the AMF, the banking supervisor and the consumer-fraud agency estimate that financial scams cost French savers about €500 million a year, and that 3.2% of the population has probably been a victim of an investment scam, roughly 1.5 million people, up from 1.2% three years earlier. Forty-five per cent of victims are men under 35.³² Cybermalveillance.gouv.fr, the state help service, assisted more than 500,000 victims in 2025 and recorded a 277% rise in fake-investment cases and a 159% rise in fake bank adviserBank spoofing (“faux conseiller bancaire”)A caller shows your bank’s real phone number on your screen, claims to be its anti-fraud service, and talks you into “securing” your money by validating transfers or handing over codes.Read in the glossary → cases.³³

France: fraud by manipulation, 2021 to 2025

Millions of euros lost to fake bank advisers, fake anti-fraud services and similar cons. Now 41.6% of all payment fraud.

The Banque de France’s payment-security observatory counts a category it calls fraud by manipulation: fake bank advisers, fake anti-fraud services, fake executives and swapped IBANs. It reached €516 million in 2025, up 34%, and now makes up 41.6% of all payment fraud in France, a share that has doubled in four years while card fraud fell to a historic low.³⁴³⁵ The victims are not who most people assume: reports to the police peak among 20-to-24-year-olds, and people aged 18 to 44 are more than 70% of them.³⁴

A French engineer described his case to franceinfo in May 2026: a woman called Kexin Lin on Facebook, a €1,000 test withdrawal, ten transfers, and the whole of the life-insurance inheritance from his mother gone. “I was living a dream,” he said, “and the dream costs dearly.”¹⁸ A doctor identified as Pierre told TF1 how a West African “brouteur” posing as Élodie took €402,000 over three years, including a courier who delivered a case of “burnt” banknotes; the courier was convicted in Marseille.³⁶ Same outcome, two industries: the artisanal romance scam and the industrial one.

What the law refunds, and what it does not

For the fake bank adviser, French law is on the customer’s side more often than banks admit. A payment the customer did not authorise must be refunded unless the bank proves the customer’s gross negligenceGross negligence (“négligence grave”)The legal test that decides whether a French bank must refund an unauthorised payment. The bank has to prove it; a customer tricked by a convincing call is usually not grossly negligent.Read in the glossary →, and the burden of proof is the bank’s. The Cour de cassation ruled in October 2024 that a woman who validated €54,500 of transfers during a spoofed call was not grossly negligent, extended the same protection to professionals in June 2025, and held in July 2026 that strong authentication does not by itself prove consent.³⁷³⁸ Lower courts have ordered Crédit Agricole and La Banque Postale to refund spoofing victims this year.³⁹⁴⁰ The court did tighten the line in March 2026 for a customer who confirmed operations in the app after an explicit warning message, so the protection is real but not unconditional.⁴¹

For pig butchering the law offers much less, because the victim authorised the transfers. The refund regime does not apply. Recovery depends on criminal seizures: a North Carolina man who lost $753,000 was told by a federal agent that about $630,000 might come back, and a year after reporting had received nothing; the Cambridge victim’s $200,000 in seized crypto is tied up in forfeiture proceedings.⁴²²³ Only the United Kingdom runs a mandatory reimbursement scheme for authorised push-payment fraud, which returned 89% of losses in covered cases in 2025.⁴³ In France and Belgium there is no such fund.⁴⁴

How to protect yourself

• If they contacted you first, it is a scam until proven otherwise. Not “probably”. Every case above started with an approach. The FTC’s rule is blunt: never let someone you met only online direct your investment decisions.²⁰
• Check the register, not the website. In France, an intermediary must appear on the ORIAS register, an investment firm on the REGAFI register, a crypto provider must hold MiCA authorisation, and the AMF and ACPR publish blacklistsAMF blacklistThe French regulator’s public lists of websites and firms offering investments without authorisation. Being on it is disqualifying; not being on it proves nothing, so also check the authorisation registers.Read in the glossary → of unauthorised offers; the I-SCAN portal now aggregates the blacklists of more than 150 regulators.⁴⁵ In the United Kingdom, the FCA register; in the United States, FINRA BrokerCheck and Investor.gov. Absence from a blacklist proves nothing. Absence from the authorisation register is disqualifying.
• The small withdrawal is the trap. Being allowed to take out €1,000 or €4,000 is a designed step, not evidence that the platform pays.¹⁸²²
• No legitimate platform charges a fee to release your own money. Taxes, verification deposits, unfreezing fees, “liquidity” payments: each one is the moment to stop, not to negotiate.¹⁹²⁴
• If a platform tells you what to say to your bank, your bank is right. Coaching to get past a fraud check is itself the proof of fraud.²³
• Talk to someone outside the conversation before any transfer above what you could lose. The San Francisco retiree’s son was right for months and could not stop it; a phone kept warm is designed to keep you from hearing him.¹⁴⁶
• Report within hours, not weeks. In France: a complaint at the commissariat or gendarmerie, Perceval for card fraud, Pharos for online content, SignalConso, and Cybermalveillance.gouv.fr for guidance. In the United States, IC3; in the United Kingdom, Action Fraud. The FBI’s kill-chain procedure can sometimes claw back a fresh wire; it cannot touch one that is two weeks old.⁴²
• After a loss, expect the second call. Anyone offering to recover your money for an upfront fee, in crypto or gift cards, is the recovery scam. Legitimate authorities do not charge to return funds.²⁴

Bottom line

The Prince Group case is the first time the pig-butchering industry has been named, sanctioned and prosecuted as what it is: a corporate enterprise with ledgers, phone farms, a bank and a mining fleet, run on forced labour and revenue of tens of millions of dollars a day. The enforcement of the last year is real and unprecedented. It has also recovered almost nothing for the people whose savings built the fortune, and the compounds have moved rather than closed. Which leaves the defence where it always was, with the reader. The scam needs you to believe three things: that a stranger reached out because they liked you, that a dashboard is money, and that a fee will unlock it. Refuse the first and the other two never arrive.

Sources

All links accessed 22 September 2026.

Footnotes

1. ABC7 News, “7 On Your Side: Bay Area retiree ignores warnings and wires $500K life savings to fake woman in pig-butchering scam”, 19 February 2026. ↩ ↩²

2. US Department of Justice, “Chairman of Prince Group Indicted for Operating Cambodian Forced Labor Scam Compounds”, 14 October 2025. ↩

3. US District Court, Eastern District of New York, civil forfeiture complaint, United States v. approximately 127,271 bitcoin, case 1:25-cv-05745, filed 14 October 2025. ↩ ↩² ↩³ ↩⁴ ↩⁵

4. CNN, “The young tycoon accused of masterminding a multibillion-dollar scam empire”, 24 October 2025. ↩

5. France 24, “Chen Zhi, ce mystérieux homme d’affaires accusé d’être le parrain du cybercrime”, 5 December 2025. ↩

6. Les Echos, “Fermes de téléphones, esclaves et « pig butchering »: cette saisie de 15 milliards de dollars en bitcoins qui révèle un empire de la cyberfraude”, 15 October 2025. ↩

7. US Treasury, “U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia”, 14 October 2025. ↩ ↩²

8. GOV.UK, “UK and US take joint action to disrupt major online fraud network”, 14 October 2025. ↩

9. BBC News, “Chen Zhi: Cambodia extradites alleged scam mastermind to China after arrest”, 8 January 2026. ↩

10. The Diplomat, “Alleged Cambodia Scam Kingpin Chen Zhi Could Face the Death Penalty in China”, 29 July 2026. ↩

11. OCCRP, “Taiwan and Singapore Add to Growing Action Against Alleged Cambodian Crime Group”, 4 March 2026. ↩

12. GOV.UK, “UK crackdown on vile scam centres steps up with sanctions on illicit crypto network”, 26 March 2026; OCCRP, “EU Sanctions Target Prince Group and its Chairman Chen Zhi”, 30 July 2026. ↩

13. US Treasury, “Treasury Cracks Down on Transnational Criminal Organization Behind Cyber Scam Operations Targeting Americans”, 9 September 2026. ↩

14. Bangkok Post (Reuters), “US imposes visa curbs on 32 people linked to Prince Group”, 22 September 2026; GOV.UK, “UK and Cambodia join forces to take down online scam networks”, 22 September 2026. ↩

15. UNODC, “Forced to scam: Inside one of the fastest-growing forms of human trafficking”, 27 July 2026. ↩ ↩²

16. Lowy Institute, “Asia’s scam centre problem is moving on, not shutting down”, 16 April 2026. ↩

17. ICIJ, “Questions swirl around US plans for record $15B Prince Group crypto seizure”, 18 March 2026. ↩

18. franceinfo, “Centres d’arnaques en ligne: comment dépouillent-ils leurs victimes?”, 10 May 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

19. FBI IC3, 2025 Internet Crime Report, “Cryptocurrency Investment Fraud”, 2026. ↩ ↩² ↩³

20. FTC, “New FTC Data Show People Have Lost Billions to Social Media Scams”, 27 April 2026. ↩ ↩²

21. Chainalysis, “2026 Crypto Crime Report: Scams”, 14 January 2026. ↩ ↩²

22. Pleine Vie, citing TF1 and RMC, “Il perd 350 000 € à cause d’une arnaque au deepfake”, 24 February 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

23. Boston Herald, “Massachusetts resident on Tinder swindled out of $500,000 in fraud scheme: Feds”, 13 January 2026. ↩ ↩² ↩³

24. FBI IC3, “Fictitious Law Firms Targeting Cryptocurrency Scam Victims”, 13 August 2025. ↩ ↩² ↩³

25. FBI IC3, 2025 Internet Crime Report, 2026. ↩ ↩²

26. FTC, “FTC Testifies before the Joint Economic Committee on Agency’s Efforts to Combat Fraud”, 25 March 2026. ↩

27. FTC, “FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025”, 15 June 2026. ↩

28. FTC, Protecting Older Consumers 2024–2025, report to Congress, December 2025. ↩

29. UNODC, “New UNODC report reveals scale of South-East Asia’s ever more interconnected criminal economy”, 21 July 2026. ↩

30. AMF, “L’AMF appelle l’attention des épargnants sur la multiplication des arnaques prenant la forme de faux articles de presse”, 19 August 2026. ↩

31. RMC, “Placements financiers: l’AMF alerte contre la plateforme BitKelTrade et ses méthodes d’arnaque de masse”, 20 August 2026. ↩

32. AMF, Parquet de Paris, ACPR and DGCCRF, joint press release on financial scams, 19 December 2024. ↩

33. Cybermalveillance.gouv.fr, “Rapport d’activité et état de la menace 2025”, March 2026. ↩

34. Banque de France, Rapport de l’Observatoire de la sécurité des moyens de paiement 2025, 7 September 2026. ↩ ↩²

35. Capital, “Faux conseiller bancaire, SMS: les escroqueries ont bondi de 34% en un an”, 8 September 2026. ↩

36. TF1 Info, “‘J’ai perdu une vie de travail’: un médecin explique comment un brouteur lui a soutiré 400.000 euros”, 13 March 2026. ↩

37. Décideurs Juridiques, “Spoofing bancaire: quand la Cour de cassation redessine les frontières de la négligence grave”, 20 April 2026, on Cass. com. 23 October 2024, no. 23-16.267 and 12 June 2025, no. 24-13.777. ↩

38. Kohen Avocats, “Virement frauduleux: l’authentification forte ne prouve pas le consentement, Cass. com. 1er juillet 2026, no. 25-13.134”, 7 July 2026. ↩

39. Capital, “Une banque sommée de rembourser une cliente qui avait fourni ses codes à un faux conseiller bancaire”, 11 February 2026. ↩

40. Clubic, “Fraude bancaire: piégé par spoofing, un client de La Banque Postale se fait rembourser”, 26 February 2026. ↩

41. JSS, “Spoofing: un tournant défavorable aux consommateurs?”, 1 April 2026, on Cass. com. 4 March 2026. ↩

42. WRAL, “Fuquay-Varina man scammed out of $700,000 awaits any return of his money”, 22 June 2026. ↩ ↩²

43. UK Finance, “Fraud remains a national security threat as criminals steal almost £1.3 billion”, 15 June 2026. ↩

44. L’Avenir, “Il a perdu 85 000 euros dans une arnaque aux cryptomonnaies: existe-t-il un organisme pour indemniser les victimes?”, 19 January 2026. ↩

45. AMF, “I-SCAN: le portail unique d’accès aux listes noires de plus de 150 régulateurs”, 23 May 2025. ↩

46. FTC, “False alarm, real scam: how scammers are stealing older adults’ life savings”, August 2025. ↩