Madagascar raids expose alleged links between scam networks in Cambodia and Africa

Authorities in Madagascar say raids on online scam centres have uncovered links to criminal networks that previously operated in Cambodia, as investigators examine how fraud operations have shifted from South-east Asia to Africa.

The operations, which involved Chinese nationals and allegedly recruited African workers through social media, ran romance scams, cryptocurrency fraud and investment schemes.

Investigators said some recruits were brought to Madagascar with promises of legitimate employment before having their passports confiscated and being forced to participate in online fraud.

Madagascar’s Justice Ministry said 13 Chinese-run scam compounds were dismantled in operations conducted in August and September, with assistance from the United States Department of Justice (DOJ).

A total of 148 Chinese nationals were extradited to China, the ministry said. The authorities also seized cryptocurrency and examined thousands of electronic devices as part of the investigation.

The crackdown has raised questions about the movement of organised cybercrime networks between regions following law-enforcement operations against scam compounds in Cambodia.

Workers allegedly recruited through Facebook

Authorities said the compounds recruited African nationals through social media advertisements offering jobs in Madagascar’s commercial sector.

Around 20 nationals from Kenya, Rwanda, Uganda and Zimbabwe were in custody in connection with the investigation, according to Malagasy officials.

Hassan Mouigni, chief of the police criminal investigation unit, told AFP that the recruits had said they were approached through Facebook and promised employment.

“According to their statements, they were recruited via Facebook to come work in Madagascar in the commercial sector,” he said.

“But when they arrived here, most of the passports were confiscated by the boss and they were forced to scam. They were victims of deception.”

The alleged practice resembles recruitment methods documented at scam compounds in South-east Asia, where people have been lured by fake job advertisements and subsequently forced to carry out online fraud.

Madagascar’s cybercrime unit coordinator, Tsitohaina Ralihivao, said the operations required workers who could communicate in English because their targets included people in the United States, Canada and Pakistan.

The presence of the compounds became more visible in Antananarivo as operators expanded beyond renting private villas to taking over entire hotels, Mouigni said.

US investigation identifies Malaysian suspect and links to Cambodia

A US Department of Justice investigation has identified a criminal group with connections to Malaysia and China that allegedly established scam compounds in Madagascar in early 2025 after moving operations from Cambodia.

The DOJ said the group was led by Malaysian national Chui Kok Wa, who was charged with conspiracy to commit wire fraud in the United States.

According to an affidavit filed in a US federal court, the operation used dating websites to approach victims, with workers posing as women seeking romantic relationships.

After building trust, they encouraged victims to invest in cryptocurrency through fraudulent websites and platforms.

The victims were persuaded to connect their cryptocurrency wallets to the websites and transfer funds.

The operators allegedly used the access to take cryptocurrency from the wallets without the victims’ knowledge.

The FBI identified about 74 cryptocurrency wallets associated with approximately 800 people across the United States who reported losses after interacting with fraudulent investment platforms.

The DOJ said Chui’s phones contained employment contracts setting out overnight working schedules in Madagascar to correspond with daytime and evening hours in the United States. The documents also included bonus payments linked to money stolen from victims.

Investigators found scripts instructing workers how to persuade victims to invest. One described the operation as an “emotional scam”, using victims’ feelings to encourage financial transfers.

The DOJ announced charges against six people in connection with the scheme on 27 October. The defendants included Chui and five African nationals. The charges are allegations and have not been established as convictions in the US proceedings.

The US authorities said they believed the criminal group had moved its operations from Cambodia following law-enforcement action there.

Ralihivao linked the relocation to a 2025 crackdown on scam compounds in Cambodia near the Thai border, which took place amid armed clashes between the two countries.

“When the Thais dismantled them, they just relocated the operations. The same organisations came to Madagascar,” he told AFP.

An FBI court document also recorded interviews with three Brazilian nationals who had worked at a scam compound in Antananarivo. They said they had initially responded to online job advertisements and ended up working in Cambodia before being moved to Madagascar in early May 2026.

The FBI said their accounts were consistent with information from other investigations indicating that cyber scam centres were increasingly opening in Africa after compounds in South-east Asia were shut down.

More than US$52 million in cryptocurrency restrained

The US DOJ said its Scam Center Strike Force deployed a team to Madagascar in August at the invitation of the country’s Justice Ministry and National Police.

The team assisted Malagasy investigators with the examination of more than 3,200 electronic devices seized from 13 scam compounds.

The DOJ said the operation also resulted in approximately US$52 million in cryptocurrency being restrained in a single day.

The funds were connected to an online marketplace called Xinbi Guarantee, which allegedly provided services to scam operators, including money laundering, the creation of fraudulent investment websites and the recruitment of trafficking victims.

The US authorities said the marketplace operated through Telegram and connected vendors offering services to criminal groups running scam centres.

The DOJ described the action as part of a wider effort to disrupt the financial infrastructure supporting cyber-enabled fraud.

In a separate announcement on 27 October, the department said its investigation had identified the alleged Madagascar-based fraud scheme and led to charges against six defendants.

It also said the US government had restrained more than US$1 billion in cryptocurrency through the work of its Scam Center Strike Force since its establishment in November 2025.

Questions over extraditions and detainees held in Madagascar

The crackdown has also raised questions about the treatment and legal status of people detained during the operations.

Madagascar’s Justice Ministry told AFP that 148 Chinese nationals had been extradited to China.

The ministry has separately described the transfers as part of judicial cooperation with Beijing, including the transfer of convicted Chinese nationals to serve the remainder of their sentences in China.

In a statement published on its website, the ministry said the first group of 50 Chinese nationals convicted of offences linked to online fraud was transferred from Avaradrano Central Prison to China on 7 September.

It said the operation was conducted in cooperation with Interpol and the Chinese embassy.

The ministry said the transfers were carried out under applicable legal procedures and formed part of cooperation between the two countries against transnational crime.

However, the US DOJ said its investigators were unable to interview several Chinese nationals identified as leaders of the compounds because they had already been repatriated to China or were no longer in Malagasy custody.

The department said it had sought Madagascar’s cooperation in extraditing the six defendants charged in the US case.

It also said it had obtained a material-witness warrant to interview 15 employees who claimed they had been trafficked and abused by Chui.

The DOJ said those individuals were believed to be held in a Madagascar prison.

Eleven Chinese detainees leave prison without authorisation

The investigations have also been overshadowed by a separate prison scandal involving 11 Chinese nationals arrested in connection with online scam operations.

The detainees reportedly left Madagascar’s Avaradrano prison in August following transfers that were not supported by the required authorisations.

According to an account published by Radio France Internationale (RFI), five detainees were taken out of Antanimora prison on 21 August, around 50 minutes after being admitted. Four days later, six others were released after spending approximately 32 minutes in the facility.

The Justice Ministry said the transfers had been requested on the grounds of disputes among Chinese detainees. However, the required administrative procedure had not been followed.

The incident became public in October and prompted investigations into possible misconduct by prison officials.

Several prison administration personnel were subsequently placed under judicial investigation, according to Malagasy media reports. 

UN warns scam networks are expanding beyond South-east Asia

The developments in Madagascar come amid warnings from the United Nations Office on Drugs and Crime (UNODC) that scam-centre networks have expanded beyond their original bases in South-east Asia.

In an April 2025 report, UNODC said criminal groups involved in online fraud were increasingly operating across international borders, with people from dozens of countries identified in scam compounds.

The report documented the involvement of nationals from African countries, including Kenya, Madagascar, Rwanda, Uganda and Zimbabwe, alongside people from Asia, Europe and the Americas.

It also described how criminal groups recruit people through deceptive employment advertisements before forcing them to carry out online fraud.

A separate UNODC paper published in October 2025 examined the relationship between cybercrime, corruption and human trafficking.

It said scam-centre operators used false job advertisements to lure people into compounds, where victims could be forced to commit crimes under abusive conditions.

The agency warned that criminal networks could relocate their operations to areas with weaker governance and enforcement capacity when authorities intensified action against them elsewhere.