Trafficked Trust, Part 1

Fake Love & Forced Labor

Stolen hearts on one end, confiscated passports on the other. Who actually runs a scam conversation?

Trafficked Trust is a series from Sunrise Sector, an AI-powered threat intelligence company focused on the scam economy. This series is about the human infrastructure behind fraud - because, as this first post argues, the human structure and technical fingerprints are a shared story.

One Conversation, Two Victims

Somewhere right now, two strangers are locked in a conversation that will damage them both.

One of them feels loved. He wakes up to Good morning darling messages from a friend who remembers everything and always checks in to see how his workday was. His cryptocurrency investments are doing well, and he checks a dashboard daily to see his growing returns. He will move his savings into that dashboard in the coming months. And then his retirement. Then, to withdraw his incredible earnings, he’ll need to borrow just a little bit of money to pay taxes to the investment platform. And then just a little bit more to pay fees. Unfortunately, no matter how much he pays, he will never be allowed to withdraw his money from that platform.

What he doesn’t know is his “friend” is working long shifts against a daily quota, from a guarded building the friend cannot freely leave, in a country the friend may never have chosen to enter. The friend answered a job ad, possibly for customer service, marketing, or data entry. The salary was enough to travel internationally for the first time, maybe even borrowing money to pay for the ticket. The passport confiscation came after arrival. The conversation these two are having is scripted, artificial. The punishment for missing quotas is not.

The deposits are real, even if the returns on the dashboard are not. It leaves the first person’s bank as wire transfers and stablecoins, moves through wallets and over-the-counter brokers and laundering marketplaces, and lands with people nowhere near the conversation.

It is all too easy to slap a one-word label onto the story and move on: scam. That four letter word is carrying a lot of weight. What do folks do next? Believing they know the villain, they close the case and move on. The money is gone, it can’t be recovered, don’t fall for the next scam. This story has been told thousands of times. Tens of thousands of times. Hundreds of thousands of times.

The chapter of the story that is rarely shared, though, is from the people following the scripts, sending the Good morning darling messages. A large share of these people are trafficked, working inside what are functionally prison-factories for fraud. Holding both facts at once - the person typing may be a victim and the person sending money is a victim - is the point of this blog series. Not to excuse the harm, but to put the machine that produces it on display.

Identifying and tracking that machine is the job of Sunrise Sector, a threat intelligence company. We track the fraud infrastructure - the domains, the fake trading platforms, the wallets, the money laundering - and ship indicators that let defenders act. So why does our blog open with a post about forced criminality? Because, as we will show, the labor structure is where the technical signals originate. You cannot fully understand the indicators without understanding the workplace that generates them.

A Note On Words

You likely know this fraud as “pig butchering”. That name is the criminal’s own - from the Chinese phrase sha zhu pan, slang for fattening a pig before slaughter - and it casts the defrauded person as livestock. This language acts as a gift to the criminal syndicates behind this activity by keeping victims from coming forward, effectively silencing them. We prefer the term “romance scam”. Alternatively, INTERPOL has recommended “romance baiting”.

Keep in mind, however, that a criminal industry’s internal vocabulary - for victims, its workforce, and more - is itself intelligence. When an operation’s slang treats the people it defrauds as animals to fatten and the people it employs as animals to work, it is telling you, in its own words, exactly what it is. We do not prefer the language, but we will quote it in specific situations.

Understanding The Scale Of The Problem

None of the human cost here is speculative. The UN Human Rights Office of the High Commissioner, in a February 2026 report bluntly - and aptly - titled “A Wicked Problem”, documented torture, sexual violence, and prison-like conditions in scam centers. This report estimates that at least 300,000 people are working in scam centers, trafficked from 66 countries. A June 2025 report from INTERPOL revealed that 74 percent of related human trafficking victims were brought to SE Asia, where the highest density of scam centers can be found. INTERPOL also highlighted that new scam centers had been identified in the Middle East, West Africa, and South America. The United Nations Office on Drugs and Crime puts the industry’s annual profits near forty billion dollars, driven by syndicates evolving into what are, in effect, full-service criminal providers.

The fraud side of the ledger is just as documented. According to the FBI’s 2025 Internet Crime Complaint Center (IC3) Report, US victims alone reported over $20.9 billion in losses in 2025, with investment fraud - the category romance scams drive - the largest and fastest-growing slice at $8.6 billion. Chainalysis tracked approximately $17 billion flowing to scam operations in 2025. The laundering marketplaces that service this economy have processed volumes measured in the tens of billions.

We understand the scale of the coercion, and the scale of the theft. What is far less often connected - and a key component for why Sunrise Sector exists - is the causal line running from the coercion to the theft. To draw that line, you must see a scam compound for what it is: A workplace.

The Org Chart Of A Compound

Strip away the horror for a moment and look at a scam compound the way you'd look at any business with thousands of employees, because structurally that's what it is: a call center with a razor-wire perimeter. And an org chart.

Every scam compound is different, but let’s take a look at the general organizational structure. Keep in mind that each scam organization is considered a “company”, and that a given scam compound houses dozens of companies - including electronics stores, coffee shops, and scam organizations.

At the bottom: The keyboard workers. The people in the seats, running the conversations - the ones a defrauded person is actually talking with. Many are trafficked; they are recruited for language skills, matched to victim markets, and interchangeable by design. A worker who escapes or is sold to another compound is replaced, and the conversations continue without the victims noticing. Note the word interchangeable, because that is where the technical story begins.

Next layer up: The supervisors and enforcers. The layer that runs quotas and administers punishment. In the US prosecution of the Shunda compound in Myanmar, a trafficking victim “personally witnessed HUANG participate in beatings of compound workers” at KK Park, a notorious scam compound in Myanmar. “HUANG” is Huang Xingshan, a high-level scam compound manager. This is where coercion stops being an abstraction and becomes a daily operating procedure.

Above them: The operators and the money. The people who own the "companies," run the fraudulent investment platforms, purchase victim data, and move the proceeds. These are the “bosses”. This is where trafficked labor ends and willing, profiting participation begins.

Around all of it: The hosts. The compound sits on land someone leases, in a zone someone administers, behind protection that someone sells. UN reporting has documented immigration officers coordinating with recruiters and police collecting payments from compound managers - corruption it describes as deeply entrenched. A compound is not a rogue building. It is an institution with a landlord.

Connecting Every Layer: The Vendors. Compounds do not exist in isolation. An entire ecosystem forms around them. Local vendors selling food, coffee, clothes, and other wares. The compound buys social media accounts in bulk from online marketplaces. It rents SMS verification services by the thousand. It leases VPNs and proxy infrastructure to make its workers appear to be in Singapore or Japan. It deploys fake & fraudulent trading platforms built from template kits - near-identical sites and apps that differ only in language pack and deposit address. It launders proceeds through "guarantee" marketplaces that function as criminal escrow services. These vendors have established what is, effectively, a supply chain of specialized criminal service providers.

The Forced Labor Structure Is the Reason The Fraud Is Detectable

Consider what the labor model requires, and the related traceable artifacts:

Interchangeable workers require standardized conversation scripts. A rotating, coerced, quota-driven workforce can’t improvise; it executes conversation flows. The standardization is so severe that the operations themselves treat it as a vulnerability: scam playbooks acquired by Sunrise Sector include explicit instructions to randomize selection so that no two workers send identical openers. The conversation scripts we’ve examined target eight specific pieces of information from every victim: name, age, occupation, location, marital status, income, investment experience, and cryptocurrency familiarity. These are required datapoints before the conversation can advance to the investment pitch.

Industrial scale forces templated infrastructure. The scale of the fraud operations is so massive that it is not feasible to hand-build a fake exchange for each victim. The platforms are kits: near identical sites and apps where little changes, sometimes not even the deposit address or server backend. Templates yield indicators: domains, TLS certificates, app hashes, hosting patterns. The shared code, these attributes, the common backends - these are what enables Sunrise Sector to track this malicious infrastructure. In our analysis of one platform kit, a single template produced over a dozen lookalike domains across multiple registrars in a matter of weeks, each differing only in branding details and wallet addresses.

Compartmentalization leaves architectural fingerprints. The fraud funnel is not monolithic - it is divided across specialized workstations and roles. Some workstations are dedicated to handling front-end social engineering (persona fabrication, LinkedIn targeting, romance openers). Others handle mid-stage grooming, such as cryptocurrency onboarding tutorials, exchange registration guides, and blockchain primers. Other dedicated systems, used by personnel more closely aligned with the supervisors and operators, handle the cryptocurrency wallets and associated funds.

Shift work leaves rhythms. Quotas, schedules, and provisioning cycles show up as timing patterns. When was a domain registered? When was a new platform deployed up? When were messages sent? Operations tempo and rhythm is a signature.

The supply chain is not monolithic - there is a money trail. The fraudulent investment platforms do not run on servers inside compounds. Compounds use many vendors and external services, from Chinese cloud SMS platforms that manage US virtual phone numbers to VPN subscriptions. This creates a dependency on third-party providers who can be subpoenaed, cut-off, or compromised. It creates opportunity for disruption. Every handoff between criminal providers is a seam, and the proceeds crossing those seams move on-chain - wallet clusters, stablecoin flows, OTC cash-out providers. Seams are where attribution lives.

These aren’t artifacts left by careless criminals. These are the unavoidable consequences of running fraud at an industrial scale with coerced labor. You cannot staff a quota-driven, high-turnover operation with trafficked people and also have every conversation be an artisanal, untraceable one-off.

What Comes Next

This series continues with the technology: the digital infrastructure these operations run on, and the tools inside their toolkits. From there we will widen the frame - because not every scam location is a compound, and the difference matters.

The love is fake. The labor is forced. The money - and the trail it leaves - is real. This series exists to hold all three of those sentences in view at once, because that is what it takes to see this industry clearly enough to help break it.

Sunrise sector is an AI-powered threat intelligence company focused on the fraud economy of Southeast Asia’s scam compounds - its infrastructure, its on-chain flows, and the human systems behind both. This series draws on field research and collaboration with organizations supporting survivors of trafficking for forced criminality. Where survivor accounts inform this work, identifying details are withheld or altered to protect people who may still be at risk.

Indicators