Table of Contents
- POGO scam hubs never left the Philippines — they rebranded. Two raids in one week prove POGO scam hubs operate at national scale: an Ayala Avenue office tower in Makati (124 arrested, mostly Chinese nationals) and a provincial operation in Zamboanga Sibugay (~200 foreign nationals, ~2,000 devices seized).
- POGO scam hubs now wear office clothes. The new camouflage is the ordinary office. The banned POGO industry’s workforce dispersed into commercial buildings that look exactly like legitimate BPO sites — corporate rent, desks, badges.
- For OFW families the money threat is unchanged: romance scams, sextortion blackmail, spoofed investment platforms. The production facility moved; the product is identical.
- The defense against POGO scam hubs is behavioral, not technical: verify every investment platform against the SEC and BSP, never send intimate content to online contacts, report within 24 hours (CICC 1326, NBI 8252-6228, PNP-ACG 8723-0401).
- Policy just escalated: the Philippines adopted the 11-commitment Phnom Penh Declaration against online scams on October 1, 2026 — asset-recovery cooperation is the lever that makes scam hubs unprofitable, not just relocated.
Philippine authorities say POGO scam hubs never died — they rebranded. In the same seven days, the country saw the clearest evidence yet that POGO scam hubs endure: two operations that looked nothing like the scam compounds Filipinos learned to fear. No walled compound in Bamban. No gated dormitories in Porac. One was an office tower on Ayala Avenue, Makati’s priciest business strip, where 124 people — mostly Chinese nationals — sat at computers running romance-and-sextortion scripts. The other was two towns in Zamboanga Sibugay, where nearly 200 foreign nationals were intercepted alongside an estimated 2,000 phones, laptops and desktops.
That contrast is the whole story of October 2026: the product industrialized, the packaging went corporate, and the buyers — overseas Filipino workers, their families, small businesses — face the same scripts from cleaner addresses. This piece breaks down what both raids proved about POGO scam hubs, what changed in the enforcement map, and the exact playbook for anyone sending money home.
Inside the POGO Scam Hubs: the Ayala Avenue Raid
On Saturday evening, September 27, agents from the NBI Special Action Unit walked into a commercial building on Ayala Avenue carrying a search warrant and a cyber warrant from a Makati City Regional Trial Court. From the street, the target was indistinguishable from a hundred other floors in the financial district: an office with rows of computers, staffed desks, a functioning call-center floor plan. Inside, the NBI arrested 120 suspects — a count later cited in other reports as 124 — most of them Chinese nationals, on suspicion of running one of the classic POGO scam hubs, what investigators describe as a “lust scam”: victims are groomed into online relationships, persuaded to share intimate photos or videos, then blackmailed.
NBI Director Melvin Matibag told reporters the operation had mixed revenue streams — romance scripts, cryptocurrency movement, illegal trading all detected on the premises. Agents recovered alleged explicit material from the workstations, the raw inventory of sextortion. The suspects face charges of computer fraud under the Cybercrime Prevention Act of 2012 ( Republic Act 10175), and the Bureau of Immigration is verifying the foreigners’ status. What matters is the location choice of POGO scam hubs: this was not a hidden compound, it was a workplace with a lease, in the office district where legitimate BPOs stack floor after floor.
The economics tell their own story. A 120-person operation does not rent Makati space by accident. Salaries, office rent, internet, equipment — somebody running that floor believed the scam output would pay for all of it, with margin. That is an enterprise decision, not a street hustle. It is why one raid does not end the POGO scam hub model: the same back-office playbook can be reinstalled two blocks away.
Zamboanga Sibugay: Another of the POGO Scam Hubs
Five days later, on Friday, October 2, a joint force — the NBI, the Bureau of Immigration, and the Philippine Army’s Joint Task Group Igsoon under the 102nd Infantry Brigade — moved on two towns at once, Alicia and Siay. They intercepted nearly 200 foreign nationals suspected of working transnational cyber scams, and seized an estimated 2,000 mobile phones, computers, laptops and other devices, now under forensic analysis. Unlike Makati, this read like the older POGO scam hub playbook: provincial site, foreign workforce, equipment at industrial scale. The suspects are being processed by the NBI and BI for status, liability, and links to syndicates; formal charges and the nationalities breakdown are expected after documentation.
Put the two operations side by side and the dispersal pattern comes into focus. After the POGO ban, the visible compounds were dismantled or pushed offshore — and the workforce had to go somewhere. What the last week shows is that path for POGO scam hubs: some units went provincial again, back into rural hides like Zamboanga Sibugay, while others moved into Metro Manila’s commercial districts, inside the exact office stock nobody associates with fraud. Both keep the same scripts, the same foreign labor pipeline, the same target list: Filipinos at home, Filipinos abroad, and the foreign victims that made the Chinese-language “lust scam” model profitable.
The POGO-era pattern is also repeating in one more respect. Investigators noted in both cases the same operational signature flagged in 2024–2025: foreign-run script teams, Filipino support staff, crypto for moving proceeds. When the GMA report on the Makati raid noted that authorities are investigating whether former POGO workers returned — the honest answer visible from two POGO scam hub raids is: at least 320 of them did, across two sites.
Why POGO Scam Hubs Break the Old Maps
The compound era taught Filipinos a visual reflex: look for walls, guards, dormitories, rice-cake towns suddenly full of foreign cars. The Makati raid retires that reflex for POGO scam hubs. An office tower in the country’s prime business district can host the same operation, with better cover than any fenced compound — because Ayala Avenue is full of legitimate BPOs staffed by night shift. Policing the difference now requires cyber warrants and device forensics, not drive-by suspicion. That is a capability the NBI’s Special Action Unit and Digital Forensic Laboratory clearly used this week; scaling it to hundreds of buildings is the enforcement question of 2027.
For OFW families the practical takeaway is unchanged and uncomfortable: scams are industrial products now. The production facility moved; the product is identical. The people at those desks ran tested scripts against thousands of targets a day — the business only works if it reaches enough of them. Which means your defense does not depend on finding the building. It depends on rejecting the product wherever it reaches you.
The OFW Playbook: What the Two Raids Change for You
Nothing about your defense changes — but the urgency does. These POGO-style scam hubs survive on volume: scripts tested on thousands of targets until someone pays. The operational playbook, in the order the scams usually arrive:
- Love-scam floor rule: anyone you met online who steers conversation toward money — the signature opening move of POGO scam hubs, crypto, ‘investment opportunities’, or intimate content is running a script. Report and block. If you’re abroad, the NBI now has cybercrime attachés to file with.
- The video/image trap: sextortion works because victims pay to hide shame. The instant you send intimate content to an online-only contact, you are a hostage. Never send it — even to someone who has ‘already shown’ themselves, even after weeks of daily conversation.
- Pay-once-and-it-continues: blackmail does not end when you pay — that is the pricing of the next demand. Block, report to authorities, preserve evidence. When a scam hub’s stolen data surfaces — as with the DMW network intrusion — the same evidence-first rule applies.
- Investment-platform rule: before any money moves toward a ‘trading’ or ‘crypto’ platform, verify it with the SEC (8818-1898) and BSP (8811-1277). The AMLC has warned since August 2025 that deepfake videos of celebrities, CEOs and even the President are used exactly here.
- Where to report: CICC hotline 1326, NBI Cybercrime Division (8252-6228), PNP-ACG (8723-0401 loc. 7491). Report within 24 hours — device forensics and fund-tracing move fast, and the freeze-week discipline from the Coins.ph suspension playbook applies to any frozen-rail moment.
The pesos: what a single script can extract
Scale makes the arithmetic brutal. A 120-person office does not need many successes: at the ₱93 million a Pampanga doctor lost to a deepfake-driven investment scam in October 2025 — one victim, one script, one year of trust-building — a single catch can fund the floor’s rent for years. If your family’s monthly remittance is ₱25,000, that single case equals 3,720 months of your support. The raid counts are the enforcement story; the per-victim extraction is the story for your wallet.
The Bigger Picture: Regional Cooperation Against Scam Hubs
On October 1, 2026, the Philippines adopted the Phnom Penh Declaration — an 11-commitment framework with Cambodia and regional partners against online scams and trafficking into scam operations. Justice officials cited the dual problem: Filipinos both as scam targets and as workers trafficked into scam compounds abroad. The commitments cover cross-border cooperation, dismantling compounds, recovering criminal proceeds, and victim protection.
Why asset recovery matters more than headlines: a 200-worker POGO scam hub is a business. Bust it and it relocates; freeze its money trails — bank accounts, wallets, MSB channels, the exact layering AMLC mapped in the flood-control plunder probe — and it becomes unprofitable. That is the lever the declaration formalizes, and it is the one worth watching in the next twelve months of Philippine prosecutions.
What to Watch on POGO Scam Hubs
- The NBI/BI breakdown of the Zamboanga suspects’ nationalities and formal charges (expected within days of the Oct 2 operation).
- Forensic results from the ~2,000 seized devices — which platforms, which victim countries, which crypto rails (the pattern that connects to the flood-control crypto-laundry findings).
- Whether the Ayala Avenue building’s lessors and landlord face inquiry — corporate rent is now a scam-vector question in Metro Manila.
- First PH application of the Phnom Penh Declaration in prosecutions — watch for asset-freeze actions tied to scam proceeds, the AMLC playbook.
- Whether the Makati “lust scam” case produces a trafficking charge upgrade — the line between labor fraud and human trafficking determines how deep the sentencing goes.
The BPO Trust Problem: Legit Floors and Scam Floors Share a Skyline
Makati’s irony is hard to miss: the same towers that host the country’s legitimate outsourcing industry — the one paying for millions of Filipino families’ groceries — just hosted its opposite. That coexistence is not a coincidence; it is the cover. For a landlord and an HR pipeline calibrated to foreign clients, one more ‘online support’ tenant is unremarkable. The two raids imply a screening question every building owner and job applicant now shares: does the floor — like the exposed POGO scam hubs — have a registry trail, or only a lease?
There will be pressure — including in policy debate — to treat every foreign-staffed office as suspect. That cure would damage the BPO industry the country depends on. The smarter control set is narrow and already on the books: cyber warrants for device seizures (used in both raids), immigration verification for foreign staff (used in both raids), and financial-inquiry powers for the proceeds layer. The Zamboanga and Makati operations are, in effect, the working demo of that toolset.
FAQ: POGO Scam Hubs, Answered
Is POGO back in the Philippines?
Not legally. These were straight scam operations — romance/sextortion scripts and fraud — not licensed offshore gaming. The resemblance investigators flagged is operational: foreign workforces, scripted targeting, industrial scale. The September 27 and October 2, 2026 raids both involved foreign nationals, computers at scale, and proceeds moved through crypto — the same signature as the banned POGO model.
I sent money to an online romance contact — what now?
Stop all payments, preserve receipts, screenshots and account numbers, then report to CICC 1326 or NBI Cybercrime (8252-6228). If you’re overseas, contact the Philippine Embassy and ask for the NBI cybercrime attaché channel. Recovery odds drop sharply after 24 hours, because funds are layered through wallets and exchanges exactly as the AMLC described in its 2026 freeze orders.
How do I verify a Filipino office isn’t a scam hub?
As an individual you don’t — that is NBI, BI and DICT work with cyber warrants. What you control is your own exposure: never transact with people you met only online, verify every investment platform with the SEC (8818-1898) and BSP (8811-1277), and treat any request for intimate content as the attack it is.
How do these scam hubs recruit Filipino staff?
The same way call centers do — job posts for ‘online customer service’, ‘chat support’, ‘international accounts’. The red flags are payment via personal E-wallets, no company registry listing, and tasks that involve scripted chats with strangers. The NBI notes Filipino support workers were present in the Makati operation; working-age readers should treat unverifiable ‘support’ jobs as a possible POGO scam hub recruiting funnel.
What is the Phnom Penh Declaration in simple terms?
An 11-commitment pact adopted by the Philippines with Cambodia and regional partners on October 1, 2026. It commits governments to cooperate across borders against online scam operations: dismantle compounds, disrupt recruitment and trafficking, freeze and return criminal proceeds, strengthen national laws, and protect victims. For OFW families, its test is simple: whether POGO scam hub money gets frozen faster and returned at all.
The BPO Trust Problem: Legit Floors and Scam Floors Share a Skyline
Makati’s irony is hard to miss: the same towers that host the country’s legitimate outsourcing industry — the one paying for millions of Filipino families’ groceries — just hosted its opposite. That coexistence is not a coincidence; it is the cover. For a landlord and an HR pipeline calibrated to foreign clients, one more ‘online support’ tenant is unremarkable. The two raids imply a screening question every building owner and every job applicant now shares: does the floor’s business have a registry trail, or only a lease?
There will be pressure — including in policy debate — to treat every foreign-staffed office as suspect. That cure would damage the BPO industry the country depends on. The smarter control set is narrow and already on the books: cyber warrants for device seizures (used in both raids), immigration verification for foreign staff (used in both raids), and financial-inquiry powers for the proceeds layer. The Zamboanga and Makati operations are, in effect, the working demo of that toolset.
