Scam Center Philippines: $938M Restrained, 503 Sites Seized — the Supply Chain Lit Up in October

Key Takeaway 🌐 The scam center Philippines story entered its supply-chain phase, and the numbers finally match the industry’s size. America’s Scam Center Strike Force has restrained roughly $938 million in cryptocurrency from the laundering networks behind Southeast Asia’s fraud industry — including $52 million in a single September day, when it seized the Xinbi Telegram marketplace that sold scam operators their websites, their money-mule services, and their trafficking recruits. India’s own Operation Mule Hunt exposed a ₹2,289-crore mule-account pipeline and 638 arrests in one state alone — scale the scam center Philippines enforcement record has never claimed.

And the Philippines just ran its largest POGO raid of 2026 in Zamboanga Sibugay — 244 workers, 3,000 phones, one compound.

Read together, these are not three stories: they are one machine exposed at every layer, from the compound floor (a scam center Philippines compound like Casa de Coco) to the mule account to the marketplace that made it all purchasable.

For OFW families — the demographic these operations target with remittance-adjacent scams — the supply-chain view explains why the “no OTP, no reply” habits we keep repeating are the only defense that works at scale.

Start with the marketplace, because it is the most unusual weapon law enforcement has taken from the industry this year. Xinbi was a Chinese-language Telegram operation — a guarantee service where scam center operators bought custom investment websites, hired money laundering, and recruited staff for compounds across Southeast Asia.

Purchases ran through USDT escrow: Xinbi held the buyer’s payment until the vendor delivered, which made a criminal bazaar behave like a professional marketplace. On September 7, 2026, a U.S. District Court authorized the seizure of the Telegram channels; the same warrant took two Xinbi payment wallets holding about $12 million, and 47 more wallets tied to laundering vendors, for a one-day restraint above $52 million. Tether’s cooperation gets named in the Department’s release — the first time the industry’s stablecoin rail has been publicly credited inside a strike-force operation at this level.

The strike force’s ledger tells the scale story in three dates. Launched November 2025 by the U.S. Attorney for D.C.;

by February 26, 2026, seizures topped $580 million. By March, agents charged two Chinese nationals — Huang Xingshan and Jiang Wen Jie — as managers and enforcers of the Shunda compound in Burma, whose crews defrauded one American victim of more than $3 million on a single fake investment platform.

The operation also seized 503 fake investment websites through Operation Level Up, and the FBI had notified 8,935 victims by early spring — two-thirds of whom had no idea they were being drained — preventing another $562 million in losses. By September, the total restrained reached roughly $938 million, with a team deployed to Madagascar for the takedown of 13 Chinese-run compounds and the processing of 3,200 devices.

The trafficking layer: who works inside the compounds

The scam center Philippines record — like the region’s — runs on trafficked labor, and the strike-force filings read like a manual. The Telegram channel seized alongside Xinbi had more than 6,000 followers and posted recruitment for Cambodia jobs; once recruited, workers were held against their will and forced to defraud Americans while posing as U.S. banks and NYPD detectives. The Shunda filings describe workers beaten and threatened; the compound’s enforcer personally participated in punishments. Myanmar’s Shunda ran from January 2025 until November 2025, when the Karen National Liberation Army seized it — after which the operators, including the two now charged, relocated to Cambodia.

That movement pattern — compound to compound, border to border — is the supply chain in motion, and it is exactly the pattern the Zamboanga raid interrupted on Philippine soil.

The State Department’s $10 million reward for information on the Tai Chang centers in Burma completes the picture: Washington is treating the entire scam-industrial complex as a target structure — bosses, compounds, websites, Telegram hubs, and the crypto rails that pay for all of it. Treasury’s sanctions hit Cambodian operators including a serving senator and businessmen whose holding companies housed the operations. The enforcement arc now covers every layer of the stack simultaneously — a first for this industry.

The mule layer: India’s Operation Mule Hunt and the money trail

Money stolen in Southeast Asia’s compounds has to land somewhere, and India’s answer came in Operation Mule Hunt: a scam center Philippines-scale enforcement action in Gujarat that mapped a ₹2,289-crore cyber-fraud network and arrested 638 people connected to mule accounts. The pattern inside the case matters for this region: syndicates park “digital arrest” money — the impersonation scam where victims are told they face criminal charges by video call — in bogus accounts opened with rented identities. India’s Enforcement Directorate separately traced a ₹7-crore law-enforcement-impersonation case straight to Cambodia, tying the mule layer to the same transnational operators the strike force chases.

The Philippine connection is direct: the BI’s Oct 5 consumer warning tells families that every OTP request and “guaranteed return” pitch traces back to operations just like the one struck in Zamboanga Sibugay — 113 workers in Siay, 131 in Alicia, mostly Chinese, with roughly 3,000 phones and 78 monitors recovered from the Casa de Coco compound.

The enforcement arc from a Mindanao compound to a D.C. courtroom makes every scam center Philippines case a supply-chain case now now runs through Telegram marketplaces, Tether wallets, mule accounts in Gujarat, and recruitment channels promising “attractive female candidates” with American accents. The industry is a supply chain; the law finally attacks it as one.

What the supply-chain view changes for the OFW playbook

When the scam industry could be treated as a single raid target, consumer defense meant waiting for each compound’s takedown — reactive, local, always late. The supply-chain view breaks that: interrupting a marketplace like Xinbi disables the scam center Philippines industry’s purchasing power across borders at once; freezing $938 million cuts the profit that recruits the next compound; seizing 503 websites removes the storefronts instantly. For families, the same logic applies at personal scale: interrupt the industry where it touches you — at the OTP, at the first investment conversation, at the unexpected message — because and every layer above that scam center Philippines touchpoint is already somebody’s enforcement case.

The website layer: 503 storefronts and the Operation Level Up math

Every fake investment platform the industry runs is a small business in itself: a domain, a dashboard, payment routing, and a retention desk. Operation Level Up’s seizure of 503 dot-com domains in the strike-force action shows the storefront layer’s actual size in the scam center Philippines record — each site drew deposits from Americans who believed the returns were real, and the FBI’s complaint data shows victims typically wired multiple times before reporting. The scam center Philippines pattern repeats the same storefront grammar: “fortunepartners”-style names, live-looking charts pulled from real crypto prices, withdrawal buttons that demand a “tax” or “verification fee” before any payout.

When domains die, the crew spins a replacement — Tai Chang’s tickmilleas.com was followed by fortuneprimeglobalirts.com within weeks, itself seized the same day it was announced.

The storefront-churn math is why domain seizures alone never end an industry: 503 takedowns equals 503 replacements if the demand side — victims willing to deposit — stays live. That is why the strike force pairs domain work with the marketplace layer: kill the purchasing hub that fabricates the storefronts, and the churn slows with it. The scam center Philippines Disruption Week results in May showed the same layering: more than 1.4 million social media and email accounts disrupted, malicious IP traffic cut off, and servers decommissioned across Southeast Asian networks.

The recruitment script: how compounds hire, and how families spot it

The Xinbi seizure included

the recruitment channel’s archive: postings seeking female candidates with American accents, US-daytime shift availability, and travel urgency to Cambodia or the border compounds. Recruits travel under false promises, surrender documents at arrival, and work under armed guard. The Zamboanga compound’s 3,000 phones mirror the same structure — BI teams described “an organized illegal online operation” with equipment laid out for mass messaging.

Philippine recruitment for these compounds follows a scam center Philippines pattern recruiters themselves admit: offers to young workers in Visayas and Mindanao towns, “customer service” salaries in dollars or crypto, and departure by ferry or regional flight with no formal employer on paper. Families who ask one question — “what company payroll runs this?” — break the script, because compound economics cannot survive formal payrolls.

Report the job-post to the BI or barangay before anyone boards transport; the Bureau’s Oct 5 directive put that duty in writing for exactly this reason.

The Tether layer: stablecoin rails inside criminal escrow

The most consequential line in the September release is not the $52 million — it is the named cooperation: Tether proactively assisted. Criminal bazaars adopted USDT because it clears globally in minutes with no banking hours. Guarantee services like the Xinbi bazaar ran their USDT escrow for scam center Philippines operators and vendors alike, and vendors published wallet addresses on the same Telegram posts that advertised their laundering. Freezing $938 million proves the rails can be restrained given the legal structure — the Philippines’ own Casa de Coco stockpile, SIM bundles, and monitors were processed the same way BI teams log and inventory devices for the case files.

For remittance households the Tether lesson is indirect but material: the peso lands through BSP-regulated rails, not stablecoin bazaars. The family remittance habit — regulated landing account, alerts on, savings separated — structurally avoids the exact rail the strike force restrains. The scam pitch that asks a family to “invest” through an unregistered crypto platform is asking them to step from the regulated rail into the restrained one. That sentence is now literal: the funds are frozen and being forfeited across the scam center Philippines record now.

The verification archive: what readers can check without trusting summaries

Every number in this piece traces to a public release, and the archive is worth bookmarking. The Secret Service’s September 2026 releases carry the Xinbi warrant language and the Madagascar deployment notes. The February release carries the $580 million mark. The Justice Department’s compound-case releases carry the Shunda filings and the 503-domain seizures. The Bureau of Immigration’s Oct 2 release carries the Zamboanga numbers and equipment lists. India’s Operation Mule Hunt coverage carries the ₹2,289-crore network map. Nothing here requires trust in a summary — including this one.

Two reminders before the closer, both mechanical. One: any message claiming to explain a frozen fund or a returned forfeiture is itself a scam variant — real victim-returns route through official portal processes, never through a reply link, and the FBI’s portal states this in its own FAQ. Two: the strike-force ledgers update monthly; if a figure here reads different by the time you check the release page, trust the dated release, not a screenshot on social media — the churn applies to numbers themselves.

Watch three threads through the closing quarter. The forfeiture of the ₹938-million restraint — victim returns depend on it; the FBI’s victim-notification count will keep climbing from 8,935, and Filipino diaspora members who invested in “platforms” should check the FBI’s complaint portal even if they are overseas. The Zamboanga follow-ups: identity verification of the 244 workers seized from the scam center Philippines compound, and whether NBI charges bring finance-crime counts on top of immigration cases. And the compound migrations: Madagascar proved the industry relocates when pressured; the next Zamboanga will be announced by the same signs — a pension house suddenly staffed, phones arriving in bulk, and recruitment messages that promise what nobody delivers. The scam center Philippines machine was described to the public in 2024 as a POGO problem. The supply-chain record shows it was always a global fraud industry — and October is the month the whole chain lit up under enforcement light at once — read our qilin tracker for the parallel case.