Raid, relocate, repeat: how banks can disrupt the networks behind romance-investment scams

With fraudulent activity rising across the banking sector, Pallavi Kapale, Senior Financial Crime Officer at Bank of China, shares expert insights on how financial institutions can disrupt the criminal networks driving romance-investment scams.

Cambodia’s crackdown shows that enforcement can close a location without dismantling the payment, corporate, and digital infrastructure behind industrialised fraud. The next challenge for banks is to follow networks rather than borders and to measure disruption, not simply reimbursement.

In February 2026, Cambodian authorities said they had closed approximately 190 suspected scam centres, arrested 173 prominent crime figures, and deported 11,000 foreign workers. It was an important intervention against an industry associated with investment fraud, money laundering, human trafficking, and forced labour.

But a few months later, Amnesty International reported that dozens of suspected compounds remained active. Of the 86 locations it identified, it said the authorities had intervened only 24. Cambodia rejected the suggestion that it was failing to act, pointing to its nationwide enforcement campaign. A raid can empty a building, but it does not necessarily erase the criminal capability behind it.

That capability is becoming increasingly portable. In July 2026, INTERPOL confirmed that hundreds of suspects had been arrested in Sri Lanka for involvement in cyber-scam centres during a three-month global operation. Independent reporting from Sri Lanka also suggests that some foreign-led networks are favouring smaller, rotating groups operating from rented houses, hotels, and offices rather than conspicuous, guarded compounds. Sri Lanka has not simply replaced Cambodia as the new centre of the problem; it is an early warning of how quickly the model can disperse when pressure increases elsewhere.

The industry commonly calls this crime ‘pig butchering’. INTERPOL has urged a move towards ‘romance baiting’ arguing that the term dehumanises victims and may deepen the shame that already prevents reporting. In this article, I use ‘romance-investment fraud’ to describe the wider combination of confidence building, emotional manipulation, and fraudulent investment activity.

A building is not the business model

A modern scam operation is a supply chain. It may include deceptive recruitment, trafficked labour, stolen identities, synthetic media, social-media accounts, domain hosting, fake trading platforms, payment accounts, money mules, shell companies, OTC brokers, virtual-asset service providers, and unhosted wallets. Each component can be replaced, outsourced, or moved.

This modular structure explains why enforcement can produce displacement rather than eradication. UNODC has warned in its report ‘Inflection Point’ that organised cyberfraud groups originating in East and Southeast Asia, such as Sihanoukville (Cambodia), Kokang (Myanmar), Shwe Kokko (Myanmar), and Poipet (Cambodia) as enforcement pressure increases. INTERPOL has likewise observed scam-centre activity beyond the original hub, including in the Middle East, West Africa, and Central America. This aligns with the UK’s new fraud strategy 2026-2029 recognising overseas scam centres as a strategic threat requiring international disruption.

For financial institutions, a control framework built around a short list of high-risk countries, individual customer warnings, or known cryptocurrency exchanges will struggle against a business designed to relocate and reassemble. Banks must move from detecting isolated suspicious payments to understanding the networks through which the payments travel.

Shift one: from geographical risk to network risk

Country risk remains relevant, but it should not become a substitute for analysis. Applying a blanket high-risk label to Cambodia, Sri Lanka, or another emerging location may create noise, encourage indiscriminate de-risking, and still miss the network when it routes payments through apparently lower-risk jurisdictions.

A network-led model would examine convergence and connection: multiple unrelated customers paying the same beneficiary, newly established businesses receiving rapid international inflows, common directors, addresses, telephone numbers, devices or domains, dormant companies going active. Banks should also identify accounts whose outward payment flows repeatedly converge on the same VASP, OTC broker, merchant, or wallet cluster. When a law enforcement disclosure occurs, the review should extend beyond exact-name matches to beneficial owners, directors, payment counterparties, merchant identifiers, etc. The purpose is to ask whether the new intelligence changes the risk interpretation of activity the firm has already seen.

Shift two: from screening names to mapping infrastructure

The coordinated action against Cambodia-based Prince Group and Huione Group illustrates why this matters. In October 2025, US authorities designated Prince Group as a transnational criminal organisation and severed Huione Group from the US financial system. The US Treasury said Huione has laundered at least USD 4 billion in illicit proceeds between August 2021 and January 2025. In parallel, the US DOJ filed a civil forfeiture action concerning approximately 127,271 bitcoin, then valued at around USD 15 billion, alleged to be connected to the Prince Group operation. The UK imposed coordinated sanctions and froze assets linked to the network.

The significance of these actions is not limited to the addition of new names to screening databases. They reveal an ecosystem spanning corporate ownership, financial services, cryptoassets, property, and other legitimate-looking businesses. A sanctioned person or entity therefore becomes a seed for a network map, not the end point of a screening exercise. Proactive intelligence enables institutions to identify connected entities, wallets, and transaction patterns before they appear on official lists, helping them remain ahead of the threat rather than responding after the risk has materialised.

Shift three: from monitoring the sender to examining the receiving ecosystem

Most traditional controls look first at the person making the payment – has the customer suddenly begun investing, or transferred to a new beneficiary. These questions remain important, but they reveal only one side of the transaction.

The receiving institution may see something the sending bank cannot – funds arriving from numerous unrelated individuals, references to investments, loans, taxes or withdrawal fees, small transfers followed by rapid escalation to other PSPs, MSBs, or cryptoasset platforms. Proactive intelligence enables institutions to identify connected entities, wallets and transaction patterns before they appear on official lists, helping them remain ahead of the threat rather than responding after the risk has materialised. May also see several receiving accounts connected by the same device, contact details, funding source, or onward beneficiary.

Since October 2024, sending and receiving PSPs have split the cost of eligible reimbursements equally. This creates a direct incentive for firms operating beneficiary accounts to detect and remove mule accounts quickly and not merely respond after another bank reports the fraud.

Shift four: from generic warnings to evidence-led intervention

A romance-investment fraud victim may be acting under emotional influence. Generic pop-up warnings are easily dismissed, particularly when the criminal has rehearsed the victim’s response in advance. The FCA’s 2025 review of six banks and payment firms found examples of strong intervention, but also missed opportunities to identify suspicious transactions and inconsistent probing of customer explanations.

Front-line staff and fraud analysts therefore need questions that test the investment journey. For example: how did the customer encounter the person or platform? Were they moved from a dating site or social-media service to an encrypted messaging app? Were they allowed to make a small withdrawal before being encouraged to invest more? Have they been told to pay a tax, fee, or deposit to unlock funds? Were they instructed what to tell the bank, or asked to install remote-access software?

A combination of indicators may justify proportionate friction. For example, a specialist conversation, secondary review, risk-based cooling-off period (under the Payment Services Regulations 2017, payments can be delayed until the end of the fourth business day where there are reasonable grounds to suspect). The objective is to distinguish investment behaviour from a manipulated payment journey using customer context, transaction history, beneficiary intelligence, and network evidence together.

Shift five: from separate fraud alerts to one financial-crime case

A single case of romance-investment fraud may involve APP fraud, money laundering, sanctions exposure, cryptoasset risk, cyber-enabled crime, human trafficking, and forced labour. Yet each element is routed to a different team, creating duplicated work and lost intelligence.

A unified scam-network case model bringing together fraud, AML, sanctions, cyber intelligence, and vulnerable-customer specialists is needed rather than operating in silos.

Shift six: from reimbursement statistics to disruption metrics

In July 2026, The Payment Systems Regulator reported that 88% of the GBP 316 million that was lost in APP scam claims had been returned during the first 18 months of the regime. That represents substantial progress in customer protection.

But money reimbursed by the bank is not necessarily money recovered from the criminal. The proceeds remain with the scam network, and they continue targeting new victims.

Boards and senior management should therefore look beyond alert volumes, SAR counts, and claims-processing times. For example: value prevented, frozen and recovered, mule account identification, number of connected accounts found from each investigation, time taken to share actionable intelligence, review of beneficiary accounts, and rates of repeat victimisation.

These metrics should feed governance. If a firm repeatedly reimburses customers whose payments reach the same beneficiary institution, VASP, or merchant category, that pattern should feed risk appetite, scenario tuning, and senior-management reporting.

Conclusion

Cambodia’s crackdown does matter. Compounds have been disrupted, alleged organisers have been targeted, and financial infrastructure has come under unprecedented scrutiny. But the reported emergence of smaller scam operations in Sri Lanka and the wider globalisation identified by UNODC and INTERPOL shows why success cannot be measured only by buildings closed or people deported.

For banks, the next phase requires three fundamental changes: follow networks rather than borders, treat the receiving side of the payment as part of the crime scene, and measure whether controls remove criminal capability, not merely whether victims are reimbursed after the event.

The scam compound may move, shrink, or change its name. The financial system will still see fragments of its activity. The institutions that connect those fragments fastest will be best placed to protect their customers and expose laundering networks.

Disclaimer: The views expressed in this article are my own and do not necessarily reflect the views of my employer or any other associated party.

About author

Pallavi is a seasoned professional with a wealth of experience in Financial Crime across the 1LOD and 2LOD. Her expertise has been honed through her tenure in several high-street banks. Currently, she serves as a Senior Financial Crime Officer (2LOD) in the Financial Crime Intelligence Unit at the Bank of China.

Pallavi's professional background is marked by her specialisation in key areas of Financial Crime. She is an expert in Anti-Money Laundering (AML), fraud prevention/investigations, and conducting bank-wide trainings and risk assessments.

Pallavi holds an ICA Diploma in AML and is a Member there. She also has an ICA Advanced Certificate in AML and is an ICA Certified Financial Crime Investigator. She regularly writes articles on financial crime topics on LinkedIn.

About Bank of China

 

Bank of China, including BOC Hong Kong, BOC International, BOCG Insurance, and other financial institutions, provides a comprehensive range of financial services to individual and corporate customers as well as financial institutions worldwide.