For years, the wrong-number text arrived like clockwork. A friendly mistake, then apologies, small talk, and gradual friendship. Eventually, the investment tip was a “sure thing” on a slick platform showing returns that seemed too good to ignore.
Americans watched account balances climb on fabricated dashboards, only to discover the withdrawal button led nowhere. Life savings had vanished into a laundering network spanning continents.
The DOJ froze or seized over $580 million tied to these overseas scam networks in just three months. That figure maps the contours of an industrial fraud supply chain that has turned confidence schemes into shift work, complete with quotas, scripts, and coerced labor inside guarded compounds.
Factory model of fraud
What separates contemporary investment scams from their predecessors isn’t sophistication in the traditional sense, but operational scale.
These networks don’t rely on a single talented con artist. They’ve built a repeatable system: mass texting generates leads, scripted trust-building converts prospects into victims, fake platforms simulate legitimacy, and layered laundering disperses the proceeds before law enforcement can trace them.
The mechanics follow industrial logic. Lead generation operates at volume through automated messaging. Trust-building follows documented scripts guiding workers through weeks or months of relationship cultivation.
The handoff from a legitimate cryptocurrency purchase to a fraudulent platform happens gradually: victims first buy real crypto, building confidence, then transfer it to scammer-controlled sites that display fabricated gains.
When victims attempt withdrawals, the system pivots to extraction: fabricated tax bills, verification fees, and account unlocking charges drain whatever remains accessible.
Treasury estimates Americans lost at least $10 billion in 2024 to scam operations based in Southeast Asia alone, a 66% increase year-over-year. The FBI’s Internet Crime Complaint Center logged $9.3 billion in cryptocurrency-linked fraud complaints in 2024, with the largest reporting age group being 60+.
These figures represent systematic wealth transfer from retirement accounts into networks the UN Human Rights office describes as trafficking operations.
Compound economy
The organizational structure behind these numbers challenges the usual categories.
Many scam operations run from fortified compounds in Southeast Asia, where workers operate under coercion, documented by UN investigators as trafficking victims forced to execute fraud under threats and violence.
Treasury and DOJ filings describe these facilities as self-contained operations combining housing, workspace, and security infrastructure designed to prevent escape.
This labor model transforms fraud from a high-skill endeavor into a scalable business.
Workers follow scripts, hit targets, and rotate through shifts. The model’s efficiency explains the volume: when scamming becomes assembly-line work, the bottleneck shifts from talent acquisition to victim supply, and cheap digital infrastructure ensures leads never run dry.
The economics reveal why enforcement struggled to contain the problem. Spinning up new domains costs almost nothing. Fake investment platforms run on templates duplicated within hours. Victim acquisition occurs at the global scale with a minimal marginal cost per contact.
Payment rails offering speed and irreversibility, such as cryptocurrency, wire transfers, and ATM deposits, complete the stack. The operation faces low barriers to entry and high barriers to enforcement, at least until recently.
Chokepoint strategy
The DOJ’s strike force, launched in November 2025, delivered $580 million in freezes, seizures, and forfeitures within three months by attacking infrastructure rather than individual operators.
| Stage | What the victim sees | What’s really happening | Where enforcement can hit it (chokepoint) |
|---|---|---|---|
| Lead generation | “Wrong-number” text / random DM | Automated outreach at massive volume to find responsive targets | Telecom + platform enforcement, bulk-message detection, account takedowns |
| Trust-building | Weeks of chatting / romance / “friendship” | Scripted grooming to build credibility and move the victim toward money | Platform moderation, scam-pattern detection, identity/impersonation controls |
| Fake platform | App/website showing “profits” | Templated scam sites that simulate trading and fabricate returns | Hosting/domain disruptions, sanctions/takedowns on infrastructure providers |
| Extraction | “Taxes/fees” to withdraw; “account verification” | Escalating payment demands once the victim tries to cash out | Bank/ATM alerts, consumer warnings, payment-fraud rules and holds |
| Laundering | “Send crypto to verify/unlock” | Funds layered across many wallets and services to obscure origin | Blockchain tracing, wallet clustering, stablecoin freezes, exchange cooperation |
| Cash-out | “Convert to cash” / “transfer to another service” | Exit via offshore exchanges, P2P brokers, or kiosks to break the trail | Exchange compliance + off-ramp controls, kiosk/ATM monitoring, cross-border coordination |
The shift represents a change in enforcement theory: instead of pursuing decentralized scammers one by one, the new approach targets the chokepoints where money concentrates.
Blockchain analysis enabled this pivot. The $225.3 million civil forfeiture action cited in DOJ filings demonstrates the workflow: investigators trace laundering patterns across wallet addresses, identify concentration points, and coordinate with stablecoin issuers to freeze assets before they scatter.
DOJ explicitly thanked Tether for its assistance in that case, signaling cooperation between law enforcement and the infrastructure layer.
Treasury’s sanctions against Funnull illustrate the infrastructure-first approach. The company allegedly provided hosting and technical services to hundreds of thousands of scam sites, which the FBI reports are linked to over $200 million in victim losses, with an average per-person loss exceeding $150,000.
By sanctioning the enabler rather than chasing individual sites, enforcement creates friction across the entire operation.
The strike force’s $580 million total includes assets frozen mid-transfer, seized during investigation, and forfeited through civil proceedings.
DOJ states it will seek to return funds “to the maximum extent possible,” though the forfeiture and restitution process offers no guarantees. The figure matters less as a recovery metric than as a signal: enforcement now operates at the same scale as the threat.
What changes when the intercept rate rises
The three-month pace, if sustained at roughly $2.3 billion annualized, would theoretically intercept approximately 23% of Treasury’s estimated $10 billion annual Southeast Asia-based scam losses.
That calculation assumes several unrealistic conditions, but it establishes an upper bound for what coordinated enforcement might achieve under the current infrastructure.
More likely, the dynamic plays out as escalation rather than eradication. Higher intercept rates force adaptations: scammers shift to harder-to-freeze rails, disperse operations geographically, and invest in more sophisticated laundering.
Meanwhile, artificial intelligence lowers the cost per victim by enabling more convincing impersonation and deepfake video calls. Chainalysis data shows average scam payments rising from $782 to $2,764 between 2024 and 2025, consistent with AI-enhanced targeting pushing victims toward larger transfers.
The tension pits industrial capacity on both sides.
Scam operations scale horizontally through replicable infrastructure and coerced labor. Enforcement is enabled by data analysis, cross-border coordination, and infrastructure sanctions.
The outcome depends on which system improves faster.
The asymmetry problem
Bitcoin ATMs and peer-to-peer cash exchanges represent the exit valves that enforcement struggles to seal.
FinCEN flagged kiosks specifically as red-flag payment channels in recent guidance, noting scammers direct victims toward ATMs precisely because those transactions bypass traditional financial surveillance.
Once crypto is converted to cash at an offshore exchange or in an in-person transaction, the trail ends. The $580 million figure captures what gets frozen before that conversion, the real question is how much exists undetected.
Regulatory pressure on stablecoin issuers and exchanges creates tighter compliance around large transfers, but compliance friction drives migration toward less-regulated alternatives.
The pattern repeats across enforcement domains: pressure at one chokepoint redirects flow rather than stopping it. What matters is whether redirection increases operational cost and risk enough to compress profit margins.
What decides the outcome
The endgame turns on defaults and distribution.
If buying and transferring cryptocurrency to unknown platforms remains as frictionless as it is today, scam economics remain favorable. If exchanges implement stronger verification before allowing transfers to flagged addresses, if stablecoin issuers freeze suspicious flows more aggressively, or if hosting providers face sanctions for enabling scam infrastructure.
Each friction point degrades the factory model’s efficiency.
The DOJ’s $580 million represents interdicted revenue, but it also represents data: mapping laundering networks, identifying infrastructure providers, and documenting gaps in cooperation that allow scams to scale.
Enforcement doesn’t need to catch every scammer, it needs to make the factory model unprofitable by targeting the supply chain that enables industrial fraud.
The question isn’t whether individual scams continue. They will. The question is whether organized, compound-based fraud operations can maintain their current scale as chokepoints tighten and infrastructure enablers face sanctions.
The $580 million doesn’t answer that question. It shows where the leverage points are.