How Industrialized Cybercrime Is Exploiting Gaps in Global Banking Defences
Organised fraud has transformed into a sophisticated, cross-border industry extracting tens of billions from the economy every year. According to analysis by Consilient, what once appeared to be isolated incidents of deception now bears a striking resemblance to a coordinated financial supply chain — one in which victims are sourced, groomed, and exploited, while proceeds are funnelled through regulated institutions with alarming speed and intent.
The human cost is immediate and deeply personal: retirement savings wiped out overnight, small businesses destabilised, and families left financially exposed. Yet the systemic implications extend far beyond individual hardship. According to the FBI’s Internet Crime Complaint Center (IC3), reported cyber-enabled fraud losses in the US now exceed $16bn, with investment scams alone accounting for more than $4bn of that total. The Federal Trade Commission has recorded similarly sharp increases. As these figures reflect only reported cases, underreporting suggests the true economic toll is considerably higher.
Background and Context
Today’s scam networks bear little resemblance to the opportunistic schemes of a decade ago. They function more like structured enterprises, with dedicated teams handling initial outreach, social engineering, payment processing, and fund movement. Law enforcement and investigative reporting have documented large compounds in certain regions housing hundreds of operators running investment and romance scams using scripted playbooks.
Generative AI has accelerated this industrialisation further. Fraudsters can now produce tailored phishing emails, realistic voice clones, and multilingual scripts at scale, dramatically lowering the barrier to convincing deception. The cost of producing credible fraudulent content has collapsed, while potential returns remain high. The UN Office on Drugs and Crime (UNODC) has warned that “cyber-enabled fraud operations in Southeast Asia have taken on industrial proportions,” a sentiment echoed by UNODC authors in discussions with ProPublica. According to the UN Human Rights Office, hundreds of thousands of people have been trafficked and are currently being held in scam centres across Cambodia, Myanmar, Laos, the Philippines, and Thailand.
Key Figures and Entities
The investigation highlights the role of various actors in this supply chain. At the top are organised crime syndicates operating “ransomware-as-a-service” models, providing infrastructure to affiliates in exchange for a share of proceeds. These groups often exploit jurisdictions where economic incentives, corruption, or selective enforcement reduce operating risks.
At the ground level are “money mules” — individuals recruited via job advertisements or social media. According to financial crime analysts, these mules are often unwitting participants, persuaded to open accounts and transfer funds in exchange for small commissions. Their accounts serve as the critical transit points for criminal proceeds, obscuring the audit trail and complicating efforts to trace the flow of illicit capital.
Legal and Financial Mechanisms
Understanding why this has become a system-level issue requires following the full lifecycle of a scam operation. The first stage is victim acquisition, involving phishing, impersonation of trusted institutions, or social grooming. The second is extraction, where investment scams and business email compromise schemes coerce victims into transferring funds. The third — and most consequential for financial institutions — is monetisation.
A scam may begin in cyberspace, but it becomes economically real the moment funds enter the regulated financial system. Funds are routed through mule accounts, often structured to avoid detection triggers and executed rapidly to reduce the chance of intervention. The money may then be consolidated offshore or converted into cryptoassets before re-entering the traditional financial system elsewhere. Because this activity spans multiple banks and jurisdictions simultaneously, no single institution sees the entire chain, a vulnerability organised networks rely upon.
International Implications and Policy Response
The persistence of these operations points to a geopolitical dimension. In certain jurisdictions, large-scale scam and ransomware operations have continued with limited disruption, allowing ecosystems to mature and scale with relative impunity. Financial fraud is increasingly intersecting with national security considerations, as proceeds from organised scams are reinvested into further criminal activity or deployed in sanctions evasion.
While financial institutions have invested heavily in transaction monitoring and customer due diligence, traditional Anti-Money Laundering (AML) defences are struggling to keep pace. Regulators are increasingly focused on earlier disruption, particularly in authorised push payment fraud and mule detection. The expectation is shifting from documenting suspicious flows to actively preventing them. However, a system-level response remains unavoidable. Analysts suggest that better coordination and intelligence-sharing mechanisms are needed to allow institutions to identify shared risk indicators without centralising sensitive customer data, moving the industry from reactive reporting to proactive disruption.
Sources
This report draws on analysis by Consilient, data from the FBI’s Internet Crime Complaint Center (IC3) and the Federal Trade Commission, as well as reports and warnings from the UN Office on Drugs and Crime (UNODC) and the UN Human Rights Office. Additional context was provided by ProPublica reporting on cybercrime infrastructure.
