On October 17, Vietnamese authorities raided the Văn Hoa Hotel in Nghi Sơn, Thanh Hóa province. What they found inside was not a typical hospitality business, but a transnational cybercrime operation. Police arrested 118 suspects, including 113 foreign nationals from China, India, Cambodia, Malaysia, and Myanmar.
Operating behind the closed doors of a provincial hotel, the group allegedly orchestrated an online fraud network targeting victims across multiple countries. Its methods ranged from fake investment opportunities and cryptocurrency schemes to fraudulent recruitment offers, online tasks, and sports betting.
Yet, one detail placed the case in a wider regional context: the backgrounds of the foreign suspects. According to Thanh Hóa police, most had previously lived in Cambodia or Laos, both associated with large-scale scam operations.
Their backgrounds offer a glimpse into the cross-border connections behind online fraud in Southeast Asia, and the challenges of investigating networks that operate across national boundaries. Whether it represents a broader migration trend, however, requires a closer look at how these networks operate and respond to enforcement.
Possible Movement from Cambodia and Laos
For years, parts of Cambodia, Laos, and Myanmar have hosted large-scale scam compounds, often operating behind the fronts of casinos, hotels, and businesses in special economic zones. These operations have exploited weak enforcement, corruption, cross-border criminal networks, and gaps in international cooperation.
International pressure and enforcement actions have increasingly disrupted these operations. But dismantling a compound does not necessarily dismantle the network behind it. Personnel, recruitment channels, financial intermediaries, and technical infrastructure can potentially be reorganized or moved elsewhere.
The United Nations Office on Drugs and Crime (UNODC) has documented the expansion of cyber-enabled fraud alongside underground banking, money laundering, and other forms of organized crime. INTERPOL's 2025 assessment likewise describes the globalization of scam centres, with operations extending beyond their traditional hubs in Southeast Asia.
The suspects' previous residence in Cambodia and Laos makes the Nghi Sơn case relevant to this wider pattern. Vietnamese authorities also reported that 18 foreign suspects had entered Vietnam illegally and that one was wanted by foreign authorities. The group brought in large quantities of computers and telecommunications equipment, reportedly disguised as used goods.
However, these details do not establish that a particular crackdown directly caused the operation to relocate. The case could reflect the displacement of an existing operation, the expansion of a regional network into an additional location, or a combination of both.
Distinguishing between these possibilities matters. If criminal groups are actively relocating, investigators need to understand which enforcement actions preceded their movements, who facilitated their entry, and whether their financial and recruitment networks remain connected to operations elsewhere. If groups are independently establishing new bases, the priority is identifying the vulnerabilities that allow them to take root.
The central question is therefore not simply whether scam networks are moving into Vietnam, but how their cross-border connections enable them to establish and sustain operations in new jurisdictions.
Inside a Cross-Border Scam Operation
The operation discovered at the Văn Hoa Hotel illustrates how a transnational scam network can function more like an organized business than a collection of individual fraudsters.
According to Thanh Hóa police, the group operated under the direction of Zhao Xuefeng, a Chinese national also known as Đông. Investigators identified him as the alleged ringleader. The operation was divided into six teams targeting different markets and scam types, with separate personnel handling fraud scripts, equipment, staffing, finance, logistics, and translation.
This division of labour allowed the group to pursue victims in Taiwan, South Korea, Japan, India, the United States, and China, adapting its approach to different audiences.
Investigators described several distinct methods. One team targeted women in Taiwan aged over 40, approaching potential victims through messaging applications before promoting foreign-exchange investments on a platform called MGX. Another allegedly posed as investment professionals to persuade South Korean victims to buy stocks through a fraudulent platform. A separate team targeted Japanese women with cryptocurrency investment schemes, while others focused on sports betting, fake recruitment, and online-task scams.
Despite their different formats, these schemes followed a similar pattern: establish trust, persuade the victim to transfer money, and cut off contact when the victim could no longer pay or attempted to withdraw funds.
Fake investment platforms might initially display apparent profits or allow small withdrawals to make the opportunity seem legitimate. Fraudulent online-task schemes could offer small initial rewards before requiring victims to pay increasingly large fees to unlock additional work or withdraw supposed earnings. These techniques exploit the desire for financial security and the expectation that an apparently successful transaction can be repeated.
The operation's structure also points to a broader challenge for investigators. The people directly contacting victims are only one part of the system. Equipment managers, recruiters, translators, financial personnel, and alleged organizers all perform different functions. Identifying the individuals responsible for directing the operation, as well as any collaborators beyond the hotel, is essential to understanding its full reach.
The Nghi Sơn investigation has established the alleged structure of this particular operation. Whether it was connected to a larger criminal network operating elsewhere remains a separate question for investigators.
Vietnam’s Response to Cross-Border Cybercrime
The successful detection and dismantling of the Nghi Sơn operation demonstrates the effectiveness of coordination among Vietnamese authorities in disrupting a substantial transnational fraud network. The case began with immigration officials noticing unusual activity among foreign nationals renting the entire hotel, including strict access controls and a closed-off living arrangement. Police subsequently coordinated with national agencies to investigate the suspected criminal operation.
The raid represents an important disruption. At the same time, the case’s cross-border nature highlights the need for continued financial investigation, international cooperation and scrutiny of recruitment networks.
The first challenge is following the money. Online fraud proceeds can move across jurisdictions through bank accounts, payment intermediaries, cryptocurrency services, and illicit financial networks. Identifying where the money goes, who controls it, and how it is converted into usable assets can reveal connections that a physical raid alone cannot uncover.
The second is identifying the network beyond the immediate premises. Investigators need to establish who recruited the workers, supplied equipment, managed the operation's finances, and directed its activities. International cooperation is particularly important when suspected organizers, victims, financial accounts, and digital evidence are spread across multiple jurisdictions.
The third challenge concerns the people found inside these operations. Research by UNODC and INTERPOL documents cases in which individuals are trafficked into scam centres after responding to fraudulent overseas job offers, then coerced into committing online fraud under threats, debt bondage, or physical violence.
This does not mean everyone working in a scam centre is a trafficking victim. Some may knowingly participate in criminal activity, while others may have been deceived or forced to take part. Authorities must establish individual roles and circumstances rather than assume that all people found at a compound have the same level of responsibility.
In the Nghi Sơn case, investigators announced criminal proceedings against 84 of the 118 suspects for alleged online fraud and offences involving the illegal entry, exit, or stay of others in Vietnam. The investigation's next steps will help determine the roles of those charged, the extent of the network, and whether potential trafficking victims were involved.
The next stages of the investigation may provide a clearer picture of the financial flows, organizers, collaborators and cross-border connections that sustained the operation.
The Broader Regional Challenge
The 118-person bust in Nghi Sơn demonstrates how a transnational fraud operation can establish a sophisticated base inside Vietnam while drawing on personnel who had previously resided in neighbouring countries.
But a single raid cannot, by itself, establish that Vietnam is becoming a major destination for scam networks displaced by regional crackdowns. That conclusion will depend on whether further investigations reveal recurring relocation routes, shared organizers, common financial infrastructure, or similar operations appearing elsewhere in the country.
The immediate operation has been disrupted. The broader challenge is preventing the networks behind it from simply reorganizing across another border.
For Vietnam and its regional partners, that means looking beyond the premises where fraud takes place to the infrastructure that sustains it: recruitment channels, digital systems, financial intermediaries, and the people who coordinate operations across jurisdictions.