The directions have been clear: He had 4 days to make every sufferer fall in love.
And there have been a number of victims. On-line, Safeer Mohammed Koorimannil, who was trafficked to a rip-off middle in Myanmar, impersonated a 28-year-old Singaporean girl named Ella. On a typical shift, he mentioned, he chatted with greater than 100 individuals throughout dozens of profiles on the similar time, as supervisors prowled among the many desks with electrical batons.
In only a month, Koorimannil focused some 50,000 victims from at the very least 17 nations, in keeping with data he smuggled out to The Related Press. His “shoppers” included a widowed tailor in Kurdistan, a pastry chef in Turkey, a sheep farmer in Kyrgyzstan, troopers in Iraq, an engineer in Russia, a constructing painter in Germany, a port officer in Argentina, a scholar in Indonesia, a safety guard in Poland and a dairy farmer within the Republic of Georgia. And he did it utilizing software program constructed with artificial intelligence fashions from American tech corporations that scammers are abusing to focus on victims at unprecedented velocity and scale. “Everyone seems to be a robotic there,” he instructed AP from his dwelling in southern India in his native Malayalam language.
Expertise from American corporations is getting used to energy a revolution within the rip-off trade, enjoying a key function within the industrialization and globalization of fraud in ways in which haven’t been clear till now, an AP/”FRONTLINE” investigation has discovered. Watchdogs say these corporations have the technical capability to do extra to guard towards abuse however lack the authorized, regulatory, and enterprise incentives to crack down on a criminal offense the Federal Commerce Fee estimates value People practically $200 billion in losses in 2024.
Whereas most public scrutiny of the know-how that fuels scams has targeted on the social media platforms victims see, the infrastructure exploited to commit fraud begins a lot farther upstream, the investigation confirmed. American know-how is current all alongside the digital provide chains that join scammers with the scammed, from AI fashions baked into highly effective new instruments to optimize workflow and create extra excellent fakes, to satellite tv for pc dishes that allow scammers to evade web crackdowns, to web service suppliers that carry visitors from the lawless borderlands of Myanmar to the telephones and computer systems of thousands and thousands of victims.
The AP discovered no proof to recommend these corporations have been doing something unlawful themselves. Nevertheless, the abuse of their instruments and tech infrastructure at rip-off compounds in Myanmar, as documented by the AP and “FRONTLINE,” raises questions on how vigorously they’re implementing their very own phrases of service, which prohibit criminality and, in lots of instances, explicitly ban fraud.
Among the many AP’s findings:
—American-made AI fashions—mainly ChatGPT and Gemini—have been used to construct specialised software program that enables scammers to seamlessly work throughout dozens of languages, surveil employees and goal victims world wide, the investigation discovered with the assistance of C4ADS, a Washington-based nonprofit targeted on international safety. Scammers who bought these instruments took in tens of thousands and thousands of {dollars}, in keeping with blockchain evaluation by TRM Labs on the request of AP/”FRONTLINE.”
—A classy, international web infrastructure helps Myanmar’s scam-compound financial system, which depends on companies from Cogent Communications, AT&T, DigitalOcean, and Oracle, amongst others. One in 5 alerts from units at 4 rip-off compounds linked to sanctioned entities in Myanmar was carried by a U.S.-registered firm, in keeping with an AP evaluation of greater than 200,000 machine connections supplied by Worldwide Justice Mission, an anti-trafficking nonprofit.
—Elon Musk‘s satellite tv for pc web firm, Starlink, is the primary web service supplier in Myanmar, together with to rip-off facilities, in keeping with machine information, public data and interviews—regardless of public strain from Congress and a extensively publicized crackdown final fall.
—Not less than 25 new rip-off compounds have been constructed deep inside Myanmar since a high-profile crackdown alongside the Thai border final fall, new satellite tv for pc imagery reveals. Scammers from at the very least 13 of those outposts used Starlink IP addresses to get on-line between early March and the tip of Might, an AP evaluation of machine and satellite tv for pc information from Worldwide Justice Mission reveals.
The AP/”FRONTLINE” investigation was based mostly on tens of 1000’s of leaked rip-off middle information, movies and pictures; an evaluation with C4ADS of misuse of AI at rip-off facilities; an examination of greater than 200,000 connections made by units over a yr at 4 rip-off compounds in Myanmar linked to entities sanctioned by the U.S. authorities; and interviews with 58 rip-off victims and three dozen present and former scammers from 19 nations.
Cybersecurity consultants say web service suppliers, AI corporations, and Starlink might do extra to stop the abuse by scammers—however lack the authorized, regulatory, and enterprise incentives.
“If there’s no disincentive to persevering with this, if there’s no value to truly facilitating scamming, then why would I spend a greenback to stop scamming?” mentioned Sascha Meinrath, the Palmer chair in telecommunications at Penn State College. “That is the issue. It’s identifiable, it’s addressable—at the very least considerably—but it surely prices one thing. And proper now the price of facilitating scamming is zero.”
Outdoors america, that value is beginning to rise. The UK, the European Union, Australia, and Singapore have launched new rules that require corporations to do extra to stop scams or face monetary penalties.
In the meantime, in Washington, lawmakers and authorities officers have been asking American tech corporations to cooperate to chop scammers off from U.S. infrastructure, however on a voluntary foundation.
In November, District of Columbia U.S. Lawyer Jeanine Pirro created the Rip-off Heart Strike Power to focus on rip-off compounds. In a four-day train in Might, the Strike Power labored with Meta, SpaceX, Google, and others to disrupt greater than 1.4 million social media and e-mail accounts, interrupt malicious IP tackle visitors, seize satellite tv for pc web terminals, and decommission servers and internet hosting infrastructure linked to Southeast Asian rip-off networks. “We is not going to enable legal organizations to weaponize our personal infrastructure towards us or devastate the life financial savings of hardworking households,” Pirro mentioned in an e-mail to AP. “Our message is obvious: we are going to discover you, we are going to cease you, and we are going to defend the American individuals.”
OpenAI and Google each mentioned they’ve sturdy packages in place to proactively disrupt scammers from abusing their instruments. Starlink didn’t reply to detailed requests for remark.
Web service suppliers emphasised that they will’t see the content material their networks carry or what finish customers are doing on-line—privateness by design that constrains their capability to watch for abuse. All mentioned they reply to legitimate abuse experiences and cooperate with regulation enforcement. None would disclose particular buyer data, citing privateness guidelines, however a number of mentioned they’d taken concrete motion in response to AP’s reporting.
OpenAI mentioned that based mostly on the knowledge AP shared, it recognized and banned three accounts that had been utilizing its fashions to help on-line scams. Oracle mentioned it was “diligently working with regulation enforcement” on the fabric shared by AP. UpCloud, a Finnish cloud companies supplier with servers within the U.S., mentioned AP’s question had prompted an inner overview and refinement of its danger evaluation processes.
OpenAI CEO Sam Altman has likened synthetic intelligence to a utility, akin to electrical energy or water. However not like water utilities, tech and telecom corporations in america are usually not answerable for proactively guaranteeing the security of the content material they carry.
Some individuals imagine that ought to change.
“This needs to be like clear water,” mentioned Matthew Moynahan, the CEO of GetReal Safety, a cybersecurity agency. “Something popping out of the faucet for an finish person, whether or not that faucet is a PC, a browser someplace, or your cell phone, soiled water shouldn’t get to you. That is what that is.”
Virtually Automated: American AI abused for industrial-scale scamming in SE Asia
Using AI in scams is exploding so quick that many within the cybersecurity neighborhood concern fully-automated scams run by AI brokers will quickly change into commonplace.
“We’re transferring in direction of a world the place perhaps you don’t want human scammers anymore,” mentioned Ari Redbord, international head of coverage at TRM Labs, a crypto analytics agency. “All you want is tons of, 1000’s, thousands and thousands of agentic brokers who don’t have to sleep, don’t have to eat, who’re 24/7 doing this.”
Already, the essential AI-powered instruments Koorimannil used required scant human intervention. His job was to chop and paste responses from scripts his rip-off bosses generated.
Koorimannil and his finest pal had answered an advert on-line for jobs encouraging tourism to Thailand. From the airport in Bangkok, nonetheless, a ready black automobile sped them to the border with Myanmar, he mentioned, and the subsequent morning armed males escorted them throughout the Moei River to Tai Chang, a rip-off compound the U.S. authorities sanctioned final yr.
Koorimannil managed to sneak out a screenshot from his laptop that AP and safety nonprofit C4ADS used to determine the important thing to his productivity—a software program platform known as Kongtian Clever Buyer Acquisition, or KT for brief.
AP additionally recognized an identical suite of software program, known as World Social Visitors Navigation, or 007TG, described by a former scammer as a “one-stop store” for operating scams at industrial scale.
KT and 007TG are a part of a thriving grey marketplace for tech that has each reliable and illegitimate makes use of and is extensively exploited by scammers, in keeping with blockchain evaluation, a overview of Telegram channels frequented by scammers, and interviews with scammers from three nations. KT and 007TG have been created by for-profit companies utilizing AI fashions from main international corporations and offered to scammers—who in flip generated tens of thousands and thousands of {dollars} in illicit earnings.
OpenAI’s ChatGPT performed essentially the most outstanding function, together with Google’s Gemini, although the software program included different AI fashions as properly, together with from Europe and China. Each KT and 007TG used ChatGPT and Gemini to generate automated replies, energy a role-play chatbot, which scammers might use to develop convincing characters, and embed real-time translation in over 100 languages, C4ADS discovered. KT and 007TG software program additionally tracked the efficiency of employees—to devastating impact, in Koorimannil’s case.
He was crushed for being unhealthy at scamming individuals, leaving his physique purple and swollen with lashes, pictures present.
“After they got here close to my laptop, my arms would shake and sweat,” Koorimannil instructed AP.
At night time, he mentioned, he and his finest pal curled in the identical slim bunk, too frightened to sleep alone.
Blockchain evaluation, achieved for AP/”FRONTLINE” by TRM Labs, reveals how highly effective these instruments could be. Cryptocurrency transactions are recorded on an indelible public ledger, or blockchain, which could be analyzed to indicate the sample and quantity of cryptocurrency transactions. TRM Labs discovered {that a} single crypto pockets utilized by 007TG acquired $860,000 in funds between April 2024 and December 2025—together with transfers from at the very least 4 cryptocurrency wallets related to identified rip-off networks. These scammers, in flip, raked in at the very least $75 million.
Stopping AI abuses at scale is difficult as a result of scammers typically use ChatGPT the identical method tons of of thousands and thousands of different individuals do—to translate, assist write messages, create content material, and do primary analysis, in keeping with OpenAI. The intimacy, monetary strain and manipulative language in romance scams, for instance, could also be exhausting to differentiate from real customers looking for assist with a divorce. And instruments like KT and 007TG can have reliable makes use of, particularly for Chinese language companies looking for to develop abroad.
However by monitoring person habits over time to floor patterns of deception and manipulation, OpenAI mentioned it detects scams with 95% accuracy and takes down 100,000 rip-off accounts every month. The corporate mentioned it has additionally independently disrupted service to rip-off networks working from Cambodia, Myanmar, and Nigeria.
Whilst fraud networks exploit their know-how, a rising variety of persons are utilizing the identical instruments to battle again. OpenAI mentioned individuals use ChatGPT thousands and thousands of occasions a month to determine and keep away from scams—as much as thrice extra typically, the corporate estimates, than the mannequin is abused by scammers. OpenAI additionally lately collaborated with the World Anti-Rip-off Alliance to launch rip-off.org, which helps customers assess the chance they’re being focused by scammers.
Google didn’t reply to particular questions on AP’s findings, however mentioned the corporate is “dedicated to creating AI responsibly” and engineers its fashions with security guardrails to filter out content material that promotes scams. 007TG went darkish in December however has since claimed to be again up and operating. Neither it nor KT responded to requests for remark.
In the long run, by a connection in Bahrain, Koorimannil and his pal discovered a dealer who oversaw ransom funds for 21 Indians from their compound, he mentioned.
They every needed to pay 500,000 Indian rupees ($5,300) for his or her freedom.
Missed alerts: U.S. web service suppliers play outsize function in carrying rip-off middle visitors
It took a very long time for Chris Colocousis to grasp the extent to which scammers world wide use American know-how to prey on individuals like him. At first, all he noticed was that the girl who reached out to him on Fb had a New York cellphone quantity—not too far-off from his dwelling in Massachusetts—and mentioned she labored at a widely known monetary agency in Atlanta.
“Eliza” recommended a video name. And there she was—the identical blond magnificence as in her Fb pictures. She even had little baggage below her eyes. She was too actual to not be actual.
Now Colocousis, a divorced man in his 60s, has no thought the place “Eliza” actually is, whether or not he was speaking together with her or with ChatGPT—and even when she’s a she. He does know that the $400,000 he says he “invested” below Eliza’s steerage is now gone, robbing him of the safe retirement he’d spent years working for.
“You simply really feel like your entire world fell aside,” he mentioned. “I’m occupied with all this time that I invested into reaching a degree the place I might retire at a sure age—and it’s simply gone.”
Every step of a fraud is a digital sign, mentioned John Breyault, vp of public coverage, telecommunications and fraud on the nonprofit Nationwide Shoppers League. And web service suppliers are the community on which many of those companies journey.
“The ISPs are in a very vital place on this chain,” he mentioned.
New information reveals that U.S. web service suppliers play an outsized function in scams run out of Myanmar. The AP analyzed a pattern of 202,013 connections made by units at 4 rip-off compounds in Myanmar—KK Park, Tai Chang, Deko Park, and a more recent website close to Hpakalu. One in 5 was routed by U.S. web service suppliers. No different nonregional nation got here shut.
Amongst them have been Cogent Communications, Oracle, AT&T, and DigitalOcean. Corporations outdoors america—together with UpCloud, the Finnish cloud supplier, and GlobalTeleHost, a Canadian internet hosting and web infrastructure firm—additionally used servers within the U.S. to host high-risk visitors from rip-off facilities, the info reveals.
“They’re getting paid some huge cash to route these IP addresses,” mentioned Riley Kilmer, co-founder of Spur Intelligence Company, a cybersecurity firm. “Proper now the income outweighs the chance. And in the event you might shift that stability, the ISPs must act.”
Web service suppliers have entry to a trove of knowledge that could possibly be used to attenuate illicit exercise, however doing so requires vital funding, cybersecurity analysts say.
“The coverage in a lot of the internet hosting world tends to be, we are going to take motion after the very fact,” mentioned Dan Winchester, co-founder of Scamalytics, a fraud prevention firm. “That’s not likely very efficient. What it’s good to be doing is proactively stopping fraud in your servers.”
The advert tech information was compiled by Worldwide Justice Mission between February 2025 and January 2026. This information captures a slice of exercise from apps that share data with information brokers, which might reveal the situation and IP tackle a given machine is utilizing when it goes on-line. AP then recognized the businesses these IP addresses had been allotted to utilizing a database maintained by Scamalytics, which additionally charges IP addresses for potential fraud danger.
These corporations have been among the many most important gamers within the dataset:
ORACLE
Greater than 100 U.S.-geolocated IP addresses allotted to Oracle have been used on the KK Park rip-off compound between February and April 2025. AP shared the detailed connection information with Oracle. “We’re diligently working with regulation enforcement on this matter,” an Oracle spokesperson instructed AP.
COGENT COMMUNICATIONS
Cogent Communications was among the many greatest gamers, with connections from KK Park and Tai Chang rip-off compounds. Almost 40% of the IP addresses allotted to Cogent appeared on publicly out there blacklists of potential abuse, in keeping with Scamalytics information. Scamalytics rated 99.6% of them as probably dangerous. Cogent says it depends on third events to report fraud and investigates each verified criticism, however like different ISPs, it might’t see person visitors immediately.
AT&T
IP addresses allotted to AT&T have been used at three compounds between February 2025 and January 2026. AT&T says it’s cracking down on fraud by making visitors on its community extra clear. In September it started implementing new guidelines that require enterprise clients to route visitors below their very own community id, not AT&T’s, to make it tougher to disguise questionable exercise.
DIGITALOCEAN
Gadgets from KK Park and Hpakalu used at the very least 41 IP addresses allotted to DigitalOcean, a cloud infrastructure supplier based mostly in Colorado. Scamalytics rated practically all as probably dangerous. DigitalOcean mentioned it reviewed the info shared by AP however declined to reveal the end result. The corporate mentioned it doesn’t management how buyer functions are used and works carefully with them to battle abuse.
UPCLOUD
UpCloud had a single IP tackle—linked to a server in New York Metropolis and rated very excessive danger by Scamalytics—which linked at the very least 382 occasions between February and April 2025 with units inside KK Park. UpCloud mentioned the info AP shared “triggered a radical inner overview on our aspect to make sure that the chance of comparable conditions is additional lowered going ahead.” The corporate mentioned it might have concerned a VPN hosted on its platform, however famous that it can not entry buyer techniques, that are non-public. They declined to offer additional particulars, citing European information safety legal guidelines. The agency mentioned it displays for criminality as mandated by EU regulation however doesn’t depend on Scamalytics as a result of their danger assessments are usually not detailed sufficient.
GLOBALTELEHOST
GlobalTeleHost, a Canadian firm that gives information middle tools and community connectivity for enterprise clients, was allotted IP addresses used at KK Park and Tai Chang. Two-thirds appeared on public blacklists as probably abusive, in keeping with Scamalytics, which rated 99.9% as probably dangerous.
GlobalTeleHost mentioned it doesn’t serve finish customers immediately and doesn’t management its clients’ functions, visitors or inner overview processes. The corporate mentioned the IPs shared by AP have been assigned to business VPN suppliers. The corporate mentioned it handed AP’s technical findings to these clients and requested them to research, however some responded that their data weren’t detailed sufficient to determine particular customers. GlobalTeleHost mentioned it doesn’t depend on Scamalytics danger rankings however acts on “verified abuse complaints and lawful requests from authorities.”
In lots of instances, scammers in Myanmar routed their web connections by U.S.-based cloud companies to cover the place they have been actually positioned earlier than connecting to main platforms—mainly Meta, which owns Fb, Instagram, and WhatsApp, in keeping with Kentik, a community monitoring agency in San Francisco that mapped web visitors from a pattern of knowledge shared by AP. That makes it simpler for scammers to seem like elsewhere and slip previous platform security checks.
Meta mentioned that form of deliberate evasion is why collaboration—with regulation enforcement and throughout trade, together with connectivity and know-how corporations—is essential to disrupting unhealthy actors at scale.
“Scammers are decided criminals who use more and more subtle techniques to defraud individuals and evade detection on our platforms and throughout the web,” a spokesperson mentioned in a press release. By analyzing behavioral patterns of customers, Meta mentioned it has been in a position to disrupt thousands and thousands of accounts tied to rip-off facilities throughout Southeast Asia and the United Arab Emirates.
“These items is so pervasive,” mentioned Doug Madory, director of web evaluation at Kentik. “You’ll be able to efficiently launder connections to your coronary heart’s content material.”
A method to do this is by leasing IP addresses, which could be extra useful when visitors seems to originate from a widely known supplier. This worthwhile loophole could be exploited to evade safety controls. AT&T started implementing a change in September that tightened this loophole by requiring enterprise clients to announce their very own community id.
“It will be nice if everyone did what AT&T did,” Madory mentioned. “They most likely misplaced some clients out of that coverage, however these have been fairly unhealthy clients.”
Colocousis mentioned individuals who assume rip-off victims like him are gullible idiots don’t perceive the sophistication of legal organizations behind on-line fraud.
On Jan. 25, 2025, Colocousis laid out $80,000 money in neat rows on his desk, simply because the customer support consultant at his crypto buying and selling app had instructed. Eliza had instructed him if he simply paid this final bit, he might unlock his funds and withdraw all his cash.
“I’ll inform you that I really feel somewhat uneasy however I do know you retain telling me it’s okay,” he messaged her. She responded immediately with a string of kiss emojis.
The subsequent morning, a younger man, who Colocousis mentioned confirmed up in a Jeep with New York plates, trudged throughout a skinny layer of snow to his doorstep. As soon as inside, the person—who mentioned his title was Vincent—instructed Colocousis to place the stacks of $50 and $100 payments in a plastic purchasing bag. Vincent despatched a message and the cash immediately appeared within the fraudulent crypto buying and selling account Eliza had helped Colocousis open, he mentioned.
Vincent left with an enormous smile and a fast, amiable wave. “See you subsequent time,” he mentioned. “Possibly. OK. Bye-bye.”
Colocousis believes American tech corporations ought to do extra to guard individuals like him. He’s nonetheless so shaken that he says he generally has hassle leaving his home.
“The greed is—,” Colocousis looked for phrases. “I’m all for capitalism, however when it’s completely ruining individuals’s lives, people who have labored their entire life in direction of a purpose in order that they don’t should work anymore, solely to have it simply ripped out of their chest—you realize, one thing’s improper.”
Starlink is the highest web service supplier in Myanmar and scammers have been an enormous a part of its person base, information reveals
—By Erika Kinetz, Related Press
