The Scammer Was Untouchable. His Infrastructure Wasn't.
A scam compound in Myanmar runs on American parts. The worker inside it reaches the victim through a U.S. social media account or a U.S. email service. The fake trading platform sits on a server rented from a U.S. hosting company. The compound itself, in a part of the world where the power grid is a rumor, often gets its internet from satellites overhead. The "profits" the victim watches climb on her screen move out as cryptocurrency through U.S. exchanges. Strip away the American infrastructure and the operation can't reach a single person in this country.
For years that fact sat there unused. We treated the scammer as the target, and the scammer was in Cambodia or Laos or across the Thai border in Myanmar, behind a name on a messaging app that deleted itself the moment the money stopped. Untouchable. So the cases died in local police queues, one victim at a time, and the losses climbed past seven billion dollars a year.
A few weeks ago I wrote about Mrs. Lao, who lost $475,000 to one of these operations, and about why her local police department had no architecture to do anything with her case. The piece ended on a claim: the model to fight this exists, we just haven't decided to deploy it at the scale the problem demands. On June 3rd, the Justice Department announced the first real piece of that model going live. It's worth looking at closely, because the idea inside it is right, and the numbers attached to it are small, and both of those things are true at the same time.
What Actually Happened
From May 18th to the 21st, the Justice Department's Scam Center Strike Force put a room together in Washington. On one side, federal investigators from the FBI, the Secret Service, and Homeland Security Investigations. On the other, representatives from Apple, Google, Meta, Microsoft, Coinbase, SpaceX, and three security firms most people have never heard of: TRM Labs, Silent Push, and Zenlayer. Police from Australia, Canada, New Zealand, the U.K., and Thailand joined too.
The government walked in with intelligence on specific targets in Southeast Asia: the accounts, the servers, the IP addresses, the crypto wallets the scam compounds were using. The companies in the room owned that infrastructure. They walked out and acted on it.
They called it Disruption Week. When the dust settled, the Strike Force reported that the private sector had interrupted more than 1.4 million social media and email accounts tied to the scam networks. Hosting companies decommissioned servers and colocation environments the operations ran on. Network providers cut malicious traffic. Acting on government information, private firms voluntarily froze over $3.8 million in cryptocurrency mid-laundering. Thai police arrested seven scammers and opened new cases.
Notice who did the disrupting. Not the FBI. Not a court order. The companies did it, voluntarily, because the scammers were violating their terms of service, and the only people who can enforce a terms-of-service violation at the scale of 1.4 million accounts are the people who wrote the terms.
That's the part worth slowing down on.
The Leverage Point Moved
Every other approach to this crime targets a node the system can't reach. The scammer is overseas and anonymous. The victim's local detective has sixty other cases and no jurisdiction in Myanmar. The trafficked worker running the script is himself a victim, lured to Thailand with a fake job offer, his passport taken, kept in line with beatings. Public reporting on these compounds documents electrocutions and murder. Arresting the person at the keyboard accomplishes nothing and isn't even just.
The infrastructure is different. The infrastructure is here, it's owned, and it's owned by a short list of companies. An Apple ID, a Gmail account, a Meta profile, a Coinbase wallet, a server in a U.S. data center, a satellite uplink: every one of those is a private product with an owner who can switch it off. The scammer can't be arrested from Washington. His Apple ID can be closed from Cupertino.
That's the reframe. For the first time, the government stopped asking "how do we catch the scammer" and started asking "who owns the thing the scammer needs, and will they turn it off." The answer to the second question is a phone call to nine companies. It turns out they'll say yes when the public is watching and the government brings them the targets.
This is the same logic that works against every other kind of organized crime. You don't have to arrest the kingpin to break the operation. You take away the thing the operation runs on. For drug networks it's the money and the supply chain. For scam compounds it's the U.S. internet. Same playbook, finally pointed at the right crime.
Now the Honest Part
1.4 million accounts is a real number. It is also small.
Reported losses to these investment scams rose 24 percent last year, to over $7.2 billion, and the FBI is explicit that the reported figure badly undercounts the real one, because most victims never come forward. One government estimate put the worldwide take of these syndicates near $64 billion a year. Against that, $3.8 million in frozen crypto is a rounding error. Seven arrests in Thailand, against compounds that hold thousands of trafficked workers, is a gesture.
So no, Disruption Week did not break the scam-compound industry. Anyone selling it that way is selling something. The compounds will register new accounts. They'll rent new servers. The disrupted infrastructure will be back online in some form within weeks, the way it always is.
What changed isn't the score. What changed is that the right people were finally in the same room with the right information, and the mechanism that pushed those accounts offline is one that can scale. A law enforcement model that depends on arresting individuals overseas can never scale, because there will always be more individuals and they will always be overseas. A model that depends on the companies who own the infrastructure enforcing their own rules can scale, because the infrastructure is finite and the owners are reachable. The first week of a scalable approach beats the thousandth week of an unscalable one. That's the whole argument for paying attention to this.
It also fits a larger pattern that's been building all year. In April, an operation spearheaded by Dubai police, working with the FBI and Chinese authorities, arrested 276 people and dismantled nine scam centers, with six alleged managers and recruiters charged in San Diego. A separate FBI effort, Operation Level Up, has quietly notified almost 9,000 Americans that they were being scammed before they lost everything, saving an estimated $562 million in funds that hadn't left yet. The enforcement machine is starting to move. The first four months of this year produced more action against these operations than the entire decade before it.
The machine moving is good. It is not the same as the machine being big enough. Hold both.
What to Tell Your Family. What to Tell Your Team.
For the people you're responsible for, the takeaway from all of this is smaller and more useful than the headlines.
The enforcement wins you're reading about happen upstream, at the infrastructure layer, and almost none of them recover an individual victim's money after it's gone. The one government effort that actually saves people, Operation Level Up, works by reaching the victim before the final transfers clear. That tells you exactly where your leverage is: before the money moves, not after.
So the advice hasn't changed, and the news doesn't change it. A relationship that started online inside the last few months and turned, somehow, into an investment opportunity is the scam. A platform that let you withdraw a small test amount so you'd trust it with a large one is the scam. A friend you've never met in person who keeps mentioning a private trading window only he can get you into is the scam. The mechanics are the same in every case, including Mrs. Lao's. The first small successful withdrawal isn't proof the platform is real. It's the bait.
If it's already happening, speed is the only thing on your side. Call the bank the same day. If the money left in the last 72 hours, the FBI's Recovery Asset Team has a real shot at freezing it, but only if the bank moves fast. Report it at IC3.gov with everything you have: wallet addresses, the platform URL, the handler's profile, every transaction date and amount. That report is what feeds the intelligence that filled the room in Washington. Your individual case may never see a courtroom. The pattern it belongs to is what makes the next Disruption Week possible.
To the Leaders Reading This
If you run a company, a department, or anything with infrastructure other people use, Disruption Week has a lesson aimed straight at you. The reason it worked is that the people who owned the abused infrastructure took responsibility for what ran on it, instead of treating abuse as someone else's enforcement problem. Apple didn't need a subpoena to close accounts that violated its own terms. It needed a reason to look and a willingness to act.
That's the whole posture, and it scales down to any organization. You own infrastructure. Your accounts, your email domain, your vendor access, your platform. Criminals will use it if you let them, and "we didn't know" stops being a defense the moment someone hands you the targets. The companies in that room chose to act before they were forced to. The ones who keep waiting to be forced are the ones the next story gets written about.
The model finally exists. This time, a piece of it actually shipped.
