What is the cyber scam surge in Cambodia 2026?
Cambodia’s position as a global nexus of cyber-enabled fraud has been thrust into sharp international focus over the past three to four months. Between December 2025 and April 2026, Cambodian authorities carried out extensive enforcement campaigns across the country against online scam centres. The enforcement action was followed by mass deportations consisting of nine nationalities, including Indian, South Korean, Chinese, Japanese, United States, the Philippines, Pakistani, Russian and Cambodian. According to the Commission for Combating Online Scams (CCOs), joint task forces have raided over 2,500 locations since the enforcement campaigns began, resulting in the dismantling of more than 200 major cyber fraud centres. The United Nations Office on Drugs and Crime (UNODC) estimates that between 100,000 and 150,000 people are exploited in scam compounds in Cambodia, generating between USD 12.5 and USD 19 billion annually. Despite sustained enforcement, the goal of eliminating online scam centres by April 2026 was not met, leaving Cambodia a complex and evolving risk environment for businesses, travellers, and regional stakeholders.
What is the scale of enforcement operations?
The current enforcement drives formally commenced in June 2025 following a directive from Prime Minister Hun Manet and the publication of an Amnesty International report documenting at least 53 active scam compounds across Cambodia. Authorities raided approximately 2,500 locations in total between June 2025 and March 2026. Between January and February 2026 alone, 190 locations were targeted across Phnom Penh and multiple provinces. Roughly 200 converted casinos and buildings were shuttered indefinitely. Equipment seizures since June 2025 amounted to 10,444 computers and 36,476 smartphones. Authorities detained approximately 3,575 individuals from nine nationalities. Between June 2025 and March 2026, about 48,000 foreign nationals were deported from Cambodia. Additionally, the Interior Ministry reported that approximately 210,000 foreigners departed voluntarily. In the first eight months of the enforcement drive, 37 cases were brought before the courts, resulting in the conviction of 172 ringleaders and gang members.
Which areas in Cambodia are key hotspots?
Key hotspot areas include Preah Sihanouk (Sihanoukville), with Great Wall Park, Nanhai Hotel, and casino and hotel complexes involved in pig butchering, crypto fraud, and online gambling fronts. Banteay Meanchey (Poipet) has multi-storey complexes near the Thai border crossing involved in romance scams, fake loan services, and call-centre fraud. Svay Rieng (Bavet) has the Wan Cheng (A7) casino complex and Venus Casino, involved in investment scams, telecom fraud, and trafficking. Phnom Penh and Kandal have the Garden City Hotel, Phnom Penh Hotel, and urban residential properties involved in cryptocurrency fraud and money laundering fronts. Koh Kong has resort and Special Economic Zone compounds serving as displacement sites. Pursat has scattered residential compounds serving as overflow operations. Pailin and Anlong Veng have SEZ-adjacent compounds near the Thai border emerging as relocation hubs. Mondulkiri has remote jungle compounds serving as newer trafficking hubs. Oddar Meanchey (O Smach) has the O Smach Resort and border-area facilities. Kampot and Bokor Mountain have mountain resort compounds involved in romance scams.
What are the trafficking trends and types of scams?
Cambodia’s scam compounds are large-scale human trafficking operations. Workers are recruited from at least 56 countries, with an estimated 100,000 to 150,000 people trafficked and held at any given time. The most widespread recruitment method is fraudulent job advertisements on Facebook, Instagram, TikTok, Telegram, and LinkedIn, posing as legitimate employment agencies. Once targets express interest, communication moves to Telegram or WhatsApp, with fake interviews and forged contracts. Workers are guided to transit countries such as Thailand, Vietnam, or Malaysia before being moved into Cambodia. Upon arrival, passports are confiscated. Kidnapping is also significant, with South Korea reporting incidents rose from four cases in 2021 to 330 in the first eight months of 2025. Inside compounds, workers face physical coercion, debt bondage, electric shock batons, isolation chambers, and torture. Scam types include pig butchering (romance-investment fraud), cryptocurrency investment fraud, voice phishing (vishing), digital arrest scams, fake loan services, task scams, and money laundering.
What is the government response and impact on businesses?
After the establishment of the Commission for Combating Online Scams (CCOs), Cambodian agencies launched “Operation XXL” in February 2025. In early April 2026, Cambodia’s parliament enacted a dedicated law aimed at dismantling scam centres. On 06 January 2026, Chen Zhi, founder of the Prince Holding Group, was arrested and extradited. The enforcement actions have led to localised but significant security disruptions, particularly in provinces hosting large-scale raids such as Preah Sihanouk, Svay Rieng, Banteay Meanchey, and Phnom Penh. Large police deployments, roadblocks, and perimeter lockdowns continue to restrict movement and temporarily disrupt commercial and residential activity. The cyber scam ecosystem remains active and fragmented rather than fully dismantled, with a shift from large, visible compounds to smaller, more dispersed operations. Immediate operational impacts include increased inspections, document verification, compliance checks, temporary disruptions at mixed-use properties, and episodic delays at border zones. Labour availability has tightened as foreign workers exit, and local workers reassess engagement with high-risk industries.
What should organisations and individuals do to prepare?
Foreign companies operating in Cambodia should undertake an urgent audit of all cyber, financial, and payment-related activities to identify any inadvertent exposure to scam-linked networks. Establish or update a Cambodia-specific Business Continuity Plan that accounts for enforcement-related disruptions, including alternative logistics routes, remote-work protocols during enforcement-day lockdowns, and pre-approved secondary transport and accommodation providers. Ensure that all employees, contractors, and logistics personnel travelling to or within Cambodia carry valid identification, vehicle registration documents, and up-to-date emergency contact details for their respective embassies. Deploy or enhance cybersecurity controls, including advanced anti-phishing tools, multi-factor authentication, executive impersonation detection, and domain-monitoring services. Travel to Sihanoukville, Poipet, Bavet, and border-adjacent special economic zones should be evaluated carefully. Maintain close monitoring of announcements from the Cambodian CCOs, the General Department of Immigration, and relevant foreign embassies in Phnom Penh.
Frequently asked questions
When did the Cambodia cyber scam enforcement operations begin?
The enforcement drives formally commenced in June 2025 following a directive from Prime Minister Hun Manet and the publication of an Amnesty International report documenting at least 53 active scam compounds.
Which areas in Cambodia are most affected by cyber scam operations?
Key hotspots include Preah Sihanouk (Sihanoukville), Banteay Meanchey (Poipet), Svay Rieng (Bavet), Phnom Penh, Koh Kong, Pursat, Pailin, Mondulkiri, Oddar Meanchey, and Kampot.
What are the emergency contact numbers for Cambodia?
Emergency numbers vary. In Cambodia: Police 117, Fire 118, Ambulance 119. For tourist police: 023-724-793. For embassy assistance, contact your home country’s embassy in Phnom Penh.
Download the full advisory now
datasurfr’s Special Advisory on the Cyber Scam Surge in Cambodia carries the complete enforcement data, the full hotspot map, and a detailed recommendations directory. Download the full advisory now to brief your travel and continuity teams.
Filed under: APACThreat Intelligence Special Reports
