AI Fuels Online Fraud in Malaysia and Myanmar as Regional Scam Networks Expand

Malaysia and Myanmar face a growing fraud threat

Malaysia recorded a 197 percent rise in identity fraud in 2025, the largest annual increase among countries tracked by an industry study, as artificial intelligence helped criminals create false identities and more convincing scams. In Myanmar, compounds linked to online gambling and special economic zones continued to provide bases for fraud operations, including those that force trafficked people to deceive victims abroad.

As of November 27, 2025, both countries were facing a sharp rise in online fraud. A new study released Tuesday described investment swindles, romance traps and identity theft using AI throughout their operations. Criminal groups were using the technology to expand social engineering, meaning manipulation that persuades people to hand over money or information, and to evade security checks.

The financial damage extends across the region. The United Nations Office on Drugs and Crime (UNODC) estimated that scams targeting victims in East and Southeast Asia caused between $18 billion and $37 billion in losses in 2023. Researchers at the Center for Strategic and International Studies (CSIS) estimated that the broader cyber scamming economy linked to Southeast Asia generates more than $43.8 billion annually.

Those figures describe different parts of the problem: losses suffered by people targeted in East and Southeast Asia, and revenue generated by a wider criminal economy connected to Southeast Asia. Behind both are networks combining deception, stolen information, payment services and, in many compounds, forced labor.

Malaysia and Myanmar occupy different positions in that economy. Malaysia's widespread mobile internet use and growing digital payments give criminals many opportunities to reach consumers. Myanmar's border areas offer locations where limited access for law enforcement, porous frontiers and protection arrangements help compounds keep operating.

How AI makes deception more convincing

Fraud rings use large language models, the technology behind many conversational AI tools, to produce polished messages in Bahasa Melayu, Burmese, English and Chinese. They can sustain lengthy conversations, adjust their scripts as a target responds and deliver pitches in language that sounds natural and local.

Automated systems also sort through large datasets, profile potential victims and schedule contact across messaging apps and social networks. Fake job offers, investment invitations and promises of quick wealth can arrive with details that make the approach feel personal. Locals and expatriates alike receive these tailored messages.

Deepfakes add fabricated voices and faces. A deepfake is audio or video made or altered with AI to imitate someone. Voice cloning supports calls pretending to come from a boss or a relative in distress. Fabricated video enables bogus live conversations with supposed romantic partners or investment advisers.

UNODC documented the integration of generative AI, deepfakes and malware into organized criminal operations across East and Southeast Asia. Mentions of deepfake content associated with criminal activity targeting the region increased by more than 600 percent during the first half of 2024 across platforms being monitored.

An industry study recorded a 1,530 percent increase in fraud involving deepfakes across Asia Pacific between 2022 and 2023. Authorities in Malaysia, Singapore and Indonesia have issued public alerts about AI impersonation schemes aimed at local users and victims overseas.

The attraction for criminals is practical: software can help maintain many conversations, produce convincing material and adapt an approach quickly. A familiar voice, fluent language or apparently live video gives the target another reason to trust a request before transferring money.

Identity attacks become more complex

Identity verification firms reported a change in fraud patterns during 2025. The volume of basic fraud attempts stabilized, while more complicated attacks increased. One report recorded a 180 percent jump in sophisticated identity attacks combining synthetic identities, AI, device tampering and manipulation across different communication channels.

A synthetic identity mixes genuine and invented personal details. Criminals can pair that mixture with documents and faces generated by AI, then use it to try to pass the checks required to open an account. Device tampering adds another layer by interfering with information that a service uses to assess the person connecting to it.

Malaysia's 197 percent annual increase in identity fraud placed it at the top of the countries tracked by one industry study in 2025. Scam crews were using fabricated identities and AI material to bypass onboarding checks, the identity checks performed when someone first joins a financial service or platform.

Dating platforms and online media became global hotspots for complex fraud, alongside growth in romance scams and extortion. Several countries experienced explosive increases in deepfake attacks during the previous year. The growing combination of false documents, altered device information and persuasive conversation makes detection more demanding than spotting a single suspicious image.

Verification specialists described attacks that unfold in stages and move between channels. A criminal may present an apparently credible identity at one point and use social engineering later, making the person's behavior as important to examine as the documents submitted.

Why Malaysia's payment habits matter

Malaysia sits at a crossroads of regional trade, with very high mobile internet use and rapid adoption of instant payments and digital wallets. Those services make everyday transactions convenient, while giving fraud groups fast routes to contact people and persuade them to send money.

Criminals have adapted through so called authorized scams. In these cases, the victim makes the transfer personally after being deceived. The transaction passes through the normal payment process, leaving fewer traces of a hack because the criminal's main tool is persuasion.

Investment fraud, parcel delivery cons and impersonation of government officials are common lures on messaging apps and social platforms. AI helps criminals tailor these approaches to the language and circumstances of the recipient, including colloquial wording that can make a message seem familiar.

Malaysia's challenge therefore involves both account security and the decisions people make while using legitimate accounts. A strong login process can protect access, while a convincing impersonator may still persuade the account holder to authorize a payment.

Myanmar's compounds depend on coercion and protection

Myanmar faces a different concentration of risks. Scam compounds linked to online gambling and special economic zones have taken root in border areas where law enforcement access is limited. Some operators repurposed casinos and hotels that lost business during the COVID-19 pandemic.

Satellite internet and porous borders allow operations to remain connected and target people abroad. Alliances with local armed groups and brokers provide protection and logistics, while enforcement pressure in neighboring countries has pushed some operators to relocate.

Trafficked workers are central to many compounds. People attracted by fake job advertisements can end up forced to operate phones and chats under threats of abuse. The person sending a fraudulent message may therefore also be a victim of the network directing the scam.

Interpol reported that people from at least 66 countries have been trafficked into scam centers since 2023. Roughly three quarters were taken to hubs in Southeast Asia. The organization described the compounds as a double edged threat, harming both the people forced to commit crimes and those deceived online.

Police operations have reached locations as far apart as the Philippines and Namibia, rescuing workers and seizing hundreds of devices. The geographic spread illustrates how a business rooted in regional compounds can extend its recruitment, infrastructure and targets far beyond Southeast Asia.

A criminal industry with services for rent

Investigators described a diversified business organized much like a multinational service sector. Casino owners, payment processors and cryptocurrency handlers provide infrastructure. Recruiters find workers, technical specialists supply phishing kits and malware, and managers set scripts and quotas.

Phishing kits help criminals construct deceptive messages or websites that solicit sensitive information. Tools that let customers create deepfakes themselves make fabricated media easier to obtain. Data brokers, call center managers, money mules and specialists who launder cryptocurrency sell other parts of the operation.

UNODC described a criminal service economy in which groups can rent the capabilities they need. A money mule receives or transfers criminal proceeds, helping move the funds away from their origin. Selling these services lowers the technical barrier for groups entering the fraud business.

The financial network runs through loosely regulated online gambling sites, providers of virtual asset services considered high risk, and underground banking. Stablecoins, cryptocurrencies designed to maintain a steady value, help move funds. Mixers combine cryptocurrency flows to make their origins harder to trace, while underground banking links digital transfers with cash.

Criminals layer proceeds through these channels, moving money through successive transactions and accounts. UNODC also documented new underground markets and cryptocurrency channels used to launder money. Middlemen move funds across borders, connecting the technical operation to the wider financial network.

Some of the same networks smuggle drugs, weapons and wildlife along shared routes. Those connections give them additional reach and resources. UNODC said annual profits from scam centers operating on an industrial scale now approach $40 billion, while groups led from Asia are expanding into Africa, South Asia, the Middle East, the Pacific and other areas through alliances with criminal service providers.

How a relationship becomes an investment trap

Pig butchering, a term used for prolonged investment scams, often begins with a friendly message on a dating app or social platform. The criminal develops a relationship over weeks before introducing an apparently attractive investment opportunity.

The target is then directed to a polished trading app or website displaying invented account balances. AI writes much of the conversation, creates convincing screenshots and simulates financial dashboards. Deepfake voices and videos can make a supposed mentor or romantic partner seem more credible.

The deception continues until the victim tries to withdraw money. Access fails, and the scammers disappear. A displayed balance is part of the fabricated experience, while the victim's actual funds have already entered the criminal payment network.

Romance scams, investment swindles and identity fraud increasingly share the same tools. A convincing conversation builds confidence, fabricated media supports the invented identity, and a false platform supplies the appearance of a working investment service.

The developments described by agencies and industry studies span several years:

• 2022 to 2023: An industry study recorded a 1,530 percent increase in fraud involving deepfakes across Asia Pacific.
• 2023: UNODC estimated scam losses of $18 billion to $37 billion among victims in East and Southeast Asia. Interpol issued an Orange Notice warning about scam centers.
• Since 2023: Interpol reported trafficking victims from at least 66 countries, with roughly three quarters taken to Southeast Asian hubs.
• First half of 2024: Mentions of deepfake content linked to criminal activity targeting the region rose by more than 600 percent across monitored platforms.
• 2025: Industry studies recorded Malaysia's 197 percent increase in identity fraud and a 180 percent rise in sophisticated identity attacks.

Police pursue compounds and the money behind them

Interpol has coordinated multinational raids since issuing its Orange Notice in 2023. It also promotes I GRIP, a mechanism that helps authorities freeze and recover funds across borders when victims report quickly.

United States federal agencies and prosecutors have increased sanctions, asset seizures and cooperation with counterparts in the region. Blockchain analytics, which examine transactions recorded on cryptocurrency networks, help investigators trace money through those systems.

UNODC's guidance for the Mekong region called for disruption of money flows, stronger regulation of online finance considered high risk, and better recovery of assets across borders. The agency warned that the criminal ecosystem was evolving faster than current defenses. Its warning urged governments to treat the threat as a global priority:

It is more critical than ever for governments to recognize the severity, scale and reach of this truly global threat, and to prioritize solutions that address the rapidly evolving criminal ecosystem in the region.

Enforcement pressure in parts of Cambodia, Lao PDR, Myanmar and the Philippines has displaced some operations into new business parks and remote areas, within the region and farther away. Corruption and political instability continue to restrict access to some compounds, even as coordinated operations free victims and seize equipment.

Cyril Gout, acting Director of Police Services at Interpol, described trafficking, cyber fraud and online abuse as a transnational challenge requiring sustained coordination among governments, civil society and platforms. He explained the partnerships needed:

Addressing this threat requires genuine international cooperation. That means intelligence sharing between countries, partnership with NGOs that assist victims, and close collaboration with technology companies whose platforms are exploited for scams.

Sanctions against enablers, closer oversight of virtual asset flows considered high risk, and joint financial investigations are gaining momentum. Victim testimony remains crucial. Rapid reporting to banks, cryptocurrency exchanges and police improves the chances of freezing funds before they move through more layers of accounts. No next hearing, enforcement deadline or scheduled announcement was identified.

Banks and technology firms adjust their defenses

Financial institutions across Asia Pacific are changing their controls. Nearly all have expanded compliance teams over the past two years, and many use AI for fraud detection, onboarding and efforts to prevent money laundering.

Banks in Hong Kong, Singapore and Australia are introducing consumer protections through measures such as Scameter alerts, shared liability rules and agreements across industries. Shared liability rules allocate responsibility for scam losses among the parties covered by the rules.

Asia Pacific is also adopting ISO 20022 payment messaging early. The standard allows payment messages to carry richer information, giving monitoring systems more data with which to spot unusual activity. That can reduce exposure to networks of money mules and accounts opened using synthetic identities.

Technology firms are using AI to scan for fraudulent websites, flag phishing in calls and messages, and label synthetic media. The Tech Against Scams coalition brings platforms, cryptocurrency exchanges and financial services together to share methods and indicators of criminal activity.

The Tech For Good Institute and partners argue for common definitions and information sharing across borders in real time to close enforcement gaps. Responsible AI frameworks also include watermarking and content provenance. These approaches mark generated material or provide information about its origin, helping reduce the impact of deepfakes.

Practical steps for consumers and businesses

Most scams begin with a message, call or website. The central precaution is to verify a request before acting, especially when someone asks for money or credentials. An apparently familiar voice or convincing video can now be fabricated.

Consumers can reduce their exposure through the following steps:

• Verify identities through a second communication channel before sending money or sharing credentials.
• Treat unsolicited investment and romance approaches with skepticism, especially when someone urges a move to another platform or unfamiliar app.
• Check website addresses, app permissions and reviews. Avoid installing apps from outside official stores and keep devices updated.
• Use bank and telecommunications tools against scams where available, including Scameter style risk alerts. Enable transaction notifications, set transfer limits and use strong authentication.
• Report incidents immediately to the bank, cryptocurrency exchange and police. Request an account freeze or transaction recall, and preserve messages, website details and wallet addresses.
• When using cryptocurrency, verify platforms, test with small transfers and avoid unofficial brokers and unlicensed virtual asset services.

Businesses should combine automated detection of unusual activity with staff training on social engineering. Monitoring behavior alongside identity documents can help identify synthetic identities and attacks that move between channels.

Malaysia's consumer fraud and Myanmar's compound operations form connected parts of a regional business: convincing approaches attract money, financial intermediaries move it, and protected infrastructure supports repeated attacks. Effective responses therefore involve payment providers, technology platforms, investigators and organizations assisting trafficking victims.

Key Points

• Malaysia and Myanmar experienced a sharp rise in online fraud as criminals used AI for investment scams, romance traps and identity theft.
• Malaysia recorded a 197 percent annual increase in identity fraud in 2025, the largest among countries tracked by one industry study.
• UNODC estimated $18 billion to $37 billion in scam losses among victims in East and Southeast Asia in 2023.
• CSIS researchers estimated that cyber scamming linked to Southeast Asia generates more than $43.8 billion annually.
• Industry studies recorded a 1,530 percent increase in Asia Pacific deepfake fraud from 2022 to 2023 and a 180 percent rise in sophisticated identity attacks in 2025.
• Interpol reported trafficking victims from at least 66 countries since 2023, with roughly three quarters taken to Southeast Asian hubs.
• Police are using multinational raids, sanctions, asset seizures and financial investigations, while banks and platforms expand detection and information sharing.
• Verifying identities through another channel and reporting suspected fraud quickly can help prevent transfers or improve the chances of freezing funds.