The United Nations has put a figure on Southeast Asia's scam economy, and the number reframes the problem.
In an assessment published on 21 July 2026, the UN Office on Drugs and Crime estimates that scam operations run out of the region stole between US$88.3 billion and US$114.1 billion from victims across East Asia, Southeast Asia, Australia, and New Zealand in 2025. That is at least three times the 2023 estimate of US$18 billion to US$37 billion, and it is larger than the annual economic output of several countries in the region.
The earlier instalments in this series looked at who runs the compounds and how they feed global payment fraud. This one is about what changed in the year since: the compounds have started to behave like companies.
A criminal economy the size of a national budget
UNODC describes a single, service-based criminal economy rather than a scatter of separate gangs. Laundering, human trafficking, data theft, and online fraud now operate as specialised functions plugged into shared infrastructure, closer to a franchise network than a cartel.
The report frames this as a strategic move away from trafficking physical goods such as drugs and towards selling services like cyber-enabled fraud, which leave little trace and are far harder to seize or attribute to any single actor. It also points to the tools driving the scale-up, including the adoption of AI to automate deception, generate convincing personas, and accelerate cryptocurrency theft.
Much of the work is still done by people held against their will. The UN estimates that around 300,000 people from dozens of countries have been drawn into compounds across the region, many of them trafficking victims.
The financial engine is investment and romance fraud aimed at individuals, but the same networks and the same laundering rails move the proceeds of business payment fraud, which is where the risk crosses into corporate finance.
Crackdowns that scatter the problem instead of ending it
The corporate turn is a direct response to enforcement. As The Edge Singapore reported from the UN findings, syndicates have moved out of fortified, easily identified compounds and into ordinary office blocks and villas, and have merged fragmented operations to withstand raids and expand across borders.
Australia's ABC documented the same pattern along the border between Thailand and Myanmar, where compounds have kept growing despite a publicised crackdown, breaking into smaller sites and reappearing in purpose-built business parks built to house more of the same.
UNODC is direct about why the region is so hard to clear: the syndicates exploit the power vacuums left by conflict, corruption, and weak governance in Myanmar, Cambodia, and Laos. Enforcement has produced visible arrests and seizures, and the pressure on those governments is real.
Singapore shows what that pressure looks like from a country on the receiving end. Its own reported scam losses fell for the first time in 2025, down to S$913 million from S$1.12 billion the year before, and it has taken enforcement past its own borders. In October 2025 the Singapore Police Force named 27 Singaporeans as members of an organised crime group run out of a scam compound in Cambodia, with reported losses of about S$41 million.
Weeks later, in reporting picked up by the Straits Times, Singapore seized more than S$150 million in assets linked to the Cambodia-based Prince Group network. Singapore has pushed the response outward as well, leading the ASEAN Guide on Anti-Scam Policies and Best Practices that regional digital ministers endorsed in 2026. But the region's 2025 loss figures describe an economy that is still expanding even while it is being policed.
Assume the polish, verify the payee
That is what the corporate turn changes for finance teams rather than only for police. An economy that runs out of office blocks, registers shell companies, and launders through property is built to be hard to tell apart from a real counterparty.
The qualities that help it survive a raid also help it clear a quick check by an accounts payable team: a plausible company name, a registered address, an invoice indistinguishable from every other invoice. Once the fraud economy is industrialised, the mere appearance of legitimacy stops being evidence that a payment is safe.
The practical response is to stop using surface legitimacy as a proxy for a safe payment.
- Verify the ownership of a bank account before paying it, through a source independent of the invoice or the email that asked for the change.
- Confirm vendor bank detail changes through a second channel outside email, every time, and send any change that arrives with a new account and a sense of urgency to a second reviewer.
- On cross-border payments into and out of the region, treat a mismatch between the vendor's registered name and the account name as a reason to stop, not a formality to wave through.
The UN's figure will be read in most boardrooms as a law-enforcement story, but it is just as much a procurement and payments one. Verifying who actually owns a bank account before money leaves is the control that holds up whether the fraud is run by one person or by the industrial economy UNODC has now measured, and it is the gap Eftsure is working to close globally. Find out how we can help.
The question for APAC finance leaders is whether their payment controls still assume a lone fraudster, or the corporate economy the UN has just described.
