Inside the Scam Compounds: How Your Pig Butchering Text Got to Your Phone

TLDR

The "Hi David, how was your trip to Miami?" text that landed on your phone last week was almost certainly written inside an industrial-scale scam compound in Southeast Asia. In January 2026, Wired journalist Andy Greenberg published a months-long investigation built around "Red Bull," an Indian IT professional who answered what he thought was a legitimate tech job, was trafficked into a compound at the Golden Triangle Special Economic Zone in Laos, and spent a year forced to run crypto romance scams 17 hours a day. The FBI's 2025 Internet Crime Report, released this month, confirms the scale: Americans lost $7.228 billion to crypto investment fraud in 2025, with complaint volume up 48% year over year. ScamVerify's own data shows the recruitment funnel is accelerating. Work-from-home scam complaints jumped 69% week over week in the most recent seven-day period we can measure.

The Wired Investigation

In June 2025, an anonymous email arrived in Andy Greenberg's inbox. The sender said he was trapped inside a crypto romance scam compound in the Golden Triangle and had access to a trove of internal materials exposing the operation. He was willing to risk his life to leak them.

The source, who used the pseudonym Red Bull because of the energy drink on his desk, turned out to be a 25-year-old Indian IT professional named Mohammad Muzahir. He had answered what appeared to be a legitimate Thai tech job posting with a quoted salary of $1,500 per month. He flew to Bangkok, was driven across the Laos border into the Golden Triangle Special Economic Zone, and had his passport confiscated on arrival. His new job was to defraud Indian-Americans using scripted crypto investment scams.

For the next year, Red Bull and Greenberg communicated daily on encrypted channels. Red Bull sent over 4,200 screenshots of internal chat logs, plus training scripts, target lists, and video walkthroughs of the compound. When using his phone while walking, he referred to Greenberg as "Uncle" to avoid suspicion from floor supervisors. He eventually escaped. The full investigation is at Wired.

The Location: Golden Triangle SEZ, Laos

The Golden Triangle Special Economic Zone sits in Bokeo Province, Laos, on the Mekong River where Laos, Myanmar, and Thailand meet. The SEZ is controlled by Zhao Wei, a Chinese businessman sanctioned by the US Treasury in 2018 under the Transnational Criminal Organizations Executive Order. Treasury designated Zhao Wei as the head of a transnational criminal network involved in drug trafficking, human trafficking, money laundering, and wildlife trafficking. The compound where Red Bull was held is part of this designated zone.

Operations in the Golden Triangle SEZ, and similar compounds in Cambodia (Sihanoukville), Myanmar (Myawaddy, Shwe Kokko), and Laos itself, share a common structure:

• Secure perimeter. Compounds are fenced, patrolled, and physically isolated. Workers cannot leave.
• Dormitory housing. Workers live on-site, four to eight to a room, with cafeteria food and a canteen.
• Round-the-clock shifts. Scam operations run 17+ hours per day across rotating teams.
• Daily quotas. Each scammer is assigned a quota ranging from $1,000 to $5,000 in victim deposits per day.
• Punishment for missed quotas. Red Bull documented beatings, electric shock with cattle prods, and solitary confinement in dark rooms.
• Confiscated passports. Every worker's travel documents are held by the operators. Escape requires bribes or outright ransom.

The Recruitment Funnel: Fake IT Jobs

Red Bull was not kidnapped off the street. He answered a job posting. That matters for everyone else who might be reading one of those postings right now.

ScamVerify tracks FTC complaint data across every subject category the FTC classifies. In the seven-day window from April 14 through April 20, 2026, complaints filed under "Work from home and other ways to make money" rose 69% versus the previous seven days (166 complaints vs 98). That is the steepest week-over-week jump of any FTC subject category we track. No other category moved more than 16% in either direction.

Year-to-date 2026 is on pace to match or exceed 2025:

Not every fake remote-job complaint represents a scam-compound recruitment attempt. Many are work-from-home stuffing-envelope scams, MLM pitches, and standard phishing. But internal materials leaked by Red Bull and similar sources at other compounds show the recruitment pipeline for pig butchering operations runs through:

• LinkedIn recruiter InMails offering "customer support" or "IT" roles in Thailand, Cambodia, Dubai, or generic "Southeast Asia."
• WhatsApp and Telegram job listings shared by recruiters who have no corporate domain email address.
• Fake staffing agency websites that look professional but cannot be verified against licensing databases.
• Referral chains. Existing trafficked workers are pressured to recruit their own network.

The Pig Butchering Pipeline, End to End

Once inside a compound, workers like Red Bull run a tightly-scripted pipeline. The scripts are uniform across compounds, which is why every pig butchering attempt Americans receive follows the same beats.

Stage 1: The Wrong-Number Opener

The first text goes out in volume. "Hi David, how was your trip to Miami?" "Hello Michael, are we still on for coffee Saturday?" The name is generic, the scenario plausible. If the recipient responds with "wrong number," the script pivots to apologetic small talk. If they ignore, the number is discarded and the scammer moves to the next target.

Red Bull's scripts showed that roughly 2 to 3 out of every 100 wrong-number texts convert to a continuing conversation. Compounds push thousands per scammer per day to hit that conversion rate.

Stage 2: Platform Migration

Within one to three replies, the scammer pushes the conversation off SMS and onto WhatsApp, Telegram, or LINE. This is not casual convenience. Encrypted chat apps evade carrier-level scam detection and make the conversation less visible to anyone looking over the victim's shoulder.

Stage 3: Relationship Building (Weeks 2 to 8)

The scammer adopts a persona: typically a successful woman in her early 30s, professional background, personal interests that match the victim's profile based on social-media reconnaissance. Daily messages, voice notes, occasional video calls using AI-edited footage. Red Bull's scripts included line-by-line templates for birthday wishes, morning greetings, and "how was your day" exchanges.

See our full breakdown of these tactics in Pig Butchering Scams 2026: $1.14 Billion Lost and Growing.

Stage 4: The Mentor Introduction

Somewhere between week 3 and week 8, the scammer casually mentions an uncle, family friend, or "mentor" who has been generating remarkable returns on a private cryptocurrency trading platform. No hard sell. Just a passing reference backed by screenshots of the mentor's portfolio.

Red Bull documented this as the single most consistent script element. Every compound uses a mentor figure. The mentor is either the same scammer using a different handle, or a senior operator assigned to close the investment sale.

Stage 5: The First Deposit

The victim is walked through creating an account on a fake cryptocurrency platform. The UI looks professional. The initial deposit is small, often $500 to $2,000. Within days, the "portfolio" shows a 15 to 30% gain. The victim is even allowed to withdraw a small amount, usually 10 to 20% of their initial deposit, to build trust.

Stage 6: Escalation

After the first successful withdrawal, the scammer and mentor encourage larger deposits. $5,000. $25,000. $100,000. Home equity loans. 401(k) distributions. Family savings. The fake portfolio continues to show explosive gains.

Stage 7: The Butcher

When the victim attempts a large withdrawal, the platform freezes the account and demands a "tax payment," "security deposit," or "anti-money-laundering fee" before releasing the funds. Victims who pay the fee are asked for another one. The cycle continues until the victim runs out of money, at which point the account is locked and the scammer disappears.

Red Bull's compound had quotas of $1,000 to $5,000 per scammer per day in extracted funds. The best-performing scammers extracted hundreds of thousands from a single victim over six to twelve months.

What This Means for the Person Reading This

The FBI's 2025 Internet Crime Report confirmed what Red Bull's leaked materials already showed. Pig butchering is no longer opportunistic fraud. It is an industrial supply chain.

If you receive a text from an unknown number asking about a person you do not know, a trip you did not take, or a dinner you did not plan, you are almost certainly being contacted by the opening stage of a pig butchering script written in a compound 8,000 miles away. Engagement confirms your number is live. Non-engagement moves you to the next list.

What You Can Do

If you get a wrong-number text:

1. Do not reply. Not even "wrong number." Reply confirms your number is active and flags you as a potential target for follow-up.
2. Report the text. Forward to 7726 (SPAM) in the US. This routes the number to your carrier's abuse team.
3. Verify the number at scamverify.ai to see if it has been flagged already.
4. Forward the full thread to scan@scamverify.ai. We are mapping the phone numbers, Telegram handles, and fake platform names used by these operations.

If a family member is being pitched one of these:

1. Do not argue about the relationship. Pig butchering victims are psychologically attached to the scammer persona. Frontal attacks on the relationship reinforce the scammer's claim that "your family does not understand us."
2. Ask about the investment platform. Any platform where the victim cannot withdraw freely, or where taxes and fees are demanded before withdrawal, is fraudulent without exception.
3. Use the FBI Operation Level Up channel. The FBI proactively contacts pig butchering victims. Report the situation at IC3.gov.

If you are being recruited:

The 3 red flags of a fake IT or remote-job pitch, documented in our fake job offer letters guide:

1. Overseas "customer service" or "IT support" role, especially in Thailand, Cambodia, Laos, Myanmar, or Dubai.
2. Salary quoted in USD but paid via crypto or transferred on arrival.
3. Recruiter only communicates via WhatsApp or Telegram, never from a corporate-domain email.

Further Reading

• Wired: He Leaked the Secrets of a Southeast Asian Scam Compound
• FBI IC3 2025 Annual Report: Full PDF
• Apple News In Conversation: Andy Greenberg on scam compounds
• US Treasury 2018 Zhao Wei OFAC sanctions: Treasury press release

The texts on your phone have a supply chain. Understanding it is the first step to breaking it.