Incognia Exposes How Overseas Scam Cities Target Global Financial System

Organized "scam cities" in Southeast Asia are industrializing financial crime by shifting from identity theft to legitimate account handovers. For fintech professionals, this represents a critical vulnerability: accounts that pass every onboarding check but are later weaponized by overseas networks using sophisticated device clusters, rendering traditional per-account security measures increasingly obsolete.

What was announced

Organized criminal networks are increasingly moving away from traditional identity theft in favor of a more scalable model: the industrialization of account handovers. These operations, often referred to as "scam cities," function as sophisticated business enterprises rather than disorganized criminal cells. Based primarily in Southeast Asia, these networks utilize massive physical compounds where teams of workers manage hundreds or even thousands of devices simultaneously. These workers are tasked with targeting global consumers through a variety of schemes, including financial fraud, sextortion, and "pig-butchering" scams.

Data from Incognia reveals the significant impact this is having on the financial sector, with 81% of institutions reporting a rise in mule account handover fraud. In these scenarios, "mules" are recruited to open accounts using their own legitimate identities. Once the account is fully verified and onboarded, it is handed over to operators in another country. This allows criminal networks to utilize accounts that have already passed rigorous Know Your Customer (KYC) and identity checks. Currently, 64% of financial institutions have suspected or confirmed these cross-border handovers within their own systems, suggesting that many platforms may already be hosting accounts operated by overseas fraud networks.

The physical infrastructure supporting these activities is becoming more sophisticated. Investigators have documented large-scale clusters where multiple accounts are operated from the same physical location using specialized hardware. This industrialized approach allows fraudsters to generate fake activity, commit bonus abuse, and facilitate collusion at a scale previously unseen. Because each account appears legitimate on its own, these patterns are often invisible to traditional security systems that evaluate accounts independently. These findings point to a new challenge where fraud does not begin with a suspicious identity, but with a legitimate account that becomes part of an industrialized operation.

"You have people, technology and infrastructure working together to target victims around the world. Once you understand what's happening on the ground, you can see why the financial system is such an important part of the operation."

Erin West, Founder and Former Prosecutor at Operation Shamrock.

The companies involved

Incognia is a specialist in the digital identity and fraud prevention space, focusing on the use of location and device intelligence to secure the digital landscape. The company provides a platform that analyzes behavioral signals, device integrity, and precise location data to identify anomalies that suggest fraudulent activity. By moving beyond static identity data, Incognia enables financial institutions to detect coordinated attacks where multiple accounts are being managed from a single "fraud farm" or compound. The company’s technology is designed to recognize the signatures of automated scripts and device clusters that are hallmarks of industrialized crime, providing a layer of defense that looks at the infrastructure behind the account rather than just the account holder's credentials.

Operation Shamrock is an initiative led by Erin West, a former prosecutor and the organization's founder. Operation Shamrock focuses on the intersection of law enforcement and the financial system to combat the rise of organized fraud compounds. West has extensive experience working with global law enforcement agencies to investigate the physical infrastructure of these networks, particularly in Cambodia. The organization highlights how these compounds often operate as forced-labor environments where workers are compelled to execute scams. By bridging the gap between on-the-ground investigation and financial security, Operation Shamrock provides critical insights into how criminal enterprises exploit legitimate financial rails to move illicit funds and scale their operations globally.

What this means

The rise of industrialized "scam cities" represents a fundamental challenge to the current regulatory and security paradigm. For years, the industry has focused on the "front door" of onboarding, but these findings suggest that the most dangerous threats now enter through legitimate channels. This puts traditional KYC providers under significant pressure to evolve or face obsolescence, as a "verified" identity no longer guarantees a safe user. The sector must now grapple with the reality that fraud is a high-growth business with its own physical and digital infrastructure.

This shift necessitates a move toward continuous, signal-based authentication that monitors the life of an account rather than just its creation. It also raises difficult questions regarding cross-border data sharing and the role of financial institutions in identifying human rights abuses, such as the forced labor often found in these compounds. As criminal networks continue to scale, the industry's ability to detect device clusters and behavioral anomalies will likely become the new baseline for financial integrity. The open question for the sector is whether current privacy frameworks can coexist with the level of device-level monitoring required to dismantle these industrialized networks.