Overview of the scam hub in Cebu, Philippines
In Cebu, Philippines, a scam call center ran a sophisticated $800,000 crypto fraud from the second floor of the Skyrise building in Cebu IT Park, using fake investment products like Quantum AI and Bitcoin Code.
Leveraging the Philippines’ low labor costs and strong English skills, the fraudulent investment group operated to scam unsuspecting victims in South Africa, Nigeria and the Gulf countries, promising high returns to lure deposits. Earlier, it used to target people in Canada, the UK and European countries. The scamsters have been operating under different names, such as BMJ Data Processing Services, Virtual Wealth Exchange, Solless Markets, BTC Boutique and more.
A YouTube content creator, “Mrwn,” hacked into the scammers’ operations, gaining access to their CCTV and internal systems. He kept a watch over the group for more than a year before confronting the group’s boss, triggering panic and forcing them to go offline.
Did you know? One of the biggest crypto scams, PlusToken, ran from 2018 to 2019 and stole over $2 billion from users. The Ponzi scheme disguised itself as a crypto wallet offering high returns.
How crypto scammers in Cebu, Philippines operated
The scamsters used a calculated mix of psychological manipulation, fake product pitches and poor data security practices to defraud unsuspecting victims. What appeared to be a legitimate business on the surface was, in reality, a well-organized scam syndicate.
Here is how the operation worked:
Use of a script for deception
The scammers relied on a 14-page call script that sounded professional and sincere to the victims. Calls began with a warm greeting, followed by a pitch for fake investment platforms like Quantum AI and Bitcoin Code. The script led to the goal of convincing victims to make an initial deposit.
Emotional manipulation
Agents used psychological pressure to manipulate victims’ behavior. For instance, to lure victims, the fraudsters made promises of 30%-40% weekly returns. In one call, a scammer pushed a South African victim by questioning whether he wanted to “stay poor forever.” They also falsely claimed to be operating locally in cities like Cape Town or Abuja to gain trust.
Deploying various tactics to get funds
Agents deceived victims using multiple tactics, such as stealing credit card information and pressuring individuals to send cryptocurrency through Bitcoin ATMs.
Data mishandling
The scammers had a voluminous amount of critical data belonging to victims that they could sell on dark web markets. Victims’ card details were stored in plain text, leaving them exposed to identity theft, further putting the victims’ funds at risk.
The combination of emotional manipulation, deception and data exploitation paints a disturbing picture of a scam syndicate operating under the guise of a legitimate company, only uncovered thanks to Mrwn’s infiltration into it.
Did you know? Scammers often mimic popular crypto websites with slight domain changes, a tactic called typosquatting. One wrong letter in a URL can land you on a fake site ready to drain your wallet.
How did the YouTuber Mrwn discover the call center crypto scam?
The investigation began when a friend of the YouTuber Mrwn received a suspicious call in the middle of 2024 promoting an investment via Quantum AI. Sensing something was off, Mrwn launched a deeper probe into the operation:
- Infiltrating the call center: Using social engineering techniques, Mrwn gained access to the scammers’ internal systems. This included live CCTV feeds inside their office and access to individual computers. Despite the scammers relocating their office multiple times, Mrwn managed to maintain access, including to their boss’s system.
- Identifying key players: Through continuous monitoring, Mrwn identified two central figures in the operation. The floor manager, known as “Marcus,” was revealed to be Antonio, as he verified through rent agreements and official documents. The top-level handler, “Adam,” operated using an Israeli phone number and was likely an alias.
- Hard evidence collected: Mrwn’s investigation yielded substantial evidence, including recorded scam calls, internal messages and financial spreadsheets. These documents showed the group made approximately $820,000 annually, with $365,340 in net profit after rent and salaries.
- Role of crypto in the scam: Local crypto news outlet BitPinas noted that the manager’s screen displayed email notifications about maintenance and login alerts from crypto exchanges Binance, Netcoin and the local platform Coins.ph, increasing suspicions about the role of cryptocurrency in the scam operation.
- Corporate cover: The group was executing its fraudulent activities under the name “BMJ Data Processing Services.”
Year-long undercover work by Mrwn exposed the full scope and structure of the scamsters’ operation.
Did you know? In many phishing scams, victims are asked to connect their wallets to fake DeFi apps. These apps often include hidden smart contracts that silently approve unauthorized transfers.
How did YouTuber Mrwn confront the call center crypto scammers?
After nearly a year of collecting evidence, Mrwn chose to directly challenge the crypto scammers. As the group relocated to a new office in Cebu, he followed their trail and executed a daring digital confrontation, leaving the fraudsters shaken and disorganized.
This is how he confronted the scammers:
- Accessing the new office: When the scammers shifted to the Gallery building near Cebu’s Envy Bar, Mrwn swiftly accessed their network. He tapped into their CCTV system. Soon, he spotted familiar faces from the previous office settling into the new space.
- A digital face-off: Impersonating the boss, “Adam,” on Telegram, Mrwn unnerved the agents by sending screenshots from their own CCTV. This sparked panic and confusion. He then used the office manager’s laptop microphone to confront Marcus, whose real name is Antonio, live. Efforts of Mrwn to talk to the actual “Adam” failed, as he blocked, unblocked and avoided direct communication.
- The aftermath: The scammers immediately fled the office, some hiding their faces. By the next day, the scam center’s servers and CCTV cameras were offline, showing their operations were disrupted.
How did the Philippine government respond to the crypto scam?
Mrwn shared screenshots of his efforts to reach out to various Philippine government agencies, most of which received no response. The Department of Justice replied, suggesting he file a police report locally. However, this wasn’t possible, as Mrwn is not located in the Philippines.
However, the video going viral seems to have prompted some action. “We reject the idea that the Philippine government does not respond to challenges,” said Department of Information and Communications Technology Assistant Secretary Renato Paraiso during a virtual press conference, addressing Mrwn directly and committing to an official investigation. “Mrwn’s investigation has provided valuable leads, and we already have several persons of interest. We will pursue this investigation, aiming to identify specific crimes, locate these individuals, and apprehend them.”
Earlier, a viewer had emailed Mrwn, expressing concern regarding the widespread presence of scammers in the Southeast Asian nation and the government’s apparent inaction.
