Foreign workers, local sponsors: Inside Palau's hotel scam centers
- Admin
- 42 minutes ago
- 7 min read
By Bernadette Carreon and Emanuel Stoakes
(OCCRP)- When police raided the Cocoro Hotel in Palau’s main city of Koror in January, the scene they uncovered was far removed from the tiny Pacific island country’s postcard-perfect image.
It was a sight that has become disturbingly familiar in the Asia-Pacific region.
This operation had the hallmarks of an online scam center—untold numbers of which are powering a brutal Asia-based cyber-fraud industry largely run by Chinese crime syndicates.
Such centers often rely on trafficked and abused workers to target people online with a combination of romance, gambling and investment schemes, which are estimated to steal over $60 billion a year from victims worldwide.
They are most famous for what has come to be known as “pig-butchering,” a reference to scammers’ core technique of building trust with their victims, before going in for the kill and draining their bank accounts.
A new trove of documents obtained by OCCRP sheds light on how the operation inside the Cocoro Hotel actually worked, along with a similar operation uncovered two weeks earlier at another hotel, the Beluu Sea View Resort.
The documents include investigative reports from Palau’s security agency, digital forensic analyses and internal files from the computer systems of the scammers.
They reveal a sophisticated business model where around two dozen workers from countries like China and Vietnam, some of whom appeared to be working under coercive conditions, used prepared scripts to target victims through Chinese-language gambling sites.
One of the operations netted profits of at least $200,000 a month, with proceeds then funneled offshore using cryptocurrency, according to Jay Hunter Anson, the chief information security officer at Palau’s Ministry of Finance.
Despite these initial reports, it is not clear whether authorities are actively investigating the centers. Palau's National Security Coordination Office, Immigration Agency and Bureau of Public Safety, the national agency responsible for criminal investigations, did not respond to queries about whether the raids had led to any prosecutions or ongoing investigations.
According to Anson, scam operations have been “getting worse, bolder” in Palau, and yet the island nation has few resources to combat the problem.
The country has “zero cybercrime laws or regulations,” he told OCCRP.
Although at least 12 workers were detained in the January raids, they were simply deported because the country does not have the laws and capacity to pursue prosecutions, he said.
There is another problem. These scam sites often appear to be “supported by local facilitators who use their positions to enable, conceal or legitimize illicit activity,” Anson told OCCRP.
One of the recently busted centers was able to operate undetected for about two-and-a-half years in the close-knit country of just 18,000 people.
The files reveal that many of those working at the centers raided in January had their work visas sponsored by construction and IT companies belonging to local political and business elites in Palau, including the owner of the Cocoro Hotel, Vance Polycarp, who was also a member of the board of Palau’s banking regulator until earlier this year. He did not respond to requests to comment, and there is no further evidence in the files that he had any involvement in the suspected scam site.
As OCCRP and local media have previously reported, this is not the first time that prominent Palauans have been implicated in facilitating the entry or establishment of foreigners later arrested in raids on alleged scam operations.
What else does this recent cache of files show?
Evidence seized in the January raids showed the workers at the apparent scam centers came from countries like China, Malaysia, and Vietnam. Some were given Chinese-language nicknames such as “Shark,” “Tall and Elegant,” and “Little Hero.”
According to spreadsheets found on their seized devices, a total of 21 people had been listed as “employees” of the operation at Cocoro Hotel since 2023 or earlier.
All of them had held work visas sponsored by companies owned by one of two prominent Palauans: Polycarp and the country’s former vice president, Elias Camsek Chin.
At the other apparent scam center in Beluu Sea View Resort, two suspected scammers detained in the raid also had visas sponsored by companies owned by Polycarp, according to a National Security Coordination Office document obtained by OCCRP.
Chin, the former vice president, who was also reportedly the visa sponsor of eight Chinese nationals arrested in an earlier alleged scam operation in 2020, denied any wrongdoing when reached by reporters, and said the workers he had sponsored were caught up in the raids because they happened to be visiting friends in the hotel at the time.
“They were not involved in scamming. They were in a place where the raid took place but they were not scammers. They were there because their friends were living in that hotel,” he said.
Chin is not under investigation and has not been charged with any crime.
According to a forensic analysis of devices seized in the raid by a private firm contracted by Palau’s security agency, the workforce at the Cocoro Hotel was “tightly tracked” under a “sophisticated HR management” system.
The report did not shed light on who was ultimately behind the operation, but it cited internal computer files that, it said, revealed “a structured, transnational criminal organization operating under the cover of multiple IT and construction companies.” All of the companies listed in the files as employing the site’s staff were owned by either Polycarp or Chin, according to Palau's corporate registry.
Asked for comment on the claims in the report, Chin said: “My employees were not and have not been charged for gambling or illegal activities as you pointed out, therefore I cannot comment as I don't know anything about these allegations.”
Some of the detained workers, who were mostly in their late 20s, “confessed to having never left the building in the past months, and sometimes years, that they have worked there,” Palau’s National Security Coordination Office noted in a report about the raid.
It added that this testimony was supported by “observations of food catering being delivered to the location” from a Chinese restaurant over the course of eight months.
This type of isolation is typical of pig-butchering operations throughout the world, said Erin West, founder and president of the global anti-scam nonprofit Operation Shamrock.
“That people weren't allowed to leave for months or years is insanity,” she told OCCRP. “That is a crazy amount of time that they're stuck there, and it's very consistent with what we're seeing in other places.”
The files found on the suspected scammers' computers revealed evidence that the centers were part of a network running online gambling, which is illegal in mainland China, and cryptocurrency fraud, according to reports by forensic investigators.
One device seized at Beluu Sea View Resort was packed with files and apps for running and marketing an online lottery, dubbed “6688 Caipiao,” that appeared to target Chinese-speaking customers.
The documents also included instructions in Chinese that directed workers to use tactics for attracting and psychologically manipulating victims, and potentially rigging bets, according to the report prepared for the Palauan government by analysts from a private cybersecurity firm.
The report describes how one such document presented “two methods for deceiving customers”:
“Offer an attractive bonus and then change the bonus conditions once the customer has deposited the money.”
“Use emotional tactics to manipulate the customer and convince them to deposit more money.”
The files seized from Cocoro Hotel, some of which were encrypted and had to be cracked by investigators, show that the center also used detailed instructions on how to attract victims to gamble on a range of websites, according to the report, which did not identify the perpetrators of the alleged scam but recommended Palau authorities coordinate with other international law enforcement in order to do so.
Behind the scenes, the scammers appear to have run such sites from the back end, allowing them to change the amount of money held in an account, offer bonuses that were not real, and hide losses in order to trick users into thinking they were gambling successfully, the report’s author told OCCRP.
The files “clearly indicate that the individuals operating these devices were managing a coordinated criminal network under the guise of an online gambling enterprise,” the report concluded.
“There is a strong indication that the criminal operation extended beyond illegal gambling,” it added. “It likely involved malware deployment, potentially used to infect victims' systems, conduct fraud and expand the criminal network through unauthorized access.”
Jarod Baker, co-founder of Honolulu-based consultancy Pacific Economics, which advises the government of Palau, described both operations as having the same modus operandi as a string of other scam centers allegedly run by Chinese organized crime that have been busted in Palau in recent years.
“The activities of illegal gambling, cyber fraud, crypto laundering, identity fraud, and workforce exploitation are all hallmarks of Chinese TOCs [transnational organized criminal groups],” he said.
Baker noted that the scams discovered in January appeared similar to the cyber-crime ring busted in Palau in 2020, whose workers had also reportedly had their visas sponsored by former Vice President Chin.
"We see the same facilitators in Palau who are bringing these people over or hiring them as IT specialists for their companies,” he said. “It's the exact same people, they're just operating under different company names."
Investigators who used digital forensic methods to follow the money trails from the Beluu hotel were able to trace payments sent through the crypto platform Tron.
With its limited law enforcement capacity, Palau remains a welcoming location for organized crime groups.
“There is a continuing and evolving threat from organized scam operations in Palau,” said Anson. “What we have found since the raids, is that these networks depend heavily on insider access and protection to sustain predatory investments and obscure the flow of funds.”
Subscribe to
our digital
monthly edition