Case Library / Smishing (SMS Phishing) / Dubai scam compound takedown: 276 arrests, six charged in San Diego (2026)
Smishing (SMS Phishing) Documented incident

Dubai scam compound takedown: 276 arrests, six charged in San Diego (2026)

Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters. What is known.

Share:

Social Engineering Examples·11 sources

The scam compound takedown came in late April 2026. Dubai Police raided at least nine pig butchering centres in Dubai and arrested 275 people, working with the FBI and China's Ministry of Public Security. Thai police picked up one more. On 29 April, federal prosecutors in San Diego unsealed charges against six people they say managed, worked for or recruited for three scam "companies": Ko Thet Company, Sanduo Group and Giant Company. Four are in custody abroad. Two are on the run. Status: Charged, no convictions.

Key takeaways

  • The centres were in Dubai, not Southeast Asia. Most of the people arrested came from Southeast Asian countries, Dubai Police said.
  • 276 arrests, six charged. The Justice Department said nothing about the other 270.
  • Losses so far: "millions of dollars", by investigators' count. No total has been given.
  • The bigger numbers you'll see next to this case, like $701 million in restrained crypto, come from a different action.

Timeline

When What happened
2025 FBI San Diego opens a Homeland Security Task Force case into compounds defrauding Americans
March 2026 A San Diego grand jury indicts an alleged Ko Thet Company manager and recruiter, plus a co-defendant who is still a fugitive
April 2026 Two criminal complaints charge four more people linked to Sanduo Group and Giant Company. One of them is also a fugitive
Week before 29 April Dubai Police raid at least nine scam centres and make 275 arrests. The Royal Thai Police arrest one more
29 April 2026 The Justice Department, FBI and IRS Criminal Investigation announce the action and unseal the charges

Dubai Police called it Operation Tri-Force Sentinel. Federal agents traced the schemes to Dubai using information from Meta, plus bank and crypto records, according to The Record. All six defendants face wire fraud conspiracy charges. The indictment adds money laundering conspiracy. Each count carries up to 20 years.

How the scam worked

This is the standard pig butchering script, as the Justice Department described it:

Stage What the operators allegedly did
Contact Reached out online and built a friendship or romance over time
Pivot Brought up crypto investing and bragged about their own profits
Set-up Helped the victim open accounts, then pointed them to an investment platform that was fake
Squeeze Pushed for bigger deposits, even if it meant borrowing from family or taking out loans
Launder Once the crypto hit the platform, the victim lost control of it. It was moved through more accounts, including the operators' own

That's all the method detail on public record. The charging papers themselves (26CR762-RSH, 26MJ2335-AHG, 26MJ2437-AHG) weren't reviewed for this page. The FBI found victims through complaints to its Internet Crime Complaint Center, interviews, and tracing on the crypto ledger.

Tip: an online friend you've never met who suddenly has a great crypto platform to share? That's the pivot. Stop there.

Which numbers belong to this case

Figure Where it comes from Does it belong here?
"Millions of dollars" in losses Investigators on this case, so far Yes. Interim, no total
8,935 victims notified, $562,726,245 saved Operation Level Up, an FBI and Secret Service programme running since January 2024 (figures to March 2026) No. A programme-wide estimate of losses prevented
$701,962,392.15 restrained, 503 domains seized The Scam Center Strike Force action of 23 April 2026 No. A separate action, six days earlier
20,000 victims in 30 countries One low-quality secondary source No. Not credibly sourced

A restraint just freezes funds through legal process. It isn't a loss, and it isn't money handed back to victims.

Who was arrested

Hundreds detained, six charged. What about everyone else? The Record put it plainly: the DOJ "did not elaborate on the status" of those arrested. Scam centres are often staffed by people trafficked into the work and held against their will. No source says any one person here was trafficked, and none says any one was a willing scammer either. So 276 is an arrest count, not a count of fraudsters.

The six charged are presumed innocent and aren't named here. As of September 2026, no arraignment, plea or conviction had been reported, and none of them is known to be in US custody.

What stops it

  • Treat crypto tips from an online friend as a scam until a bank or someone you trust in person says otherwise.
  • Never use a trading platform someone else picked for you.
  • Can't withdraw? Stop paying. "Unlock fees" and "taxes" just add to the loss.
  • Report to IC3.gov. Those complaints are how the FBI found victims in this case.
  • Banks and exchanges: flag transfers tied to new, online-only relationships.

See also the $225M USDT forfeiture and the Simex domain seizure.

Common questions

What was Operation Tri-Force Sentinel?

Dubai Police's name for the April 2026 raids on at least nine pig butchering scam centres in Dubai, run with the FBI and China's Ministry of Public Security.

How many people were arrested?

At least 276: 275 by Dubai Police and one by the Royal Thai Police. Six people were charged in San Diego.

How much did victims lose?

The Justice Department says investigators have found "millions of dollars" in losses so far. It hasn't given a total.

Were all the people arrested scammers?

Unknown. The DOJ didn't say, and scam compounds often hold people who were trafficked and forced to work.

Sources
Cite this case

Social Engineering Examples. “Dubai scam compound takedown: 276 arrests, six charged in San Diego (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/san-diego-scam-compound-takedown-ko-thet-sanduo-giant-2026

Attack Chain & Defense
1Stage 1
What happened

Victim sourcing (general pattern, not described in this case's public record): Pig-butchering operators work through volume, contacting large numbers of strangers online. The DOJ release describes these operations as organized 'companies' with managers, workers and recruiters rather than lone scammers, but it does not say how contacts were sourced, and the charging documents were not obtained for this record.

The control that would have stopped it

Mass social-platform outreach and persona-building is very hard to prevent at the source; the realistic control sits downstream, at platform-level detection of fake/scripted accounts and coordinated inauthentic behavior (Meta supplied information to this investigation, though the release does not say of what kind) rather than stopping profile creation itself.

2Stage 2
What happened

Compound staffing (general pattern, not alleged against anyone charged in this case): Scam centers of this kind are commonly staffed with a mix of willing recruits and people trafficked into the work and held against their will. DOJ documented that pattern in a separate Scam Center Strike Force action six days earlier, describing a compound in Burma where trafficked workers were beaten and forced to defraud Americans under threat of violence. No trafficking, forced-labor or smuggling charge was brought against anyone charged in San Diego in this case: the indictment alleges wire fraud conspiracy and money laundering conspiracy, and the two complaints allege wire fraud conspiracy only.

The control that would have stopped it

Disrupting forced labor inside scam compounds is primarily a law-enforcement and diplomatic problem, addressed here through the FBI's Homeland Security Task Force investigation and coordinated action with Dubai Police, the Chinese Ministry of Public Security and the Royal Thai Police rather than a consumer-side or platform-side control. Screening detainees after a raid to separate operators from people trafficked into the compound is part of that response, and the public record for this operation does not say whether or how it was done.

3Initial contact and relationship-building
What happened

Per the DOJ release, operators cultivated trust and affection with victims over time through feigned friendship or romance, then persuaded them to send money to fake investments. The public record does not state the platform of first contact. Meta, the parent of Facebook and Instagram, provided information for the investigation, and The Record reports that information helped agents trace the schemes back to Dubai rather than establishing where victims were approached.

The control that would have stopped it

Platform-level friction on unsolicited contact (message requests from strangers, romance-scam warning prompts, account-age/behavior signals) and public education on pig-butchering's 'stranger becomes friend or romantic interest fast' pattern are the nearest realistic controls at this stage.

4Stage 4
What happened

Channel migration (general pattern, not described in this case's public record): In pig-butchering generally, the conversation is steered off the public platform onto a private messaging channel, isolating the interaction from platform moderation and from the victim's social circle. No source for this case describes a channel migration.

The control that would have stopped it

User education to be suspicious when a new online contact quickly pushes the conversation off-platform, plus platform nudges that flag or slow attempts to move a new connection to another messaging app, directly target this migration point.

5Investment pitch and platform onboarding
What happened

Once trust was established, operators introduced a cryptocurrency 'investment opportunity,' walked the victim through opening accounts, and directed transfers to fraudulent investment platforms built and controlled by the scam network, per the DOJ release.

The control that would have stopped it

Crypto exchanges and wallet providers screening deposit/investment platforms against known-fraud domain and address lists, plus consumer education that unsolicited investment tips from an online romantic or friendship contact are a hallmark of pig-butchering, are the direct countermeasure here.

6Social proof and escalation
What happened

Operators touted their own fabricated trading successes to build credibility and pushed victims to invest larger sums, including encouraging them to borrow from friends and family or take out loans, per the DOJ release.

The control that would have stopped it

Financial institutions and crypto exchanges flagging escalating transfers tied to a newly formed online-only relationship, and loan/credit providers screening for the 'borrowing to invest' pattern the DOJ release calls out, counter this stage before losses compound.

7Fund capture and layered laundering
What happened

Once victims transferred crypto to the platforms, they lost control of it; the scam network then laundered the funds through additional cryptocurrency accounts, including accounts controlled by the operators themselves, per the DOJ release and the wire fraud/money laundering conspiracy charges.

The control that would have stopped it

Blockchain analytics and exchange-level transaction monitoring to trace and freeze funds moving into scam-linked wallets, plus victim self-reporting via the FBI's IC3.gov portal, are the tools DOJ credits with identifying victims and building the money-laundering case; asset forfeiture is the direct countermeasure at this stage.

8Objective completion, payout and reinvestment in the enterprise
What happened

Laundered proceeds funded the scam-compound business (recruiters, compound operations, and further victim acquisition), consistent with DOJ's framing of Ko Thet Company, Sanduo Group, and Giant Company as ongoing criminal enterprises rather than one-off scams, until disrupted by the FBI-Dubai-China-Thailand law-enforcement action.

The control that would have stopped it

This is where the case's actual disruption happened: an FBI Homeland Security Task Force investigation combined with coordinated international arrests (Dubai Police, Royal Thai Police) and Chinese Ministry of Public Security cooperation, plus platform cooperation from Meta and significant assistance from DOJ's Office of International Affairs, dismantled the compounds and disrupted the enterprise rather than relying on any single upstream control.

Quick Facts
Victim
US citizens and international individuals (other countries also affected per DOJ) targeted for cryptocurrency investment fraud through pig-butchering; victims were identified nationally through complaints filed with the FBI's Internet Crime Complaint Center (IC3), supplemented by victim interviews and financial/cryptocurrency-ledger analysis.
No victims are individually named in the public record reviewed.
Location
The at least nine dismantled scam centers were raided in Dubai, United Arab Emirates, by Dubai Police under the UAE Ministry of Interior (275 arrests), with one further arrest in Thailand by the Royal Thai Police and cooperation from the Chinese Ministry of Public Security.
Dubai Police state that most of those arrested were nationals of Southeast Asian countries, which is the arrestees' nationality and not the location of the compounds. The federal criminal case, one indictment and two complaints, was filed in the Southern District of California, San Diego. The DOJ release's only Southeast Asia reference is to the Tai Chang Scam Enterprise in Burma's Karen State, a separate FBI San Diego investigation.
Date
2026-04-29
(DOJ, FBI and IRS Criminal Investigation public announcement); the indictment was returned by an SDCA grand jury in March 2026; two criminal complaints were filed in SDCA in April 2026; the Dubai-led raids took place the week before the announcement, and exact raid dates are not stated in the public record
Impact
DOJ's press release states the scam centers "targeted Americans who have suffered millions of dollars in losses" and that "So far, investigators have identified millions of dollars in losses." That is an investigator's interim measured figure and the only loss number attributable to this case; DOJ itemizes no case-specific total and names no victim.
BasisunquantifiedDOJ states millions of dollars and itemizes no case-specific total
Separately, and not specific to these three companies, the release notes that Operation Level Up, an FBI and US Secret Service victim-notification initiative running since January 2024, had as of April 2026 notified almost 9,000 victims and saved an estimated $562 million. That is a DOJ estimate of losses prevented, not a loss total for Ko Thet Company, Sanduo Group or Giant Company; the Strike Force release of 23 April 2026 gives the precise March 2026 figures as 8,935 victims notified and $562,726,245 saved. Two larger figures circulate alongside this case and do not belong to it: $701,962,392.15 in cryptocurrency restrained and 503 fake investment domains seized are DOJ figures from the Scam Center Strike Force action of 23 April 2026, six days before this announcement. A restraint is a block on funds obtained through US legal process and voluntary action by cryptocurrency providers, so it is neither a loss figure nor money returned to victims, and DOJ's own running restraint total had risen to $832,831,006.15 as of 6 August 2026. A separate claim of 20,000 victims across 30 countries appears only in a low-quality secondary source, has no credible sourcing, and is not used here.
Status
Documented incident
Case Type
Real-World Incident
Sector
Consumer / General Public, Cryptocurrency & Digital Assets
Threat Actor
Organized Crime
Explore more

Related Cases

Browse by what this case has in common with others in the library.