Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters. What is known.
Social Engineering Examples·11 sources
The scam compound takedown came in late April 2026. Dubai Police raided at least nine pig butchering centres in Dubai and arrested 275 people, working with the FBI and China's Ministry of Public Security. Thai police picked up one more. On 29 April, federal prosecutors in San Diego unsealed charges against six people they say managed, worked for or recruited for three scam "companies": Ko Thet Company, Sanduo Group and Giant Company. Four are in custody abroad. Two are on the run. Status: Charged, no convictions.
| When | What happened |
|---|---|
| 2025 | FBI San Diego opens a Homeland Security Task Force case into compounds defrauding Americans |
| March 2026 | A San Diego grand jury indicts an alleged Ko Thet Company manager and recruiter, plus a co-defendant who is still a fugitive |
| April 2026 | Two criminal complaints charge four more people linked to Sanduo Group and Giant Company. One of them is also a fugitive |
| Week before 29 April | Dubai Police raid at least nine scam centres and make 275 arrests. The Royal Thai Police arrest one more |
| 29 April 2026 | The Justice Department, FBI and IRS Criminal Investigation announce the action and unseal the charges |
Dubai Police called it Operation Tri-Force Sentinel. Federal agents traced the schemes to Dubai using information from Meta, plus bank and crypto records, according to The Record. All six defendants face wire fraud conspiracy charges. The indictment adds money laundering conspiracy. Each count carries up to 20 years.
This is the standard pig butchering script, as the Justice Department described it:
| Stage | What the operators allegedly did |
|---|---|
| Contact | Reached out online and built a friendship or romance over time |
| Pivot | Brought up crypto investing and bragged about their own profits |
| Set-up | Helped the victim open accounts, then pointed them to an investment platform that was fake |
| Squeeze | Pushed for bigger deposits, even if it meant borrowing from family or taking out loans |
| Launder | Once the crypto hit the platform, the victim lost control of it. It was moved through more accounts, including the operators' own |
That's all the method detail on public record. The charging papers themselves (26CR762-RSH, 26MJ2335-AHG, 26MJ2437-AHG) weren't reviewed for this page. The FBI found victims through complaints to its Internet Crime Complaint Center, interviews, and tracing on the crypto ledger.
Tip: an online friend you've never met who suddenly has a great crypto platform to share? That's the pivot. Stop there.
| Figure | Where it comes from | Does it belong here? |
|---|---|---|
| "Millions of dollars" in losses | Investigators on this case, so far | Yes. Interim, no total |
| 8,935 victims notified, $562,726,245 saved | Operation Level Up, an FBI and Secret Service programme running since January 2024 (figures to March 2026) | No. A programme-wide estimate of losses prevented |
| $701,962,392.15 restrained, 503 domains seized | The Scam Center Strike Force action of 23 April 2026 | No. A separate action, six days earlier |
| 20,000 victims in 30 countries | One low-quality secondary source | No. Not credibly sourced |
A restraint just freezes funds through legal process. It isn't a loss, and it isn't money handed back to victims.
Hundreds detained, six charged. What about everyone else? The Record put it plainly: the DOJ "did not elaborate on the status" of those arrested. Scam centres are often staffed by people trafficked into the work and held against their will. No source says any one person here was trafficked, and none says any one was a willing scammer either. So 276 is an arrest count, not a count of fraudsters.
The six charged are presumed innocent and aren't named here. As of September 2026, no arraignment, plea or conviction had been reported, and none of them is known to be in US custody.
See also the $225M USDT forfeiture and the Simex domain seizure.
Dubai Police's name for the April 2026 raids on at least nine pig butchering scam centres in Dubai, run with the FBI and China's Ministry of Public Security.
At least 276: 275 by Dubai Police and one by the Royal Thai Police. Six people were charged in San Diego.
The Justice Department says investigators have found "millions of dollars" in losses so far. It hasn't given a total.
Unknown. The DOJ didn't say, and scam compounds often hold people who were trafficked and forced to work.
Social Engineering Examples. “Dubai scam compound takedown: 276 arrests, six charged in San Diego (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/san-diego-scam-compound-takedown-ko-thet-sanduo-giant-2026
Victim sourcing (general pattern, not described in this case's public record): Pig-butchering operators work through volume, contacting large numbers of strangers online. The DOJ release describes these operations as organized 'companies' with managers, workers and recruiters rather than lone scammers, but it does not say how contacts were sourced, and the charging documents were not obtained for this record.
Mass social-platform outreach and persona-building is very hard to prevent at the source; the realistic control sits downstream, at platform-level detection of fake/scripted accounts and coordinated inauthentic behavior (Meta supplied information to this investigation, though the release does not say of what kind) rather than stopping profile creation itself.
Compound staffing (general pattern, not alleged against anyone charged in this case): Scam centers of this kind are commonly staffed with a mix of willing recruits and people trafficked into the work and held against their will. DOJ documented that pattern in a separate Scam Center Strike Force action six days earlier, describing a compound in Burma where trafficked workers were beaten and forced to defraud Americans under threat of violence. No trafficking, forced-labor or smuggling charge was brought against anyone charged in San Diego in this case: the indictment alleges wire fraud conspiracy and money laundering conspiracy, and the two complaints allege wire fraud conspiracy only.
Disrupting forced labor inside scam compounds is primarily a law-enforcement and diplomatic problem, addressed here through the FBI's Homeland Security Task Force investigation and coordinated action with Dubai Police, the Chinese Ministry of Public Security and the Royal Thai Police rather than a consumer-side or platform-side control. Screening detainees after a raid to separate operators from people trafficked into the compound is part of that response, and the public record for this operation does not say whether or how it was done.
Per the DOJ release, operators cultivated trust and affection with victims over time through feigned friendship or romance, then persuaded them to send money to fake investments. The public record does not state the platform of first contact. Meta, the parent of Facebook and Instagram, provided information for the investigation, and The Record reports that information helped agents trace the schemes back to Dubai rather than establishing where victims were approached.
Platform-level friction on unsolicited contact (message requests from strangers, romance-scam warning prompts, account-age/behavior signals) and public education on pig-butchering's 'stranger becomes friend or romantic interest fast' pattern are the nearest realistic controls at this stage.
Channel migration (general pattern, not described in this case's public record): In pig-butchering generally, the conversation is steered off the public platform onto a private messaging channel, isolating the interaction from platform moderation and from the victim's social circle. No source for this case describes a channel migration.
User education to be suspicious when a new online contact quickly pushes the conversation off-platform, plus platform nudges that flag or slow attempts to move a new connection to another messaging app, directly target this migration point.
Once trust was established, operators introduced a cryptocurrency 'investment opportunity,' walked the victim through opening accounts, and directed transfers to fraudulent investment platforms built and controlled by the scam network, per the DOJ release.
Crypto exchanges and wallet providers screening deposit/investment platforms against known-fraud domain and address lists, plus consumer education that unsolicited investment tips from an online romantic or friendship contact are a hallmark of pig-butchering, are the direct countermeasure here.
Operators touted their own fabricated trading successes to build credibility and pushed victims to invest larger sums, including encouraging them to borrow from friends and family or take out loans, per the DOJ release.
Financial institutions and crypto exchanges flagging escalating transfers tied to a newly formed online-only relationship, and loan/credit providers screening for the 'borrowing to invest' pattern the DOJ release calls out, counter this stage before losses compound.
Once victims transferred crypto to the platforms, they lost control of it; the scam network then laundered the funds through additional cryptocurrency accounts, including accounts controlled by the operators themselves, per the DOJ release and the wire fraud/money laundering conspiracy charges.
Blockchain analytics and exchange-level transaction monitoring to trace and freeze funds moving into scam-linked wallets, plus victim self-reporting via the FBI's IC3.gov portal, are the tools DOJ credits with identifying victims and building the money-laundering case; asset forfeiture is the direct countermeasure at this stage.
Laundered proceeds funded the scam-compound business (recruiters, compound operations, and further victim acquisition), consistent with DOJ's framing of Ko Thet Company, Sanduo Group, and Giant Company as ongoing criminal enterprises rather than one-off scams, until disrupted by the FBI-Dubai-China-Thailand law-enforcement action.
This is where the case's actual disruption happened: an FBI Homeland Security Task Force investigation combined with coordinated international arrests (Dubai Police, Royal Thai Police) and Chinese Ministry of Public Security cooperation, plus platform cooperation from Meta and significant assistance from DOJ's Office of International Affairs, dismantled the compounds and disrupted the enterprise rather than relying on any single upstream control.
Browse by what this case has in common with others in the library.
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
A Pune CFO sent Rs 56 lakh after a Microsoft Teams message from a fake CEO profile. A second Rs…
Fraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Fake QR stickers on UK council parking machines sent drivers to cloned payment sites. 123 of 373 councils were hit…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A judge called it an AI-driven fraud, but police couldn't confirm voice cloning. How the Saskatchewan grandparent scam worked and…
US prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash.…
The FTC warned in 2023 about fake QR codes on parking meters and in texts. What it said, the Texas…
A Costa Rica-based telemarketing ringleader used VOIP-spoofed Washington D.C. caller ID and fake government-official personas to convince hundreds of mostly…
Prosecutors allege Ghanaian twins used fake female personas and AI video to take $15M+ from 130+ older Americans. What is…
A Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence…
SCE reported $131,464 collected by scammers across its 2025 customer fraud complaints. Its warnings describe immediate-disconnection and meter-removal threats as…
A fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
Nearly 200 "missed voicemail" emails from hijacked Office 365 accounts carried QR codes to fake Microsoft logins. Why email gateways…
Argan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss,…
California's Attorney General and six county DAs found more than 10,000 paper patient records and hazardous/medical waste in unsecured.
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
Fraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in…
GootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that…
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that…
eSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023,…
A Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence…