Paradise under siege: How a Pacific Island became a hub for global cyber scams

KOROR, PALAU: When police pushed open the doors of the Cocoro Hotel in Palau’s capital, Koror, this January, they weren’t expecting what they found.

This was supposed to be paradise — a quiet Pacific island known for turquoise lagoons and laid-back island life. Instead, inside the faded hotel rooms, officers walked into a scene more familiar to raids in Cambodia or Myanmar than a country of 18,000 people.

Young foreign workers sat silently at grimy tables, eyes dulled by exhaustion. Laptops glowed in front of them, surrounded by half-eaten food, plastic bottles, and clutter that suggested long days — and longer nights. Some told investigators they hadn’t stepped outside in months. Others said they had barely left the building for years. To authorities, it quickly became clear that something was deeply wrong.

On paper, the workers were employed as “drivers” and “site inspectors.” In reality, Palau’s National Security Coordination Office said, it was “immediately apparent” they were doing something else entirely. Many of their work visas had been sponsored by companies linked to the hotel’s owner — a powerful local businessman who once sat on the board of Palau’s banking regulator.

The raid had all the signs of an online scam centre, part of a sprawling cyber-fraud industry that has spread across Asia and beyond. These operations are notorious for “pig-butchering” scams — slow-burn cons that lure victims through romance, gambling, or fake investments before wiping out their savings. Worldwide, such schemes siphon off more than US$60 billion (S$77.25 billion) a year.

Until recently, Palau seemed an unlikely place for this kind of crime to take root, but documents obtained by the Organized Crime and Corruption Reporting Project (OCCRP) suggest the island has quietly become part of the network.

Inside Palau’s scam economy

The Cocoro Hotel wasn’t the first warning sign. Two weeks earlier, authorities had raided another hotel, the Beluu Sea View Resort, uncovering a nearly identical setup.

Together, investigative reports, forensic analyses, and files pulled from seized computers reveal a carefully run operation. Around two dozen workers — mostly from China and Vietnam — worked in shifts, following scripts designed to hook Chinese-speaking victims into illegal online gambling sites and cryptocurrency schemes. Some appeared to be trapped there, working under pressure or outright coercion.

According to Palau’s Ministry of Finance, just one of these operations was pulling in at least US$200,000 a month. The money didn’t stay on the island for long. It was funnelled offshore through cryptocurrency, vanishing into digital wallets beyond Palau’s reach.

Yet even after the raids, it’s unclear what came next. Authorities have not said whether any prosecutions followed. Jay Hunter Anson, Palau’s chief information security officer, offered a blunt explanation: the country has no cybercrime laws.

“We detained at least 12 workers,” Anson said. “But we had no choice but to deport them.”

That legal blind spot, experts say, makes Palau an easy target — especially when combined with alleged help from inside the system. One scam centre operated in plain sight for more than two years in a country where almost everyone knows everyone else.

Visas, power, and plausible deniability

Records from the raids show that every worker at the Cocoro Hotel had a visa sponsored by companies owned by one of two influential figures: the hotel’s owner, Vance Polycarp, and Palau’s former vice president, Elias Camsek Chin. The same names surfaced at the Beluu resort.

Chin denied any involvement, saying the workers he sponsored were simply visiting friends when the raid happened. He has not been charged with any crime and is not under investigation. Polycarp did not respond to requests for comment, and investigators say they found no direct evidence tying him personally to the scam operations.

Still, forensic analysts described a “sophisticated HR management system” used to monitor workers closely — a level of control more consistent with organised crime than legitimate business. Behind the front of IT and construction companies, they said, was a tightly run transnational operation.

Some workers told authorities they were prisoners. Meals were delivered to the building; leaving wasn’t allowed. To anti-scam experts, the pattern is familiar.

“That kind of isolation is exactly what we see in pig-butchering operations around the world,” said Erin West, a longtime anti-scam advocate. “People disappear inside these places.”

Copy-and-paste fraud, global reach

The seized devices contained step-by-step instructions on how to manipulate victims — how to lure them with bonuses that would later disappear, how to apply emotional pressure, even how to rig online bets. Blockchain analysis showed money flowing through the crypto platform Tron, targeting millions of users and netting at least US$1.6 million in just eight months.

One digital wallet tied to the operation has been linked by outside researchers to Huione Group, a Cambodian conglomerate sanctioned by the United States for allegedly laundering scam proceeds.

The Palau raids came as the U.S. and U.K. expanded sanctions against scam networks across Southeast Asia, including individuals connected to Palau-based investment projects — a sign that the island nation is now firmly on the radar.

A growing threat

The United Nations has warned that scam syndicates are spreading fast, jumping borders as law enforcement pressure grows elsewhere. From Georgia to East Timor, criminal networks are seeking out places with limited oversight and enforcement. Palau, Anson said, fits that description all too well.

“There is a continuing and evolving threat from organised scam operations here,” he warned. “These networks depend on insider access and protection.”

For a country best known for coral reefs and crystal-clear waters, the reality is unsettling. But investigators say Palau’s story carries a wider lesson: Even the most remote and idyllic places are no longer beyond the reach of global cybercrime — especially when laws, resources, and safeguards fail to keep pace.