A cybersecurity researcher and ethical hacker, known online as "Mrwn," recently exposed a large-scale cryptocurrency scam operation based in Cebu City, Philippines. The scam hub, which reportedly raked in approximately $800,000 annually, was brought to light through Mrwn's 23-minute YouTube video that has now been restricted in the Philippines due to defamation complaints, though it garnered over 2.7 million views prior to its removal.
Mrwn's investigation revealed that the call center, operating under names such as Virtual Wealth Exchange, BTC Boutique, and Solis Markets, was using sophisticated tactics to defraud victims across the globe. They lured individuals with promises of high returns on Bitcoin ($BTC) investments through AI-powered trading systems. According to Mrwn, the scammers claimed their AI trading bots could generate weekly profits of 30% to 40%, enticing victims to deposit funds.
For over a year, Mrwn infiltrated the group's internal systems, gaining access to live CCTV feeds, agent desktops, email logs, and call recordings. This extensive surveillance allowed him to gather irrefutable evidence of the fraudulent activities. The YouTube video, titled “Scammers Panic After Getting Hacked Live on CCTV!”, showcased Mrwn's findings, including footage of the scammers in action and their panicked reactions when they realized they had been hacked.
The scammers employed a 14-page call script to deceive victims, presenting themselves as financial representatives and promoting fake investment platforms like Quantum AI and Bitcoin Code. They used emotional and psychological manipulation to pressure victims, often discouraging withdrawals or cancellations by instilling guilt. Agents manually manipulated the fake trading platform to show gains, reinforcing the illusion of successful AI-driven crypto trading. In reality, no actual $BTC trading took place; the funds were directly funneled to the scammers. Leaked documents revealed that the operation earned over ₱3.9 million (approximately $68,000) in February alone, with alleged annual profits exceeding ₱20 million.
Mrwn's video prompted immediate action from Philippine authorities. The Cybercrime Investigation and Coordinating Center (CICC) launched an official investigation into the scam operation. The National Bureau of Investigation (NBI) also initiated a hunt for around 40 individuals believed to be involved in the scam, conducting an operation at the scam hub's location in Mabolo, Cebu City. However, the site was found abandoned, with the group having reportedly moved from their previous location at Sky Rise in Lahug, Cebu City, just a month prior.
The Department of Information and Communications Technology (DICT) has also launched a formal investigation and formed a task force to monitor and apprehend individuals involved in scam hubs and other cybercrimes. The Securities and Exchange Commission (SEC) released an advisory warning the public about BMJ Data Processing Services, which operates in Cebu City, stating that it is not authorized to solicit investments. The SEC also cautioned against investing in the scheme offered by the entity or its representatives and reminded business entities to comply with all applicable laws and regulations related to investment solicitation.
The DICT has expressed its commitment to addressing cybercrime and assured foreign nationals that any evidence or investigation leading to scam hubs in the Philippines would be thoroughly pursued. The case highlights the Philippines' struggle with online scams and the use of the country as a base for defrauding individuals worldwide, taking advantage of low labor costs and strong English proficiency. This particular scam targeted victims in South Africa, Nigeria, and Gulf countries, with previous targets including Canada, the UK, and European countries.
