A major police operation in Forest City, Iskandar Puteri, has revealed how organised online fraud can operate less like a small criminal group and more like a fully staffed business. Two separate scam syndicates were dismantled during coordinated raids, with police reporting the arrest of 335 people, most of them foreign nationals. The scale of the operation, the number of premises involved and the huge quantity of digital equipment seized point to a highly organised system designed to target victims across several countries.
Two Syndicates Operating from the Same Area
The raids were carried out on 15 July 2026 at 32 separate premises in and around Forest City. These included 27 luxury apartment units and five bungalows that had allegedly been converted into operational centres for online scams.
The suspects were aged between 20 and 58. Most were Chinese nationals, while others included Indonesians, Myanmar nationals and four Malaysians. Police believe the Malaysians provided logistical support, although investigations into the wider network are continuing.
Although the two syndicates operated from different types of properties and targeted different markets, both appeared to use a similar business-like structure. Workers were placed in designated locations, provided with computers and mobile phones, and reportedly expected to meet performance targets.
This was not an informal group of individuals sending random fraudulent messages. The number of workers, devices and properties involved suggests an organised operation with recruitment, accommodation, technology, scripts, supervisors and international victim lists.
Luxury Apartments Converted into Scam Floors
The first syndicate allegedly occupied more than two dozen luxury apartment units spread across almost five floors.
From these apartments, workers are believed to have carried out love scams, fake investment schemes, currency-related fraud and cryptocurrency scams. Some operations reportedly focused heavily on senior citizens, who may be more vulnerable to emotional manipulation, fabricated investment opportunities or urgent requests for money.
Victims were mainly located in China and Indonesia, while many of the people working inside the apartments were nationals of China, Indonesia and Myanmar.
The use of multiple units within the same building would have allowed the syndicate to separate different teams or campaigns. One group could focus on establishing relationships with potential victims, another could introduce an investment opportunity, while others might handle payment instructions, fake customer support or follow-up communications.
Police have not publicly confirmed the full internal structure, but the physical scale indicates that the operation required considerable coordination.
Bungalows Used to Target International Victims
The second syndicate operated from several bungalows and allegedly concentrated on cryptocurrency and investment fraud.
Police arrested 53 Chinese nationals during this part of the operation. The victims were reportedly located in China, Japan, the United States and Europe. Investigators also found indications that the syndicate impersonated law firms, potentially using the appearance of legal authority to pressure victims or make fraudulent transactions seem legitimate.
Each house was reportedly assigned to target victims from a particular country. Such an arrangement would allow workers to concentrate on a specific language, culture, time zone and communication style.
A team targeting Japanese victims, for example, may use different scripts and social expectations from one approaching people in the United States or Europe. This level of market segmentation demonstrates how modern scam operations increasingly study their intended victims in much the same way legitimate companies study customers.
Thousands of Devices Seized
Police seized approximately 1,900 electronic items, including hundreds of computers, more than 1,500 mobile phones, laptops and internet modems. A vehicle was also confiscated, with police placing the estimated value of the seized items at around RM1 million.
The number of mobile phones is particularly significant because scam syndicates often depend on maintaining many separate online identities. Different devices may be used for multiple accounts, phone numbers, messaging profiles and fabricated personas.
Police said the suspects used platforms including Telegram, WhatsApp and TikTok to approach potential victims. These platforms are not inherently fraudulent, but scammers take advantage of their reach, private messaging features and ability to create new accounts quickly.
The equipment seizure may help investigators recover chat histories, payment instructions, victim records and links to other members of the network. Digital evidence could also reveal whether the syndicates were connected to similar operations outside Malaysia.
Workers Recruited with Salaries and Commissions
Those working for the syndicates were reportedly promised monthly salaries ranging from RM2,500 to RM4,000. Additional commissions were offered to individuals who achieved their assigned targets.
This incentive structure makes the operation resemble a sales centre, except that its revenue allegedly came from deception.
Workers may have been measured by how many potential victims they contacted, how many conversations they maintained or how much money they persuaded victims to transfer. Targets and commissions can encourage aggressive tactics because workers are rewarded when the fraud succeeds.
However, the arrest of large numbers of workers also raises important questions about recruitment. Authorities will need to determine who knowingly joined the operation, whether anyone was misled about the nature of the job, and whether coercion or exploitation was involved.
Investigators said some of those arrested had previously worked at scam centres abroad. The foreign suspects were also reportedly unable to produce valid travel documents. At least 194 were expected to face court proceedings, according to police.
A Cross-Border Criminal Network
Initial investigations found that some syndicate members had entered Malaysia through Cambodia and had only been in the country for several weeks before the raids.
Johor police said they intended to work with Interpol because the alleged victims, suspects and possible organisers span multiple countries. The syndicates targeted people in China, Indonesia, Japan, the United States and Europe, while some workers had experience in scam centres outside Malaysia.
This international reach makes the investigation more complicated.
The communications may have taken place in one country, the scam centre may have been located in another, and the money may have passed through bank accounts, cryptocurrency wallets or payment services registered elsewhere. Identifying the individuals controlling the operation therefore requires cooperation between law-enforcement agencies, banks, telecommunications companies and online platforms.
Why High-End Properties Can Appeal to Syndicates
The use of luxury apartments and bungalows is notable, but it is not necessarily surprising.
Large residential properties can accommodate many workers, computers and networking devices without immediately appearing like a commercial call centre. Serviced apartments may also provide flexible rental arrangements, controlled access and a steady movement of residents and visitors.
In this case, police said the apartment units had been booked under a company name, while the bungalows were registered or rented under individual names. Investigators are now tracing those parties as part of efforts to identify the people behind the syndicates.
Property owners, agents and management bodies may increasingly need to watch for warning signs such as unusually large numbers of occupants, continuous activity at all hours, extensive telecommunications equipment or multiple units rented together without a clear legitimate purpose.
At the same time, suspicion should be based on evidence rather than nationality or appearance. The focus must remain on unusual operational behaviour and verified indicators of criminal activity.
No Connection to the Network School
The timing of the raids led to public speculation about whether the syndicates were connected to the recently closed Network School in Forest City.
Johor police chief Datuk Ab Rahaman Arsad said investigators had found no connection between the school and the two scam syndicates.
That clarification is important because unrelated incidents occurring in the same location can easily become mixed together online. Claims shared before investigations are completed may unfairly implicate people or organisations that have no involvement in the alleged offences.
The Suspected Masterminds Remain at Large
Although hundreds of people were arrested, police said the individuals believed to be controlling the syndicates had not yet been located.
This highlights one of the biggest challenges in tackling organised scam centres. The people answering messages or making calls are often the most visible members, but they may not control the money, property rentals, recruitment or technology infrastructure.
The organisers can remain outside the premises, use intermediaries and operate across national borders. Even after a call centre is dismantled, the network may attempt to rebuild elsewhere using new workers and equipment.
The next stage of the investigation will therefore be crucial. Authorities will need to follow financial trails, inspect recovered devices, identify property arrangements and determine who financed and managed the operation.
Scams Are Becoming More Structured and Convincing
The Forest City raids demonstrate how far online scams have evolved.
Many people still imagine a scammer as a lone individual sending poorly written emails. In reality, organised syndicates may operate with specialised teams, scripted conversations, multiple languages, fake documents and carefully designed online identities.
A love scam may begin with weeks of friendly conversation before money is mentioned. An investment scam may use a professional-looking platform that displays fabricated profits. A fake law firm may contact a victim claiming that money must be transferred to resolve a legal or financial issue.
The initial message may appear harmless. The manipulation often happens gradually, giving the scammer time to build trust and understand which emotional or financial pressure is most likely to work.
Public Awareness Remains an Important Defence
Enforcement operations can disrupt scam centres, but public awareness remains essential because syndicates can quickly change their identities, platforms and methods.
Unexpected investment opportunities should be independently verified, particularly when they promise unusually high or guaranteed returns. Requests to transfer money into personal accounts, cryptocurrency wallets or unfamiliar platforms should be treated cautiously.
Someone claiming to represent a bank, government agency, police force or law firm should not object to being verified through an independently obtained official contact number. A person who becomes angry, creates urgency or demands secrecy when questioned is displaying a major warning sign.
Families should also discuss scams openly with older relatives. Victims sometimes remain silent because they feel embarrassed, allowing the fraud to continue and making recovery more difficult.
Final Thoughts
The Forest City operation is one of the largest recent crackdowns on suspected scam centres in Malaysia, but the number of arrests tells only part of the story.
Behind the hundreds of workers were dozens of properties, thousands of devices, international victim lists and an alleged incentive system built around salaries, commissions and performance targets. It was an industrial operation designed to turn deception into revenue.
The raids have disrupted two major syndicates, but the reported masterminds remain beyond the immediate reach of investigators. The longer-term success of the operation will depend on whether authorities can identify the organisers, trace the money and dismantle the wider networks that allowed the scam centres to operate.
Comments