Inside the rise of the global scam-economy powered by AI and Starlink

Inside the rise of the global scam-economy powered by AI and Starlink

The instructions were clear: He had four days to make each victim fall in love. And there were a lot of victims.

Online, Safeer Mohammed Koorimannil, who was trafficked to a scam center in Myanmar, impersonated a 28-year-old Singaporean woman named Ella. On a typical shift, he said, he chatted with more than 100 people across dozens of profiles at the same time, as supervisors prowled among the desks with electric batons. In just a month, Koorimannil targeted some 50,000 victims from at least 17 countries, according to records he smuggled out to The Associated Press.

His "clients" included a widowed tailor in Kurdistan, a pastry chef in Turkey, a sheep farmer in Kyrgyzstan, soldiers in Iraq, an engineer in Russia, a building painter in Germany, a port officer in Argentina, a student in Indonesia, a security guard in Poland and a dairy farmer in the Republic of Georgia.

And he did it using software built with artificial intelligence models from American tech companies that scammers are abusing to target victims at unprecedented speed and scale.

"Everyone is a robot there," he told AP from his home in southern India in his native Malayalam language.

Technology from American companies is being used to power a revolution in the scam industry, playing a key role in the industrialization and globalization of fraud in ways that have not been clear until now, an AP/"FRONTLINE" investigation has found.

Watchdogs say these companies have the technical capacity to do more to protect against abuse but lack the legal, regulatory, and business incentives to crack down on a crime the Federal Trade Commission estimates cost Americans nearly $200 billion in losses in 2024.

While most public scrutiny of the technology that fuels scams has focused on the social media platforms victims see, the infrastructure exploited to commit fraud begins much farther upstream, the investigation showed. American technology is present all along the digital supply chains that connect scammers with the scammed, from AI models baked into powerful new tools to optimize workflow and create more perfect fakes, to satellite dishes that enable scammers to evade internet crackdowns, to internet service providers that carry traffic from the lawless borderlands of Myanmar to the phones and computers of millions of victims.

The AP found no evidence to suggest these companies were doing anything illegal themselves. However, the abuse of their tools and tech infrastructure at scam compounds in Myanmar, as documented by the AP and "FRONTLINE," raises questions about how vigorously they are enforcing their own terms of service, which prohibit illegal activity and, in many cases, explicitly ban fraud.

Key findings from the investigation

Among the AP's findings:

• American-made AI models-chiefly ChatGPT and Gemini-have been used to build specialized software that allows scammers to seamlessly work across dozens of languages, surveil workers and target victims around the world, the investigation found with the help of C4ADS, a Washington-based nonprofit focused on global security. Scammers who purchased these tools took in tens of millions of dollars, according to blockchain analysis by TRM Labs at the request of AP/"FRONTLINE."

• A sophisticated, global internet infrastructure supports Myanmar's scam-compound economy, which relies on services from Cogent Communications, AT&T, DigitalOcean, and Oracle, among others. One in five signals from devices at four scam compounds linked to sanctioned entities in Myanmar was carried by a U.S.-registered company, according to an AP analysis of more than 200,000 device connections provided by International Justice Mission, an anti-trafficking nonprofit.

• Elon Musk's satellite internet company, Starlink, is the number one internet service provider in Myanmar, including to scam centers, according to device data, public records and interviews-despite public pressure from Congress and a widely publicized crackdown last fall.

• At least 25 new scam compounds have been built deep inside Myanmar since a high-profile crackdown along the Thai border last fall, new satellite imagery shows. Scammers from at least 13 of these outposts used Starlink IP addresses to get online between early March and the end of May, an AP analysis of device and satellite data from International Justice Mission shows.

The AP/"FRONTLINE" investigation was based on tens of thousands of leaked scam center files, videos and photos; an analysis with C4ADS of misuse of AI at scam centers; an examination of more than 200,000 connections made by devices over a year at four scam compounds in Myanmar linked to entities sanctioned by the U.S. government; and interviews with 58 scam victims and three dozen current and former scammers from 19 countries.

The cost of facilitating scams

Cybersecurity experts say internet service providers, AI companies, and Starlink could do more to prevent the abuse by scammers-but lack the legal, regulatory, and business incentives.

"If there's no disincentive to continuing this, if there's no cost to actually facilitating scamming, then why would I spend a dollar to prevent scamming?" said Sascha Meinrath, the Palmer chair in telecommunications at Penn State University. "This is the problem. It's identifiable, it's addressable-at least somewhat-but it costs something. And right now the cost of facilitating scamming is zero."

Outside the United States, that cost is starting to rise. The United Kingdom, the European Union, Australia, and Singapore have introduced new regulations that require companies to do more to prevent scams or face financial penalties.

Meanwhile, in Washington, lawmakers and government officials have been asking American tech companies to cooperate to cut scammers off from U.S. infrastructure, but on a voluntary basis. In November, District of Columbia U.S. Attorney Jeanine Pirro created the Scam Center Strike Force to target scam compounds. In a four-day exercise in May, the Strike Force worked with Meta, SpaceX, Google, and others to disrupt more than 1.4 million social media and email accounts, interrupt malicious IP address traffic, seize satellite internet terminals, and decommission servers and hosting infrastructure linked to Southeast Asian scam networks.

"We will not allow criminal organizations to weaponize our own infrastructure against us or devastate the life savings of hardworking families," Pirro said in an email to AP. "Our message is clear: we will find you, we will stop you, and we will protect the American people."

Company responses

OpenAI and Google both said they have robust programs in place to proactively disrupt scammers from abusing their tools. Starlink did not respond to detailed requests for comment.

Internet service providers emphasized that they can't see the content their networks carry or what end users are doing online-privacy by design that constrains their ability to monitor for abuse. All said they respond to valid abuse reports and cooperate with law enforcement. None would disclose specific customer information, citing privacy rules, but several said they had taken concrete action in response to AP's reporting.

OpenAI said that based on the information AP shared, it identified and banned three accounts that had been using its models to support online scams. Oracle said it was "diligently working with law enforcement" on the material shared by AP. UpCloud, a Finnish cloud services provider with servers in the U.S., said AP's query had prompted an internal review and refinement of its risk assessment processes.

OpenAI CEO Sam Altman has likened artificial intelligence to a utility, akin to electricity or water. But unlike water utilities, tech and telecom companies in the United States are generally not responsible for proactively ensuring the safety of the content they carry.

Some people believe that should change.

"This has to be like clean water," said Matthew Moynahan, the CEO of GetReal Security, a cybersecurity firm. "Anything coming out of the tap for an end user, whether that tap is a PC, a browser somewhere, or your mobile phone, dirty water shouldn't get to you. This is what this is."

Almost automated: American AI abused for industrial-scale scamming in SE Asia

The use of AI in scams is exploding so fast that many in the cybersecurity community fear fully-automated scams run by AI agents will soon become commonplace.

"We're moving towards a world where maybe you don't need human scammers anymore," said Ari Redbord, global head of policy at TRM Labs, a crypto analytics firm. "All you need is hundreds, thousands, millions of agentic agents who don't need to sleep, don't need to eat, who are 24/7 doing this."

Already, the basic AI-powered tools Koorimannil used required scant human intervention. His job was to cut and paste responses from scripts his scam bosses generated.

Koorimannil and his best friend had answered an ad online for jobs encouraging tourism to Thailand. From the airport in Bangkok, however, a waiting black car sped them to the border with Myanmar, he said, and the next morning armed men escorted them across the Moei River to Tai Chang, a scam compound the U.S. government sanctioned last year.

Koorimannil managed to sneak out a screenshot from his computer that AP and security nonprofit C4ADS used to identify the key to his productivity-a software platform called Kongtian Intelligent Customer Acquisition, or KT for short. AP also identified a similar suite of software, called Global Social Traffic Navigation, or 007TG, described by a former scammer as a "one-stop shop" for running scams at industrial scale.

KT and 007TG are part of a thriving gray market for tech that has both legitimate and illegitimate uses and is widely exploited by scammers, according to blockchain analysis, a review of Telegram channels frequented by scammers, and interviews with scammers from three countries.

KT and 007TG were created by for-profit businesses using AI models from leading global companies and sold to scammers-who in turn generated tens of millions of dollars in illicit profits. OpenAI's ChatGPT played the most prominent role, along with Google's Gemini, though the software incorporated other AI models as well, including from Europe and China.

Both KT and 007TG used ChatGPT and Gemini to:

• Generate automated replies
• Power a role-play chatbot, which scammers could use to develop convincing characters
• Embed real-time translation in over 100 languages

C4ADS found that KT and 007TG software also tracked the performance of workers-to devastating effect, in Koorimannil's case. He was beaten for being bad at scamming people, leaving his body red and swollen with lashes, photographs show.

"When they came near my computer, my hands would shake and sweat," Koorimannil told AP. At night, he said, he and his best friend curled in the same narrow bunk, too frightened to sleep alone.

The financial scale of AI-powered scams

Blockchain analysis, done for AP/"FRONTLINE" by TRM Labs, shows how powerful these tools can be. Cryptocurrency transactions are recorded on an indelible public ledger, or blockchain, which can be analyzed to show the pattern and volume of cryptocurrency transactions.

TRM Labs found that a single crypto wallet used by 007TG received $860,000 in payments between April 2024 and December 2025-including transfers from at least four cryptocurrency wallets associated with known scam networks. Those scammers, in turn, raked in at least $75 million.

Stopping AI abuses at scale is challenging because scammers often use ChatGPT the same way hundreds of millions of other people do-to translate, help write messages, create content, and do basic research, according to OpenAI. The intimacy, financial pressure and manipulative language in romance scams, for example, may be hard to distinguish from genuine users seeking help with a divorce.

And tools like KT and 007TG can have legitimate uses, especially for Chinese businesses seeking to expand overseas.

But by tracking user behavior over time to surface patterns of deception and manipulation, OpenAI said it detects scams with 95% accuracy and takes down 100,000 scam accounts each month. The company said it has also independently disrupted service to scam networks operating from Cambodia, Myanmar, and Nigeria.

Even as fraud networks exploit their technology, a growing number of people are using the same tools to fight back. OpenAI said people use ChatGPT millions of times a month to identify and avoid scams-up to three times more often, the company estimates, than the model is abused by scammers. OpenAI also recently collaborated with the Global Anti-Scam Alliance to launch scam.org, which helps users assess the risk they are being targeted by scammers.

Google did not respond to specific questions about AP's findings, but said the company is "committed to developing AI responsibly" and engineers its models with safety guardrails to filter out content that promotes scams.

007TG went dark in December but has since claimed to be back up and running. Neither it nor KT responded to requests for comment.

In the end, through a connection in Bahrain, Koorimannil and his friend found a broker who oversaw ransom payments for 21 Indians from their compound, he said. They each had to pay 500,000 Indian rupees ($5,300) for their freedom.

Missed signals: U.S. internet service providers play outsize role in carrying scam center traffic

It took a long time for Chris Colocousis to understand the extent to which scammers around the world use American technology to prey on people like him.

At first, all he saw was that the woman who reached out to him on Facebook had a New York phone number-not too far away from his home in Massachusetts-and said she worked at a well-known financial firm in Atlanta. "Eliza" suggested a video call. And there she was-the same blond beauty as in her Facebook photos. She even had little bags under her eyes. She was too real not to be real.

Now Colocousis, a divorced man in his 60s, has no idea where "Eliza" really is, whether he was talking with her or with