The Game Changed, the Scam Didn’t: Inside Cubao’s 76-Person Online Fraud Bust

When enforcement shuts down one criminal business model, the infrastructure behind it does not always disappear. It can adapt.

That is the concern emerging from a recent operation in Cubao, Quezon City, where Philippine authorities apprehended 76 foreign nationals at a suspected illegal POGO-like facility. According to the Bureau of Immigration, intelligence indicated that the site was being used for online investment-scam activities.

Those apprehended included 74 Chinese nationals and two Myanmar nationals. Authorities said they suspect some may have remained in the Philippines after failing to comply with directives requiring POGO operators and employees to leave, with the BI describing the activity as an apparent evolution from traditional POGO operations.

For financial institutions, that shift matters. Criminal infrastructure can change its front end quickly, moving from one revenue model to another, while still depending on payment accounts, beneficiaries and financial intermediaries to turn online deception into proceeds.

The scam model can change. The need to move money does not.

What Happened in Cubao?

The Bureau of Immigration and Armed Forces of the Philippines raided the suspected operation in Barangay Socorro, Cubao, Quezon City, apprehending 76 foreign nationals suspected of involvement in scam activity.

The BI said its intelligence division had identified investment scam activities conducted through online channels at the site. Officials also suggested that the operation reflected how some remaining POGO-linked individuals may have shifted away from traditional offshore-gaming activities towards other forms of online fraud.

The operation was conducted under a mission order and as part of enforcement of the Anti-POGO Act of 2025. Those apprehended were subjected to inquest proceedings and are also expected to face deportation proceedings.

The AFP is separately investigating whether the facility raised wider security concerns because of its proximity to Camp Aguinaldo, although authorities said that investigation was still at an early stage.

The available reporting does not specify victim losses, payment methods or how proceeds from the alleged investment scams were moved. Those details should therefore not be assumed.

What the case does highlight is something broader: scam operations can evolve when regulation and enforcement make their previous model harder to sustain.

From Offshore Gaming to Online Investment Scams

The most important aspect of the Cubao case is not simply that another suspected POGO-linked facility was raided.

It is the apparent change in operating model.

Authorities described individuals who may once have been associated with technical POGO operations as having evolved towards online investment scams.

That kind of migration creates a challenge for financial crime teams because criminal infrastructure can be reusable. People, technology, online identities and operational expertise developed for one activity may be redirected towards another.

Investment scams are particularly suited to this model because the fraud can be conducted remotely and scaled across many potential victims. Operators can cultivate trust, present fabricated opportunities and persuade victims to transfer funds voluntarily.

For banks and payment firms, the transaction may initially look legitimate. The customer may authorise it personally and believe they are sending money towards a genuine investment.

The stronger risk signals may only emerge when institutions look at who is receiving the money and how those beneficiaries behave across multiple customers.

The Financial Risk Appears Behind the Investment Pitch

A convincing investment story is only the front end of a scam. Successful fraud still requires somewhere for the money to go.

That is where mule accounts, beneficiary accounts and connected payment networks can become relevant.

An account receiving funds from several unrelated individuals may appear ordinary when each transaction is reviewed separately. The picture changes if those incoming payments are followed by rapid onward transfers, cash-outs or movement towards common counterparties.

The same applies across multiple accounts. Shared beneficiaries, devices, contact details or transaction patterns can reveal connections between customers who appear unrelated on paper.

This matters when scam operations become organised.

The person communicating with the victim may not own the account receiving the payment. The beneficiary may not control where the funds ultimately go. Different accounts can serve as collection points before proceeds are moved onwards.

Financial institutions therefore need to look beyond whether an investment payment was authorised and ask whether the beneficiary and wider network behave like legitimate financial activity.

What Banks and Payment Firms Should Watch

Online investment scams can create signals on both sides of the transaction.

Institutions should pay closer attention when customers suddenly begin transferring significant amounts to unfamiliar beneficiaries, particularly where the transaction behaviour does not match their previous financial activity.

On the receiving side, accounts that collect funds from numerous unrelated individuals without a clear commercial explanation can warrant closer review. Risk increases when those inflows are followed by rapid withdrawals or transfers to other connected accounts.

Other relevant signals include sudden transaction-volume increases, multiple accounts sending funds towards the same beneficiaries, shared identifiers across apparently unrelated customers and repeated scam complaints connected to the same account cluster.

None of these indicators proves investment fraud by itself. The stronger signal comes from combining customer behaviour, beneficiary activity, transaction velocity and network connections.

That is particularly important when the scam itself is designed to make the initial payment look voluntary and legitimate.

What the Cubao Case Means for Financial Institutions

The Cubao operation illustrates why financial crime controls need to evolve alongside criminal business models.

Closing one operating model does not necessarily eliminate the people, technology or networks that supported it. Those resources can migrate towards new forms of fraud.

Financial institutions therefore cannot rely only on detecting a specific scam script or transaction type. They also need visibility into recurring financial behaviours that may persist even when the scam narrative changes.

A supposed investment opportunity today could be replaced by another form of social engineering tomorrow. But the underlying financial patterns may remain familiar: unrelated victims sending money, collection accounts receiving repeated inflows, rapid onward transfers and connected beneficiaries appearing across multiple transactions.

That makes network-level analysis increasingly important.

The front end of the scam can change quickly. The financial infrastructure supporting it may be much more persistent.

How Tookitaki Helps Detect Evolving Scam Networks

Tookitaki helps financial institutions connect risk signals across customers, accounts, transactions and beneficiaries rather than evaluating each event in isolation.

FinCense brings together customer risk, transaction monitoring, screening, alert management and investigations, helping compliance teams identify suspicious relationships and behavioural patterns across connected entities.

In investment-scam cases, risk can emerge through combinations of unusual customer payments, repeated third-party inflows, rapid onward movement, mule-account behaviour and common beneficiaries across multiple customers.

Connecting these signals can help investigators identify when apparently separate transactions may belong to a wider scam or laundering network.

Through the AFC Ecosystem, institutions can also stay closer to emerging scam typologies as criminals change tactics, channels and operating models.

The objective is not simply to recognise the scam of today. It is to build detection that can respond when the same financial crime infrastructure appears behind the scam of tomorrow.

The Bigger Lesson: Criminal Models Change Faster Than Labels

The Cubao case is a reminder that organised financial crime does not necessarily disappear when one business model is prohibited.

Authorities allege that individuals associated with the remnants of POGO operations had shifted towards online investment-scam activity, illustrating how quickly illicit operations can adapt when their environment changes.

For financial institutions, the lesson is to focus less on the label attached to an operation and more on the behaviour underneath it.

The website can change. The sales pitch can change. The type of scam can change.

But when institutions connect beneficiaries, accounts and money movement, the financial network behind the fraud becomes harder to disguise.