When Scam Money Turns to Gold: Inside Singapore’s S$500,000 Cross-Border Laundering Trail

A scam payment can be traced through an account.

Gold can cross a border in someone’s hands.

That distinction sits at the centre of a recent Singapore case involving an alleged scam and money-laundering syndicate operating across Singapore and Malaysia.

Singapore police charged a 27-year-old Malaysian man, nicknamed “Da Xiang”, whom they suspect of masterminding operations involving government official impersonation scams and related money laundering. Police believe he was responsible for laundering at least S$500,000 in scam and other illicit proceeds.

The alleged network did not rely only on digital transfers. Investigators said Malaysian runners were recruited to carry out tasks in Singapore, coordinate ATM withdrawals and transport gold collected from scam victims back to Johor Bahru, where the valuables were physically handed over.

For financial institutions, that creates a different AML challenge.

The scam may begin digitally.

But once proceeds become cash, gold or other portable assets, the money trail can change form entirely.

What Happened in Singapore?

According to Singapore police, the alleged mastermind recruited and coordinated Malaysians to participate in government official impersonation scams and related money-laundering activities.

Preliminary investigations found that he allegedly met at least four Malaysian runners in Malaysia, assigned them tasks, coordinated ATM withdrawals and paid them for their work.

The runners were also allegedly instructed to bring gold collected from scam victims in Singapore back across the Causeway to Johor Bahru, where the valuables were physically handed over.

The suspect was arrested in Malaysia on 22 September 2026 pursuant to a Singapore warrant and handed over to the Singapore Police Force the same day. Police believe he was responsible for laundering at least S$500,000 in scam and other illicit proceeds.

Singapore police also highlighted an increasing trend of Malaysians travelling to Singapore to help scam syndicates collect cash and valuables from victims.

That trend matters because it shows how scam networks can connect digital deception with physical value movement.

The victim may interact with the scammer remotely.

The money may move through an account or ATM.

But the value can ultimately leave the financial system in someone’s hands.

When Scam Proceeds Become Cash and Gold

Most transaction monitoring is designed around funds moving through accounts.

But scam proceeds do not have to remain digital.

Once money is withdrawn as cash or converted into gold and other valuables, the nature of the trail changes. A financial institution may see the withdrawal or purchase, but it may have limited visibility into what happens to that value afterwards.

That makes portable assets particularly relevant to AML teams.

Gold can hold significant value in a compact form. It can be transferred physically, carried across borders and exchanged without creating the same continuous digital trail as an account-to-account payment.

The alleged runners in this case illustrate how that transition can work. They reportedly acted as a bridge between scam victims and the wider network: collecting or handling value in Singapore, facilitating withdrawals and transporting gold back to Malaysia.

This also separates different parts of the operation.

The person communicating with the victim may not collect the money.

The person making the withdrawal may not control the scam.

The person carrying the gold may not be the ultimate beneficiary.

And the organiser may operate across another jurisdiction.

For financial institutions, this means following the value, not simply the original transaction.

A suspicious incoming payment may be followed by cash withdrawals. Cash may become gold. Gold may leave the country. The financial footprint can therefore disappear from conventional payment rails while the criminal proceeds continue moving.

That makes the period immediately after a suspicious payment particularly important.

Was there an unusual ATM withdrawal?
Was value rapidly converted into a high-value portable asset?
Did several accounts show similar cash-out behaviour?
Were the same beneficiaries, devices or individuals connected across transactions?

The movement after the first payment may reveal more than the payment itself.

Red Flags Banks and Payment Firms Should Monitor

Scam networks using runners, cash and portable assets can generate warning signs before value leaves the financial system.

Key indicators may include:

• Large or unusual cash withdrawals following incoming transfers
• Multiple ATM withdrawals within a short period or across different locations
• Sudden purchases of gold, jewellery or other high-value portable assets inconsistent with the customer profile
• Newly active accounts receiving funds before rapid cash-out
• Multiple accounts showing similar withdrawal, beneficiary or transaction patterns
• Customers acting as collection points for funds from unrelated individuals
• Transactions linked to known government impersonation scam complaints
• Shared devices, phone numbers, addresses or beneficiaries across suspected mule accounts
• Rapid movement from account balances into cash or high-value goods
• Transaction activity involving individuals or networks linked to frequent cross-border movement

No single signal proves money laundering.

But unusual inflows combined with rapid withdrawals, asset conversion, linked accounts and scam intelligence can reveal a much broader proceeds network.

The critical question is no longer simply:

Where did the money go?

It is:

What did the money become next?

What This Means for Financial Institutions

The Singapore case highlights four practical priorities.

Follow activity beyond the victim payment. Scam detection should not stop once the initial transfer is identified. Institutions need visibility into what happens to funds after receipt, including withdrawals, onward transfers and rapid conversion into other forms of value.

Put cash and high-value assets in context. A cash withdrawal or gold purchase may be legitimate on its own. Combined with unusual inflows, mule indicators or scam complaints, it can carry a very different risk profile.

Connect the network. Runners, mule accounts and organisers may perform different roles. Shared beneficiaries, devices, withdrawal patterns and counterparties can help expose the relationships between them.

Think beyond domestic payment rails. When people, proceeds and portable assets move between jurisdictions, institutions may only see one part of the activity. Cross-border intelligence and connected investigations become increasingly important.

The broader AML challenge is therefore not simply detecting a suspicious transaction.

It is understanding how illicit value is received, withdrawn, converted, carried and transferred.

How Tookitaki Helps Detect Scam Proceeds and Mule Networks

Tookitaki helps financial institutions connect financial crime signals that may appear unrelated when viewed individually.

FinCense brings together customer risk, transaction monitoring, screening, alert management and investigations so compliance teams can analyse activity across customers, accounts, beneficiaries and connected networks.

In scam-laundering cases, risk may emerge through combinations of signals such as unusual victim-like inflows, rapid ATM withdrawals, mule-account behaviour, shared beneficiaries, linked customers, sudden changes in transaction activity and movement into high-value assets.

Connecting these signals helps institutions identify higher-risk patterns earlier and gives investigators a clearer view of how scam proceeds move after the initial payment.

Through the AFC Ecosystem, Tookitaki also helps institutions stay closer to emerging typologies involving scam proceeds, mule networks, cash collection, asset conversion and cross-border laundering.

The focus is not simply on the suspicious transaction.

It is on the network and movement of value behind it.

The Bigger Lesson: Follow the Value, Not Just the Transfer

The Singapore case shows how quickly a digital scam can become a physical money-laundering problem.

A victim can be manipulated remotely.

Funds can be withdrawn.

Cash can become gold.

A runner can carry that value across a border.

And the proceeds can reach another part of the criminal network without another obvious digital transfer.

For banks and payment firms, that changes the investigative question.

It is no longer enough to ask where the payment went.

They also need to understand what happened to the value after it got there.

The scam may begin online.

But the laundering trail can continue through cash, gold, runners and borders.