As scam compounds in Southeast Asia continue to rake in billions of dollars in stolen funds from victims around the world, United States law enforcement aims to cut scammers off at the source by issuing seizure warrants for Starlink satellite internet terminals that provide cybercriminals with connectivity. Two US warrants and affidavits seen by WIRED detail how Starlink devices are allegedly being used by cybercriminals running scam compounds in Myanmar.
One warrant, issued on Wednesday by US Magistrate Judge G. Michael Harvey, authorized the seizure of nine Starlink terminals and two Starlink accounts allegedly used in scam compounds in Payathonzu, near Three Pagodas Pass at the Myanmar-Thai border. A linked affidavit, written by FBI investigators, claims that the Starlink devices and accounts played a “substantial role” in an alleged money laundering and wire fraud operation targeting US citizens—saying Starlink parent company SpaceX should “disable service” to the devices. It also claims that at least 26 Starlink dishes appeared to be on the roofs of several buildings making up one scam center of several in the Three Pagodas Pass area.
The second warrant and affidavit—which was not issued to Starlink but focused on seizing websites used in scamming—also claims that “at least” 79 Starlink dishes appear on the roofs of buildings at the notorious Tai Chang compound in Myanmar, which US officials say is controlled by the Democratic Karen Benevolent Army, an armed group in Myanmar which was sanctioned by the US government this week. The warrant was signed on Monday by US Magistrate Judge Matthew J. Sharbaugh.
Both sets of legal documents cite a WIRED investigation from earlier this year, which revealed that scam compounds in Myanmar have been using Starlink for internet access. Starlink, which is owned and operated by Elon Musk’s SpaceX, is a high-speed satellite internet service available in more than 150 countries around the world.
The action comes as part of a new US law enforcement initiative known as the District of Columbia Scam Center Strike Force that was announced by the Justice Department, FBI, and Secret Service on Wednesday. The effort aims to combat cryptocurrency scams targeting Americans, specifically fraud that originates from an ecosystem of systematized scamming that has evolved in multiple Southeast Asian countries and is often linked to Chinese organized crime. The “Strike Force” is already operational and the Justice Department says it has seized roughly $400 million in cryptocurrency so far that was stolen in scams.
“The Department of Justice will not stand by while Chinese organized crime victimizes Americans and bleeds dry the hard earned investments of American citizens,” Jeanine Pirro, the US Attorney for the District of Columbia, said in a press conference. “We have seized websites being used by these compounds in Southeast Asia that are used to victimize Americans. We are seeking warrants to see satellite terminals and accounts being used by the perpetrators to connect to the internet.”
SpaceX did not immediately respond to WIRED’s request for comment about the warrants and whether it would disable the devices identified in the legal documents. However, at the end of October, Lauren Dreyer, the vice president of Starlink Business Operations, posted on X that the company has “proactively identified and disabled” more than 2,500 Starlink devices being used “in the vicinity” of scam compounds in Myanmar. Starlink use in Myanmar has reportedly dropped since the company’s announcement.
Wednesday’s affidavit alleges that Starlink connectivity at the Three Pagodas Pass compounds, which include at least three separate centers in the area, can be linked to a cryptocurrency scam using the branding “Wealthob.” The documents say that between January 2017 and November this year, around 22 people filed complaints to the FBI about the investment scheme and claim to have lost around $6.7 million. The scam involved victims being sent “unexpected text messages, pretending that they misdialed a number.” Criminals then struck up a relationship with the victims and moved conversations to WhatsApp or Telegram before convincing them to invest in fraudulent cryptocurrency schemes, the documents say.
The documents say a review of records from SpaceX and Meta, which owns WhatsApp, helped to link a phone number used by the scammers to Starlink systems. The legal documents identify nine specific Starlink devices at Three Pagodas Pass and say they were linked to two Starlink user accounts that were registered in the Philippines.
Meta did not immediately respond to a request for comment, but has previously said it has disrupted more than seven million accounts linked to scam centers since the start of 2024.
Starlink accounts provide the scammers with “the internet service they need to induce U.S. victims to send their funds overseas as part of fraudulent investment opportunities,” the documents allege. The affidavit says the two Starlink accounts should be seized and orders “SpaceX to effect seizure” on the devices “by freezing and/or disconnecting the Starlink terminals from the SpaceX network.”
When asked if there were any plans to physically seize Starlink devices in Myanmar, a Department of Justice spokesperson said they cannot comment on ongoing law enforcement operations, “but we note that the warrant obligates Starlink to suspend access to the devices.”
In recent years, scammers have refined and rapidly scaled digital investment fraud schemes that have been extremely lucrative for criminals and a scourge to victims around the world. The operations are staffed using forced labor in compounds around Southeast Asia, particularly in Laos, Cambodia, and Myanmar. Researchers have repeatedly found that the majority of scam activity in that region has ties to Chinese organized crime. And the model has been so effective for criminals that it has started to be exported to or copied in other parts of the world. In an effort to generate convincing materials more quickly and tailor them more specifically to victims, scammers have increasingly adopted new technologies, including generative AI and video deepfake face cloning tools.
“Authorities in the region have reported a surge in Starlink being smuggled to support large-scale cybercrime and scam compounds, particularly into Myanmar, following a substantial telecom crackdown along the Thai border—most of which appear to remain operational,” says John Wojcik, a senior threat researcher at security firm Infoblox. Wojcik says the US creation of the Strike Force shows an increasing “government prioritization” of tackling scam compounds but also the “profound impact and damage caused by this fast-evolving billion dollar industry.”
While some scam compounds in Myanmar and Cambodia have been raided by local law enforcement officials, many continue operating and have proved resilient to disruption. In February, law enforcement officials in Thailand cut power, fuel, and internet connectivity to nearby scam compounds in Myanmar. In recent months, more than 10,000 people have been detained in Myanmar and one compound was partially blown up by officials, although experts have questioned whether some of the actions are political antics.
WIRED’s investigation in February, which relied upon mobile phone connection data, found that at least eight scam compounds near the Myanmar-Thailand border have been using Starlink devices to stay online. Between November 2024 and the start of February, the analysis showed, hundreds of mobile phones connected to Starlink more than 40,000 times while located at known scam compounds. Following the investigation, US senator Maggie Hassan wrote to SpaceX owner Elon Musk demanding answers about the use of the Starlink devices at scam compounds.
“SpaceX has a responsibility to block criminals from using the service to target Americans,” Hassan said at the time.
The post DOJ Issued Seizure Warrant to Starlink Over Satellite Internet Systems Used at Scam Compound appeared first on Wired.
