--- title: Inside a Scam Compound: Mohammad Muzahir’s Story, pt 1 source_page: https://www.sardine.ai/media/fraudology/episodes/mohammad-muzahir canonical: https://www.sardine.ai/media/fraudology/episodes/mohammad-muzahir format: text/markdown date: 2026-10-29T01:01:00.000Z description: From stolen accounts to scripts. Mohammad Muzahir shares how a fake job offer led to a scam compound in Laos and how romance and crypto scams were run inside… --- **Quick links:** [Human page](https://www.sardine.ai/media/fraudology/episodes/mohammad-muzahir) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo) --- # Inside a Scam Compound: Mohammad Muzahir’s Story, pt 1 **Published:** 2026-10-29T01:01:00.000Z From stolen accounts to scripts. Mohammad Muzahir shares how a fake job offer led to a scam compound in Laos and how romance and crypto scams were run inside… Welcome back to Fraudology. This is a survivor’s story. Mohammad Muzahir, also known as Red Bull, is the cybercrime whistleblower in the WIRED reporting that opened a window into how scam compounds work. He escaped one, and he now spends much of his time helping large organizations understand how they operate. He was studying computer science and looking for a way to fund a bachelor’s degree abroad when a friend of a friend offered him an IT manager job in Laos, in the Golden Triangle region. The job did not exist. What followed is a human trafficking story and a fraud story at the same time. This episode of the Fraudology podcast sits right where the two meet. We cover how the fake job offer worked, what daily life looks like inside a scam compound, and how forced workers are handed scripts, fake personas, and stolen accounts to run romance and crypto investment scams. This is not an easy conversation, and I hope it gives you a fuller picture of the people on both sides of the screen. This is part one of a two-part conversation. What you’ll hear in this episode: What a scam compound looks like from the inside, including buildings with dozens of floors, long daily shifts, and fines that keep workers in debt How a fake job offer and a chain of trusted contacts moved a young IT graduate from India into a scam compound in Laos Why many of the people running these scams are forced workers, and why Mohammad calls himself a victim as well How the story bible gives each fake persona a childhood, a hometown, a daily schedule, and an answer for every question How romance scam victim manipulation turns trust into a crypto investment, including fake gains and small early withdrawals Why a scammer may coach a victim to dismiss a bank’s warning before the victim ever walks into the branch What Mohammad says about stolen, aged social media accounts and how recovery flows were used against account owners What his 4,200 pages of evidence shared with WIRED’s Andy Greenberg add to what investigators know You should listen to this episode if you: Work in fraud, risk, or trust and safety and want a clearer picture of how the people behind these scams are organized Support scam victims and want to understand why they trust a persona so deeply Train bank or credit union staff who talk with customers who are being coached by a scammer Work on account takeover or social media platform integrity and want to hear how stolen accounts are used Want a survivor’s perspective on how a fake job offer becomes forced labor ### Episode notes A fake job offer and a debt that follows you Mohammad was told the job paid about $1,700 a month, which sounded like a way to save for school. A friend vouched for a contact in Laos, and that contact connected him with an agent who arranged the trip. He says the agent’s instructions came one step at a time, and his passport was taken early in the trip and never returned. Only after he arrived did he learn the truth. A manager told him there was no IT job and that he would be scamming people. When he said he wanted to leave, he was told he owed the cost of bringing him there. He had no money to pay it, and he didn’t tell his parents what the job really was because he feared what they might do. Recruitment like this depends on trust in a friend of a friend, and a debt that follows the worker makes leaving close to impossible. Daily life inside the compound Mohammad describes towers of 30 to 50 floors, with several offices on each floor and hundreds of people in every office. Workers sit at a computer for 14 to 15 hours a day. On the first day, he was given aged social media accounts with two-factor authentication already set up, along with SIM cards to create new accounts. Training happened every day. The chain of command ran from Chinese-speaking bosses through team leaders to the workers, with translators in between. Team leaders and bosses could see each worker’s accounts and messages, and they stepped in with corrections. Breaking a rule meant a fine. Mohammad’s monthly salary was 3,500 yuan, and the fines could reach thousands. His contract ran for a year, and he says the whole system runs on debt. The people at the keyboards often have no choice, which changes how fraud fighters should think about who is on the other side of the screen. The story bible The story bible is the part I wanted to understand best, because Mohammad says the entire scam runs on a single story. Each persona gets a childhood, a favorite food, a profession, and a home in a real city. The research goes down to the hospitals, parks, restaurants, and golf courses near that home. Photos come from public sites. Each worker keeps a daily schedule, shares it in a report group, and has a prepared answer for what a victim might ask. Mohammad had two story bibles, one for a businesswoman and one for a woman running a few restaurants and gas stations. Trust looks personal to the victim. It was built with careful research and a script. How trust turns into an investment Mohammad says the timing depends on the victim. A wealthy person may be talked with for months before an investment is raised. In the pattern many of us call pig butchering, victims see fake gains on a platform the scammers control, and they are allowed small withdrawals that make the platform feel safe. When someone tries to take out a large amount, a new fee or tax appears. Scripts also introduce an experienced uncle or a form of AI arbitrage to make passive income sound reasonable. Scammers may even coach victims to dismiss a bank’s warning in advance, telling them the bank only wants to keep their money. Mohammad was forced to take part in scamming two people. He says it was not his choice, and that he cried afterward and promised himself he would make it right. He also points out that the victim and the worker are both being used by the people at the top, which is why I treat empathy as a fraud control and not a courtesy. Stolen accounts and the signals platforms already have Mohammad described the accounts used in the compound as stolen, years old, and protected by two-factor authentication. I told him a login from Laos on an account that normally logs in from California looks like a takeover signal to me. He said he saw platforms block an account and ask for a face check, and that workers simply showed their own faces and got the account back. That is his experience, and he says it happened hundreds of times. I believe platforms and the companies that depend on them already have the signals they need, including location changes, recovery flows, and behavior that no longer matches the account owner. After he left, he shared 4,200 pages of data with WIRED’s Andy Greenberg. That evidence is a big part of why we now know how these operations are run. ### Key takeaways Scam compounds recruit with fake job offers that move through friends and trusted contacts, and they target people who need work or money for school. Passport confiscation and debts for travel costs keep workers from leaving. Many of the people running these scams are forced laborers, and treating them only as perpetrators leaves out part of the picture. Daily life in a compound means long shifts, daily training, monitoring by team leaders, and fines for breaking rules. A story bible gives each persona a detailed life, and the details are researched around real places and prepared answers. Trust in a persona is built over weeks or months before an investment is ever raised. Fake gains, small early withdrawals, and later fees keep victims investing. Scammers may prepare victims to dismiss a bank’s warning, which means staff conversations need patience and empathy. Stolen accounts with a long history make a persona look real, and platforms already have signals such as location changes that can flag them. Survivor evidence, including the pages Mohammad shared with WIRED, helps investigators understand how these operations run. ### Final takeaway Scam compounds are fraud operations, and they are also trafficking operations. The person writing to a victim may be a worker without a passport, following a script written by someone else and watched by a boss. That doesn’t make the loss to the victim any smaller. It does mean the full picture has more people in it than we usually describe, and that a fraud team’s work connects to human trafficking. Part two covers how Mohammad identifies deepfakes and the story of how he got out of the compound. Episode resources & links Connect with Mohammad Muzahir | LinkedIn Cybercrime Whistleblower Cybercrime Researcher and Fraud Analyst Focus on Fraud Prevention and Detection OSINT Researcher, Cybersecurity Awareness Social Engineering and Cybercrime Expert Pig Butchering Expert Connect with Karisse Hendrick | LinkedIn Host of the Fraudology Podcast Award-Winning Cyberfraud Expert Ecommerce Fraud Prevention Consultant Startup Advisor, Keynote Speaker, and Consultant to Fortune 500 merchants