Exposing A Syndicate — By Getting Scammed

• GroundUp freelancer Joel Cedras voluntarily fell victim to a scam in order to show how it works.
• There are numerous scams on social media offering quick money to desperate people.
• This particular scam is international: it appears to be operated from China, with “staff”, possibly working in coercive environments, in Myanmar, Nigeria and Thailand. Desperate people in Egypt, Peru, Bangladesh, Iraq, Pakistan, Jordan and South Africa are targeted.
• The scam is convincing, and it is extremely popular. The scammers’ Telegram account has over 100,000 followers.

I decided to be a victim of a scam. GroundUp gave me a R2,000 budget, and I threw in some of my money too. I replied to an advert offering a job working for Amazon where I would “process orders” and get paid for it.

There was some confusion down the line, because I ended up working for “Makro” instead. I got scammed out of almost R4,000, and the bank and the police failed to help. But I managed to trace it back to a syndicate based in China, that operates numerous scam sites across the world.

The ad

The ad found me on TikTok, the way it finds most people. It was an AI-generated post from an account called Amarachi, with four smiling warehouse workers, an Amazon logo, and a South African flag.

The job scam advert, generated by Google’s Gemini. Clicking on it redirects to a form, and then to a WhatsApp link.

I clicked on the ad, which took me to a WhatsApp chat with a person called “anna.king”. I said hello, and then learnt I was talking to “Susana Ascona, the Human Resources Manager”. She immediately asked where I saw the ad, and asked for a screenshot of it. Here the scammers are trying to see which ad resulted in a click, and they are trying to make sure I actually saw an ad and that I’m not someone trying to catch them out.

I told her that I was 29 and unemployed, and she then explained the side job: clicking on orders from online shopping platforms, which would take five to ten minutes a day and rake in between R500 and R10,000 daily. I was interested, and she then shared a link to signup with the platform, with a R20 sign-up bonus.

I sent her a screenshot of my successful registration. She congratulated me, and explained the last step: install Telegram and add my “mentor”. She sent a link to the mentor, Marisol, and told me to send my mentor a screenshot too. Then, the scam moved to Telegram.

Scammers move victims to Telegram mainly because its moderation is looser and accounts are easy to burn and replace. They are able to stay mostly anonymous, and can use features like channels to mass distribute fake information easily.

A screenshot after I signed up to the order processing platform

Marisol, my R100, and making my first profit

Marisol’s opening line on Telegram was very warm. “Welcome to the Business Centre. I’m glad to see you here and happy to help you earn more money”. I sent my details again for verification, and she sent me a channel link where I could see the successes of other employees. The channel had over 105,000 subscribers.

She explained the job again and explained that in order to start working, I had to be a VIP, which required me to deposit R100. It was carefully framed: “You don’t have to pay our company anything. The 100 ZAR deposit is completely secure in your registered account. If you’re not satisfied, you can withdraw it at any time.”

One of the Telegram channels. This one, Working Group 63, had over 100,000 subscribers.

She sent banking details — a Standard Bank personal account, clearly belonging to a mule (see GroundUp’s article explaining how money mules work). I was told to make an “Instant Transfer”, so that the funds clear immediately. After a ten-minute wait while “the mall checks [my] deposit”, my balance reflected the deposit. I now had R120.

I was then thrown around again, this time to my “work order supervisor”, named Carmenyah. “She will guide you step by step from beginning to end”.

My account balance after my R100 deposit and my R20 registration bonus.

Carmenyah, the money leech

Carmenyah messaged me and said that she was my Marketing Management Coach. She too asked for a screenshot to “prove that [I am] registered”. I gave her all the details, and she then sent me an instruction image and told me to start working.

This shows the user interface for completing the orders. “Please follow the steps in the image to complete the task. After completing the next 12 tasks, please send me a screenshot.”

I completed the steps, and she then guided me to withdraw. The steps were quite easy: I had to go to the site, click on a button to process an order, and after a few seconds, an order was complete, and I earned a commission.

After adding my banking details to the system, R144 landed in my account. A real payment! This payment, made from the same account that I deposited into, was small enough to be disposable, and is designed to make you confident that you are dealing with a credible company.

The different VIP tiers, of which I had to select one to continue working.

And then the upsell. I had to select a VIP tier, and after selecting VIP2, I had to make a payment of R200 to get started, this time to a new bank account, again another Standard Bank mule. Paid, confirmed, unlocked. My R200 should turn into R350. This time, I had to do 26 tasks instead of the original 12.

And then the platform gave me a “lucky” high-commission order I hadn’t asked for. It promised me a commission of R1,288, but in order to process this order, I had to pay a shortfall of R422. This is where the scam really started. I paid the R422 to an ABSA mule and asked how many more of these high-commission orders I would get. She promised that “high-commission orders will only occur 1-2 times … not too many times”. “We are a legally established company … rest assured”, she said.

Then came two more high-commission orders. I paid them an additional R888 and then R2,233. Note that I was told that I would only have to pay for two of them and that would be it, but the story changed when I got the third one. “This will definitely be your last”.

Both payments went to the same ABSA mule. At this point, I was promised to walk away with a commission of R11,032 – significantly higher than the R350 a day promise.

I confronted them after getting the third “high-commission order”. When I asked for my money back, I received a cold stock answer.

Four minutes later, another high-commission order popped up. This one was bad. To complete the order and get a commission of R33,407, I simply had to deposit R12,666 to unlock it. This was the 25th order I had to process, out of 26.

I decided that was enough. GroundUp was not going to give me any more money to waste, and I wasn’t going to part with more of my own money either, even for the sake of exposing a scam.

I asked for mercy. After all, I was told that I would only get two of these high-commission orders, but this was the fourth. No dice. I asked to speak to a supervisor. “You are not yet able to speak to your superiors because you have not completed your work yet.” I asked for some of my money back to buy bread. Nothing.

At some point, Carmenyah even told me to ask my relatives and friends for money if I did not have enough funds. They profit off of these “high-commission orders”. A victim might think that it’s worth it because they’ll get money out just like the first time. But they won’t. The first (and last) payment was to rake you in and make you think the scam is legitimate. From that point, they become leeches.

I had to deposit R12,666 in order to get a commission of R33,407. This is because the order price is R23,706, and I only had R11,040 as my balance.

Reporting it, for what it’s worth

I phoned Standard Bank’s fraud line the same afternoon. “I’d like to report a fraud case, please.”

After explaining everything, and listening to the hold music for quite some time, I was told to make a case at the police station and to get an affidavit. The Standard Bank employee said he had logged a case, but in order for the investigation to continue, I would have to get those documents to a branch.

I went to a police station to report the matter. Initially, I had to explain what “defrauded” meant to the officer, and once she understood, she told me to come back with bank statements. I came back later with all the relevant documentation — statements, message transcripts, screenshots, the works. However, I was turned away on the grounds of being “at the wrong station”, and was told to go to a different station.

The officer, while quite knowledgeable on these scams, told me I had two options: call the other police station and have them come to my house to log a case, or go to them. I chose the former. They did not pick up, thrice. At this point, the deadline that Standard Bank gave me (48 hours) had passed, so I gave up reporting the matter.

Then, several days later, out-of-the-blue, I got an SMS from Standard Bank with a “case number” and asking me to complete an affidavit with the police and send it to their fraud investigation email. By this point the money was long gone and it seemed like the bank was going through a pointless bureaucratic exercise that would simply waste my time.

These scams are easy to fall for

I went into this knowing that it was a scam. But every individual step that parted me with money felt reasonable at the time. A tiny real payout. A friendly mentor. A functional website. A public Telegram channel with one hundred thousand members.

If you, or someone that you know is being asked to pay to “activate” an account, or “unlock” a commission, especially when the platform was found on social media, please stop; it’s almost certainly a con. If you are paying money into personal bank accounts, you are probably paying money mules. If you did not apply for a job through a proper application process, remain skeptical. Companies do not conduct work on Telegram. Also look out for domains ending in funny things like .buzz and .vip.

These scams have become sophisticated over the past few years. With AI, setting up the software infrastructure to make such scams possible is easier than ever.

One of the reasons the scammers choose countries like South Africa is perhaps because both some of our banks and the police don’t do much about this kind of fraud. Both Standard Bank and the police should have done better.

Technical Information: Tracing it back to China

An international scam being run from multiple countries

I have found significant evidence showing that the platform, and many others operated across the world, are being operated by Chinese individuals. For more information on how I found this out, see the technical section at the bottom of the article.

When clicking on the TikTok advert, it does not take you to a WhatsApp link directly. It first hops through a redirector service. Upon investigating this service and finding the backend, I found that the text was in Chinese.

From here, we went to WhatsApp. The phone number is prefixed +234 – Nigeria. All of the TikTok advertisements that were found pointed to different WhatsApp numbers, all Nigerian.

The redirector service. It translates roughly to “Traffic Redirection Management – Backend Login”.

Website Analysis

The person on WhatsApp introduced me to the job scam website, za.svip44.buzz. I analysed the code and the network requests of this website, and found various other clones of the job scam, and various indicators that it is being operated by Chinese nationals.

The website is built with a Chinese framework called D-Cloud uni-app. The website’s source code is commented in Chinese. The permissions system used is identical to RuoYi, a popular Chinese back-office framework. The website’s settings include leaked metadata, with Chinese values, and an IP address operated by “Hangzhou Alibaba Advertising” in China. The image storage server is operated by Alibaba Cloud.

In the backend, there is also a built-in risk engine. This uses a scoring system that flags users who try to withdraw “too fast”, who share an IP address, or who use similar phone numbers. They also have a balance freezing system. There are also hidden rules in the source code that reveal the scam. For example, there is text in the code saying: “The number of orders will exceed your account balance. You only need to complete the difference to finish the task.”

A screenshot of the job scam website, za.svip44.buzz.

The source code exposes the international scale of the operation. There are at least eleven country-specific storefronts running on one shared backend. Each has its own domain, currency, and slightly reskinned big-brand storefront. These include: Egypt, Peru, Bangladesh, Iraq, Pakistan, Jordan, and more. It also leaks the date each one was set up, and the local “activation fee” charged in each market. Each one of these sites has identical code, including the same Chinese comments in the source code. It is very easy for this syndicate to launch the scam in a new country.

Domain records show the network expanding briskly: the oldest storefront domain was registered in October 2025, and then five more, including the South African ones, all went up in late May and early June 2026. I reported the za.svip44.buzz site to the reverse proxy (Cloudflare) as well as Google Safe Browsing, and it was subsequently flagged as phishing. On Sunday, 19 July 2026, they moved to a new domain – za.svip55.buzz. On the same Sunday, I reported the site again, and it was flagged, again. All the domains are registered anonymously.

Telegram Accounts

I managed to convince one of the fraudsters to add me on Telegram by pretending that I could not message them without them messaging me first. This allowed me to see their phone number: +66 6 5270 1849. This number is from Thailand. Earlier we saw that their WhatsApp numbers were Nigerian. It seems likely that there are scam centers operating in both Nigeria and Thailand, with a Chinese organisation owning the operation and making the profit.

I sent Carmenyah a device information and IP address grabbing link. It revealed Carmenyah is sitting in Myanmar, using Starlink as their ISP. (See Over 5,000 people trapped in Myanmar scam centres near Thai border, rights group says, published by Reuters.)