Malaysia arrests 34 Chinese Nationals involved in Law Enforcement Impersonation scam over Microsoft Teams

Police in Negeri Sembilan raided an abandoned resort in Broga, Mantin on October 12, uncovering a transnational 'Law Enforcement Impersonation' scam, also known as extortion or digital arrest - that had been operating for about a month from a block of buildings left vacant for four years. The operation, announced on October 14, led to the arrest of 40 people aged 19 to 63.

According to police, those detained include a local married couple believed to have facilitated the site, 34 Chinese nationals, three Myanmar nationals and one Taiwanese national. Investigators say the group rented one block of the derelict resort for RM20,000 per month, choosing its isolated position to avoid detection while running high-volume calls via Microsoft Teams.

The case is being investigated under Penal Code Sections 420 for cheating and 120B for criminal conspiracy. All suspects were remanded from October 13 to 16 to assist investigations.

“Its remote location in a rural area was believed to have been chosen to avoid detection.”

, Negeri Sembilan Police, on the choice of venue

How the Scam Worked: Impersonating Chinese Authorities

Police said the syndicate operated by impersonating Chinese prosecutors and police officers. Callers, speaking in Mandarin and using prepared scripts, would contact victims and claim they were implicated in criminal cases in China. The callers would then offer to “help” victims avoid arrest or prosecution to create panic and compliance.

The target victims were deliberately overseas. While the scam centre was physically in Malaysia, victims were primarily Chinese nationals living abroad, including in the United States. The use of Microsoft Teams and VoIP routing allowed the group to mask its location and present as official mainland numbers.

Microsoft Teams preferred for Conversations With Victims

Evidence extracted from seized devices shows highly produced deception materials: galleries of forged identity cards, police warrant templates, procuratorate letterheads, and bank account QR codes. Victims were walked through “verification” steps, sending photos of their own IDs, then transferring money to “safe accounts” for investigation, including accounts listed under The Hongkong and Shanghai Banking Corporation (HSBC Bank) in the screenshots presented by police.

A large blue message containing HSBC Hong Kong bank details for a transfer:

• Bank: 香港汇丰 / The Hongkong and Shanghai Banking Corporation Limited
• Address: 1 Queen’s Road Central, Central and Western District, Hong Kong
• SWIFT: HSBC HKH HKH (standard HSBC HK code is HSBCHKHH)
• Account: 620018994688
• Chinese name: 刘建洲
• English name: LIU JIANZHOU
• Postal code: 999077
• Recipient address: 38 Belcher’s Street, Sai Wan, Hong Kong

The account (HSBC Hong Kong in the name of Liu Jianzhou at a real Sai Wan/Kennedy Town address) is typical of mule accounts used by syndicates, these get rotated or shut down quickly and rarely match public records of legitimate high-profile people.

The Mandarin-language scripts relied on urgency and shame, warning that failure to cooperate would lead to an international arrest warrant. In several chats, victims were told to keep the call confidential and not to contact local police.

Inside the Call Centre

The raid revealed a makeshift but organized operation. Officers seized 82 mobile phones, three laptops, a TP-Link router, four tripods used to stabilize phones for video calls, RM5,000 in cash, and a tenancy agreement for the block. Photos show rows of phones tagged with yellow evidence markers, laptops open to Teams call logs, and a router with cables taped directly to a concrete wall, typical of pop-up scam centres that prioritize bandwidth over comfort.

The resort itself had been abandoned for about four years, police said. One block was reactivated and partitioned into workstations, with curtains drawn to prevent light leakage at night. The RM20,000 monthly rent was considered cheap for the isolation it provided.

Arrests

Of the 40 arrested, investigators believe most served as administrators and customer service officers, roles that included script reading, document forging, and monitoring transfers. Ages ranged from 19 to 63, underscoring the syndicate’s use of both young recruits and older facilitators. Multiple female faces were also visible in the evidences displayed by the Police.

The local married couple detained are alleged to have arranged the tenancy and logistics. The remaining suspects, 34 Chinese nationals, three from Myanmar and one from Taiwan, were found on site during the raid. All were taken for remand from October 13 to 16 as police trace money flows and identify additional victims.

Need of real time information sharing & close-cooperation

This case underscores why transnational crime can no longer be fought within national borders alone. The Broga syndicate was physically in Malaysia, impersonated Chinese authorities, targeted Chinese nationals living as far away as the United States, operated with passports and personnel from four jurisdictions, and ran its entire call centre on a borderless platform like Microsoft Teams. No single police force holds the full picture, the victim reports are in one country, the financial trail in another, and the servers in a third. Only seamless intelligence sharing on suspects, bank accounts and digital footprints, coupled with close operational cooperation for rapid raids and evidence preservation, can prevent such syndicates from simply renting another abandoned building in another remote district when one base is shut down.