#FactCheck-Old China Skyscraper Fire Video Falsely Shared as Attack on Iran’s IRGC Headquarters

Introduction
‍

When Tamil Nadu Police arrested a man from Vellore in May 2026 on suspicion of being the point person helping Indian youth to be smuggled into cyber scam compounds in Cambodia, the papers led with the accused. They shouldn't have led with the accused but with the system. The arrest, one in a long string of them in Tamil Nadu, Madurai, and other states, is not simply another one-off policing victory. Rather, the arrest gives us an insight into a larger, darker world: an international criminal organisation that has successfully combined human trafficking and cybercrime, a new trend in criminality that specialists are calling 'cyber slavery.'
‍

What Is Cyber Slavery?

“Cyber slavery” involves trafficking persons under the pretence of employment, forcing them into committing online fraud to serve criminal enterprises. Victims are not merely victims of the work they are forced to do; they are often turned into culprits as they become complicit in victimising others. Trafficked victims are compelled to participate in frauds targeted at unsuspecting victims all around the globe. These activities, organised into robust criminal schemes, involve victims of sex or labour trafficking who are forced into operating romance scams or the so-called "pig butchering" scams that defraud people of their investment in cryptocurrency, all in heavily secured complexes guarded with threats of violence and torture. The extent of the problem is enormous, with the UN Office of the High Commissioner for Human Rights estimating in a 2023 report that there are over 100,000 victims of cyber scam compounds in Cambodia and another 120,000 in Myanmar. Schemes throughout Southeast Asia were projected to commit as much as $39.9 billion in fraudulent schemes a year.
‍

Why Southeast Asia? The Geography of Organised Crime
‍

In order to answer why Cambodia, Myanmar, Laos, and the surrounding regions have developed into the cyber slavery hub of the world, we can draw together an array of structural reasons:

• Casino clampdown and crime diversification: Cambodia's ban on online gambling in 2019 broke down established casino-related criminal networks. This saw old casinos and Special Economic Zones turn into cyber scam compound operations.
• Corruption and state complicity: A pre-existing environment of corruption and involvement of politically linked figures permitted scamming networks to flourish, and the armed groups in the border areas of Myanmar are reportedly complicit in these operations through supplying land and protection for the networks to operate in.
• Poor governance in the border areas: The lack of state control in the frontier areas of Myanmar provided the criminal networks with a secure sanctuary in which they could operate with impunity and cross borders to escape crackdowns and move their operations.
• Post-pandemic growth: The economic stress associated with the COVID-19 pandemic led to an increase in the supply of vulnerable individuals available to fill the scam networks, as well as unprecedented profit margins on scams.

‍

The Recruitment Pipeline: How Are Indian Youth Trapped?
‍

The typical journey from an Indian town or village to a locked compound in Southeast Asia follows the same narrative:

• The bait: On platforms like Facebook, WhatsApp, and Telegram, gangs lure with posts of lucrative overseas employment for IT work, customer service, data entry, and digital marketing with attractive, albeit feasible, pay packages (Rs. 80,000 to Rs. 1.5 lakh per month) and destinations such as Thailand and Singapore added for a veneer of genuineness.
• The recruiters: Local agents who gain trust, arrange visas and flight tickets, and collect the application fees are key intermediaries. Cases registered in Vellore and Madurai hint at recruitment agents receiving a commission for each person successfully smuggled into a trap, linked to larger travel and immigration networks.
• The lie: Victims are assured that they will be working legitimately in Thailand, but on reaching the border and crossing over, they find themselves pushed into scam compounds in neighbouring countries and have their passports, mobile phones and devices confiscated, thus rendering any escape attempt futile.
• The trap: In the interim, fake interviews, false job promises and convincing flight tickets serve to maintain the facade until the victims are forced to participate in cyber-fraud schemes.

The Architecture of Coercion: Life Inside the Scam Compounds
‍

It is in these compounds that the fates of the victims become known. Survivor accounts, investigations and UN human rights reports provide evidence of these circumstances. These compounds are often surrounded by barbed wire fences, monitored with cameras and heavily guarded. Once a potential victim is captured, they are stripped of their passports and any other electronic devices, preventing them from being able to contact the outside world or to escape. Workers are allocated stringent targets, ranging from the number of potential victims they must solicit for scams and the amount of money they must acquire through such scams. Failure to do so, or perceived disobedience, may lead to beatings, electroshock treatment, starvation and long periods in confinement. These beatings are supplemented with psychological torture, with scammers assuring their victims that they owe money for their journey, stay and training. This method of debt bondage keeps people at the compound even when the opportunity for escape is presented to them. The victims are then forced to take part in more complex online scams, which involve romance scams, fake investment scams, and impersonation scams using scripts and with supervision. In some cases, families will be encouraged to pay for their captive relatives' release by ransom, whereas those who refuse to comply or meet performance requirements may be sold and transferred to another compound as a piece of property within a transnational criminal network.
‍

Cybercrime Is No Longer Just About Hacking
‍

This emergency challenges the existing notion of cybercrime. The scam compound of Southeast Asia is not about a lonely hacker or a standalone breach; it is a form of organised cyber slavery in which trafficked individuals are made to commit financial fraud on an industrial level.

The probe of India's NIA found that recruitment is done in the Indian states of Bihar and Uttar Pradesh. Transport agents in Chennai and Madurai provide logistics, and Dubai and Bangkok act as transit points on the way to Cambodia, Laos, and Vietnam. It makes use of cryptocurrency wallets, shadow banking, and shell companies for the movement of funds across international borders. Companies such as the Huione Group has been accused of facilitating billions of dollars in financial transactions for scam infrastructure before receiving sanctions from the U.S.

To illustrate the threat landscape, the U.S. Treasury imposed sanctions on 19 entities spread across Myanmar and Cambodia and said that cyber scam operations looted $10 billion worth last year. Also, cryptocurrency transactions related to trafficking crimes jumped by 85% last year, which speaks to the expanding nature of the global criminal infrastructure.
‍

India's Exposure: A National Vulnerability
‍

The scale of exposure for India is large and expanding. The most likely victims are educated, and aspirational young men and women from Tier 2 and Tier 3 cities, seeking work abroad, which perfectly aligns with the primary target of such human trafficking networks.

Repeated incidents of people from Tamil Nadu falling victim to these networks have come to light. As far back as 2022, the chief minister wrote to the prime minister that close to 300 Indians, roughly 50 Tamils included, were being held in Myanmar. The Madurai-Cambodia case that came to light in 2026 revealed an entire network spanning Cambodia, Laos, and Vietnam, with authorities believing that thousands of Indians might have been trafficked there over the past three years. Such cases from Kerala, Karnataka, Andhra Pradesh, and some northern Indian states have been reported. Last year, India had to charter Air Force flights to rescue over 549 Indians from cyber scam centres along the Myanmar-Thailand border.

The Indian embassy in Phnom Penh assisted the Indian nationals along with the CBI, MEA, and NIA in the rescue of 67 Indians in September 2024; however, these operations are largely reactive in the face of the vast and evolving transboundary crisis.
‍

Prevention
‍

The best solution is awareness. The following are tangible signs that a job offer might be a lead to trafficking:

Red Flags within the job offer:

• Receiving unsolicited recruitment messages on WhatsApp, Telegram or Instagram from unknown numbers/contacts.
• Offer of unbelievably high salaries in undefined roles like ‘data entry,’ ‘online marketing’ or ‘customer service’ outside India.
• Request for upfront money to cover costs of visas, travel, accommodation, and training.
• Job offers to places in Thailand or Singapore involving complex transit routes through other countries.
• An interview process entirely through messaging apps, where the company has no real office address or registration number.
• Urgency and/or confidentiality required.

Verification:

• Check if the recruiter is registered on MEA's e-Migrate portal-this is a portal where MEA lists authorised overseas recruiters.
• Verify the authenticity of the company through its business registration with official registries in the foreign country.
• Contact the Indian Embassy/Consulate in that foreign country if something doesn't add up about the offer.
• Do not hand over your passport to your employer on arrival; it is standard practice for recruiters working as traffickers to confiscate it.

What to do if trapped:

• Contact the closest Indian embassy or consulate immediately.
• Call the MEA overseas helpline: 1800-11-3090.
• Lodge a report on the National Cybercrime Reporting Portal (cybercrime.gov.in).

Policy Imperatives
‍

On their own, individual consciousness cannot undo such a massive criminal infrastructure. India has to enforce the Emigration Act rigorously, implement mandatory licensing of recruitment agents and create a specialised task force consisting of NIA, CBI, MEA and the states’ cybercrime units. Pre-departure orientations should also become mandatory for migrant workers who go to Southeast Asia. Globally, India needs to work more closely with Cambodia, Myanmar, Thailand and Laos via intel sharing protocols, victim repatriations and action against scam compounds. Financial probes must be on par with enforcement investigations to catch up with the perpetrators’ network, the cryptocurrency and hawala channels that facilitate money laundering and finance trafficking operations, as that would severely hit these networks.
‍

Conclusion
‍

This arrest of the recruiter in Vellore is just a small piece of a larger network. What we see in these instances is the marriage of cybercrime, trafficking, and financial fraud into a larger transnational ecosystem that systematically preys on the economic vulnerability of individuals. These young Indians are not simply falling for scams; they are being systematically targeted, recruited, trafficked, and forced into these criminal operations by a networked structure. The scam compounds in Cambodia and along the border of Myanmar and Thailand are only the end of a process that very likely starts with a convincing job offer on social media. Fighting cyber slavery will not be as simple as more arrests; we need education and international efforts, as well as policy responses that match the scope and scale of the problem.
‍

References
‍

1. https://the420.in/78415-2vellore-man-cambodia-cyber-slavery-trafficking-case/
2. https://the420.in/madhan-vadivel-cambodia-cyber-slavery-trafficking-racket-investigation/
3. https://www.newsonair.gov.in/tamil-nadu-police-arrest-key-recruiter-in-cambodia-cyber-slavery-racket/
4. https://kashmirdotcom.in/2026/05/16/cambodia-linked-human-trafficking-cyber-slavery-racket-nia-chargesheets-five-including-absconding-kingpin/
5. https://www.aljazeera.com/news/2025/7/16/more-than-1000-arrested-in-cambodian-cyber-scam-raids
6. https://www.pbs.org/newshour/world/why-southeast-asias-online-scam-industry-is-so-hard-to-shut-down
7. https://www.cfr.org/articles/how-myanmar-became-global-center-cyber-scams
8. https://www.amlrightsource.com/resources/scam-states-the-cybercrime-corruption-complex-in-southeast-asia-and-the-collapse-of-anti-money-laundering-enforcement
9. https://newlinesinstitute.org/global-security-mil-priorities/cybercrimes-human-trafficking-and-cryptocurrency-in-southeast-asias-special-economic-zones/
10. https://www.theweek.in/news/india/2026/03/21/lured-by-jobs-sold-into-slavery-indias-crackdown-on-cyber-trafficking-continues.html

‍

Introduction

The Government of India has initiated a cybercrime crackdown that has resulted in the blocking of 781,000 SIM cards and 208,469 IMEI (International Mobile Equipment Identity) numbers that are associated with digital fraud as of February 2025. This data was released as a written response by the Union Minister of State for Home Affairs, Bandi Sanjay Kumar, with respect to a query presented in the Lok Sabha. A significant jump from the 669,000 SIM cards blocked in the past year, efforts aimed at combating digital fraud are in full swing, considering the increasing cases. The Indian Cyber Crime Coordination Centre (I4C) is proactively blocking other platform accounts found suspicious, such as WhatsApp Accounts (83,668) and Skype IDs (3,962) on its part, aiding in eliminating identified threat actors.

Increasing Digital Fraud And The Current Combative Measures

According to the data tabled by the Ministry of Finance in the Rajya Sabha, the first 10 months of the Financial year 2024-2025 have recorded around 2.4 million incidents covering an amount of Rs. 4,245 crore involving cases of digital Financial Fraud cases. Apart from the evident financial loss, such incidents also take an emotional toll as people are targeted regardless of their background and age, leaving everyone equally vulnerable. To address this growing problem, various government departments have dedicated measures to combat and reduce such incidents. Some of the notable initiatives/steps are as follows:

• The Citizen Financial Cyber Fraud Reporting and Management System- This includes reporting Cybercrimes through the nationwide toll-free (1930) number and registration on the National Cyber Crime Reporting Portal. On being a victim of digital fraud, one can call the toll-free number, describing details of the incident, which would further help in the investigation. After reporting the incident, the complainant receives a generated login ID/acknowledgement number that they can use for further reference.
• International Incoming Spoofed Calls Prevention System- This is a mechanism developed to counter fraudulent calls that appear to originate from within India but are actually made from international locations. This system prevents the misuse of the Calling Line Identity (CLI), which is manipulated to deceive recipients in order to carry out financial crimes like digital arrests, among other things. Coordinating with the Department of Telecommunication (DoT), private telecommunication service providers (TSPs) are being encouraged to check with their ILD (International Long-Distance) network as a measure. Airtel has recently started categorising such numbers as International numbers on their part.
• Chakshu Facility at Sanchar Saathi platform- A citizen-centric initiative, created by the Department of Telecommunications, to empower mobile subscribers. It focuses on reporting unsolicited commercial communication (spam messages) and reporting suspected fraudulent communication. (https://sancharsaathi.gov.in/). 
• Aadhaar-based verification of SIM cards- A directive issued by the Prime Minister's Office to the Department of Telecommunications mandates an Aadhaar-based biometric verification for the issuance of new SIM cards. This has been done so in an effort to prevent fraud and cybercrime through mobile connections obtained using fake documents. Legal action against non-compliant retailers in the form of FIRs is also being taken.

On the part of the public, awareness of the following steps could encourage them on how to deal with such situations:

• Awareness regarding types of crimes and the tell-tale signs of the modus operandi of a criminal: A general awareness and a cautionary approach to how such crimes take place could help better prepare and respond to such malicious scams. Some important signs on the part of the offender include pressuring the victim into immediate action, insistence on video calls, and the threat of arrest in case of non-compliance. It is also important to note that no official authority, in any legal capacity, allows for enabling a digital/online arrest.
• Knowing the support channels: Awareness regarding reporting mechanisms and cyber safety hygiene tips can help in building cyber resilience amongst netizens. 

Conclusion

As cybercrooks continue to find new ways of duping people of their hard-earned money, both government and netizens must make efforts to combat such crimes and increase awareness on both ends (systematic and public). Increasing developments in AI, deepfakes, and other technology often render the public inept at assessing the veracity of the source, making them susceptible to such crime. A cautionary yet proactive approach is need of the hour. 

References

• https://mobileidworld.com/india-blocks-781000-sim-cards-in-major-cybercrime-crackdown/
• https://www.storyboard18.com/how-it-works/over-83k-whatsapp-accounts-used-for-digital-arrest-blocked-home-ministry-60292.htm
• https://www.business-standard.com/finance/news/digital-financial-frauds-touch-rs-4-245-crore-in-the-apr-jan-period-of-fy25-125032001214_1.html
• https://www.business-standard.com/india-news/govt-blocked-781k-sims-3k-skype-ids-83k-whatsapp-accounts-till-feb-125032500965_1.html
• https://pib.gov.in/PressReleasePage.aspx?PRID=2042130
• https://mobileidworld.com/india-mandates-aadhaar-biometric-verification-for-new-sim-cards-to-combat-fraud/ 
• https://pib.gov.in/PressReleaseIframePage.aspx?PRID=2067113 

‍

With AI touching new milestones everyday an increasing need for making it secure is also arising. As these AI companies increase their operations and position in the market as providers of powerful tools in the market. A recent concern due to Anthropic's recent privacy policy update which will be effective from July 8, 2026 shows how companies have begun expanding the amount of personal information they collect in the name of safety, compliance, and trust. While they are being demonstrated as measures to improve safety of users and prevent abuse, it raises important questions about privacy, biometric data, surveillance, data retention, and user autonomy, some of which we will be addressing in this article.

‍

Identity Verification of consumers

‍

One of the most notable update to Anthropic's privacy policy is the category of "Verification Data." According to the policy, users may be asked to verify their age or identity in certain circumstances. Depending on the verification method, Anthropic may collect:

• Images of government-issued identity documents;
• Information appearing on those documents, including identification numbers and date of birth for age verification;
• Photographs or videos of the user;
• Facial geometry templates, which may constitute biometric data under certain legal frameworks; and
• The outcome of the verification process.

At first, this may appear similar to the Know Your Customer (KYC) procedures employed by banks or financial institutions but Claude is not a banking service. It is a consumer AI platform. The issue is not that verification exists, but that the circumstances under which it may be required remain undefined.

‍

THE PROBLEM WITH “CERTAIN CIRCUMSTANCES”

‍

The policy refers to verification being required in "certain circumstances." The public notification from Anthropic mentions that these circumstances may include access to particular features, routine platform integrity checks, abuse prevention mechanisms, policy enforcement activities, or legal compliance obligations. The ambiguity of this phrase raises important concerns. From a user perspective, it is difficult to determine, When verification may be triggered ? Whether verification applies only to suspicious accounts ? Whether access to future features may depend upon verification ? Whether users in particular regions will face more frequent verification requirements ? Whether verification requests may increase as AI regulation expands ? This broad language and discretionary power that the company has along with flexibility in the hands of the company creates uncertainty for users who may have initially joined a platform expecting only an email address and payment information to be required.

‍

Government IDs collection: A new risk category

‍

Almost all AI services have operated without collecting government-issued identity documents. Once a company begins processing such information, the privacy implications change dramatically. Because government issued IDs contain: Full legal names, Dates of birth, Identification numbers, Addresses, Photographs and information regarding nationality. When companies collect these documents, they will have an important database of highly sensitive personal information. Even if the company itself does not retain the documents indefinitely, the existence of a verification process introduces additional privacy and security risks. As per Anthropic has stated that identity verification is conducted through third-party providers such as Persona. According to article on the official site titled ‘Identity verification on Claude’, Persona stores the identity documents and selfie data, while Anthropic retains access to verification records when necessary.  From the user's perspective, several important realities remain: First, the data still exists somewhere. Second, another third party organization is now involved in processing highly sensitive personal information. Third, Anthropic retains the ability to access verification records under certain circumstances. Therefore, although Anthropic may not directly maintain copies of every uploaded identity document, the practical result remains that sensitive information enters a broader ecosystem of entities and systems. Identity documents today are among the most valuable forms of personal information from the perspective of fraudsters, cybercriminals, and malicious actors. Therefore, any system that handles such documents becomes an attractive target for attack.

More information on persona’s government ID verification- https://withpersona.com/blog/what-is-government-id-verification 

‍

The Biometric Dimension

‍

Another significant aspect of the update is the reference to facial geometry templates. Unlike passwords, biometric identifiers cannot easily be changed if compromised. A person can replace a password or even obtain a new identification card, but they cannot simply obtain a new face. Facial geometry templates are sensitive because they enable automated identity matching. Although these templates, as claimed, are not equivalent to photographs, they are nevertheless derived from unique physical characteristics of a person. In many jurisdictions, including parts of the European Union and several U.S. states, biometric data receives enhanced legal protection because of its permanence and sensitivity, let us see how it unfolds in these jurisdictions.

‍

The Unanswered Retention Question

‍

It is unclear in the policy as to how long the data will be retained because retention limits serve as one of the most important safeguards in modern privacy law, they have given another vague answer that “They're bound to protect it with industry-standard security controls and delete it in line with the retention limits we've set and applicable law.” The longer sensitive information remains stored, the greater the likelihood of unauthorized access, misuse, accidental disclosure, or legal compulsion.

‍

Court Orders and Government Access

‍

Anthropic may be required to disclose information pursuant to valid legal processes such as subpoenas, court orders, warrants, or regulatory directives. The existence of identity verification records means that future requests could potentially be linked to verified identities rather than pseudonymous accounts. This does not mean governments receive unrestricted access to user data. However, it does mean that once identity verification information exists within a company's ecosystem, it may become subject to lawful disclosure requirements. The privacy implications are therefore materially different from those associated with anonymous or pseudonymous AI usage.

‍

Shifting Responsibility onto Users

‍

Another concern is that the privacy policy states that users are responsible for ensuring they possess the necessary rights, permissions, or authority when uploading files, connecting third-party services, or instructing Claude to retrieve information. Anthropic is effectively informing users that they bear responsibility for ensuring that uploaded or connected data is lawfully accessible. As AI assistants gain greater capabilities, this transfer of responsibility from platform to user is likely to become increasingly common. Beyond individual privacy, Anthropic's verification policy also raises larger questions about data sovereignty and the cross-border movement of sensitive personal information. In India, the Justice K.S. Puttaswamy (Retd.) v. Union of India judgment recognized privacy as a fundamental right under Article 21 of the Constitution, affirming that individuals have the right to informational self-determination and control over their personal data. Yet, under Anthropic's verification framework, an Indian user may be required to upload a government-issued identity document and biometric information, which are processed by Persona, a U.S.-based identity verification company acting on behalf of Anthropic. Although users voluntarily consent to this process, it nevertheless results in highly sensitive identity information crossing national borders and entering the control of foreign private entities governed primarily by foreign contractual arrangements and multiple legal regimes. While governments issue identity documents as sovereign instruments of citizenship, their verification and processing are increasingly outsourced to multinational technology companies. Questions arise not only about how securely such information is handled, but also about which country's laws ultimately govern access, retention, disclosure, and accountability when personal data leaves the jurisdiction in which it originated. Under the Digital Personal Data Protection Act, 2023, cross-border transfer of personal data is generally permitted unless the Central Government specifically restricts transfers to certain jurisdictions. Therefore, a foreign company processing identity documents is not, by itself, unlawful but this legality does not eliminate legitimate concerns. Users realistically have limited bargaining power and little practical understanding of how long their identity documents, biometric templates, or verification records will be retained, who within the corporate ecosystem may access them, or how they may be disclosed pursuant to foreign legal processes. 

‍

Conclusion

‍

The policy is commendable in some respects because it openly identifies the categories of information that may be collected rather than obscuring them behind vague terminology. However, important concerns remain regarding the extent of verification triggers, the handling of biometric information, the absence of clearly disclosed retention periods, and the long-term implications of linking AI accounts to government-issued identities. As AI systems become more integrated into daily life, these questions will likely become central issues in debates about digital privacy, surveillance, autonomy, and the future governance of artificial intelligence.

‍