Everyone hates Tilly + Ming family death sentences + crypto kiosk crackdown
Scamurai weekly newsletter #12. Oct. 3, 2025.
- Scamurai -
Weekly newsletter #12. Oct. 3, 2025.
This week’s edition is a bit shorter than usual on account of needing to listen to Taylor Swift’s new album this morning, for which I apologise. As always, get in touch at callan@scamurai.io.
// Headlines
Chinese fraudster Zhimin Qian, who entered the UK under the name Yadi Zhang on one of her several passports, has pleaded guilty to money laundering charges tied to a jaw-dropping £5.5 billion bitcoin haul seized by British authorities. The 47-year-old fled China in 2017 after conning more than 128,000 investors out of their money, then worth £1.4 billion in bitcoin. Her sham company, Tianjin Lantian Gerui Electronic Technology, promised 300% returns. She later rented a six-bedroom home worth £5 million in London from late 2018. Following the arrest of an associate, Jian Wen, in March 2022, Qian was thought to have fled the country. However, she was arrested in the UK in April 2024. Qian will be sentenced at a later date, along another associate, Malaysian broker Hok Seng Ling. The seizure of the £5.5 billion by Scotland Yard is the largest seizure of cryptocurrency in history. Further arguments are expected between Britain and China over what should happen to the money (refunding the defrauded investors, perhaps?).
A court in Wenzhou, on China’s eastern coast, has sentenced 11 members of the notorious Ming crime family to death, with another five receiving death sentences suspended for two years. They were among 39 family members sentenced on Sept. 29, with a further 11 getting life in prison and the rest receiving terms ranging from five to 24 years. Once one of the four dominant crime clans in Myanmar, the Mings ran the border town of Laukkaing until a Chinese-led crackdown in 2023. Under their control, the town became a den of gambling, drugs and online scamming, particularly after 2015. The court said their gambling and fraud rackets alone generated more than $1.4 billion, though other estimates suggest their empire raked in several billion annually. The group also committed violent acts, including opening fire on scam centre workers trying to escape, and the family has been held responsible for multiple deaths. Execution in China is usually by lethal injection. Those that receive a death sentence with a two year reprieve often have the sentence commuted to life in prison.
In the UK, the furore over compulsory digital IDs, slated for rollout in 2029, continues. Billed by the government as a way to prevent immigrants working illegally, a currently contentious topic in the UK, critics and much of the general public see the scheme as an Orwellian plot to surveil and control citizens. Already, a pub has renamed itself The George Orwell in protest and a petition to prevent it has received over 2.7 million signatures. The government has responded by doubling down. Rumours have begun to spread that the contract for the IDs has been given to Euan Blair, son of warlord-turned-wannabe-ruler-of-Gaza Tony Blair, and his company Multiverse. The company told Scamurai there was no truth in the claims, and neither Multiverse nor its leadership had any links to the scheme. But Scamurai did interview an actual digital ID company Cheqd a few weeks ago prior to the rollout. Check out the interview here.
The AI corporate machine’s crusade to strip away every last shred of human artistic expression shows no sign of slowing. Its newest target is actors. Performers around the globe are bristling at the debut of “AI actor” Tilly Norwood, unveiled last weekend at the Zurich Film Festival’s Zurich Summit Conference. Norwood is the first actress to be booked by Xicoia, a newly launched AI talent studio, spun out of a company called Particle6. Xicoia’s stated mission is to manufacture and lease digital performers for use in film, television and advertising. The company doesn’t seem to even have a website yet, but its creations are already under scrutiny. Images of Norwood shared online — and across her own Instagram — are raising eyebrows for their inconsistency, with the supposed actress often looking like an entirely different person from one post to the next.
Get this newsletter delivered fresh and ironed to your email each week, with the latest news on scams, fraud and tech, as well as Scamurai’s latest investigations — all in one place! Every Friday morning at 8am GMT.
// Hacks & dark markets
Luxury British department store Harrods confirmed last week that it had suffered a cyberattack in which hackers accessed the names and contact details of some online customers. “We have informed affected customers that the impacted personal data is limited to basic personal identifiers, including name and contact details, but does not include account passwords or payment details,” it said in a statement. Harrods has been contacted by the hackers but said it will not engage.
The UK government will provide Jaguar Land Rover with a £1.5 billion loan guarantee after a cyberattack hit the company at the end of August. The automaker is expected to repay the loan over five years. The attack has had devastating consequences for the company, which has been unable to resume production.
Canadian airline WestJet has revealed that a cyberattack disclosed in April exposed the personal data of 1.2 million customers, including passport information and other identification documents. The company said it is still assessing the full scope and impact of the breach.
// Scam factories
Cambodia’s Anti-Corruption Unit has arrested two suspects and is searching for two others in connection with a $774,000 bribery attempt aimed at securing the release of 43 Thai nationals detained following a raid on a scam centre. The group allegedly tried to bribe officials to free the detainees, but the attempt failed, and all 43 were deported in May. The arrested suspects, Heng Sokna and Muny Sokdaro, were apprehended on September 18 in Kampot.
Police in Cambodia have arrested four Chinese nationals and one Cambodian suspected of kidnapping and torturing a 51-year-old South Korean man in Phnom Penh. The motives behind the attack remain unclear, but the incident comes amid heightened warnings from South Korean authorities to their citizens traveling in the country. According to The Straits Times, authorities seized from the suspects “a K54 semi-automatic pistol, two magazines, nine rounds of ammunition, a steel pipe, three walkie-talkies, a rubber holster for a handgun, 112 narcotic pills, a drug-use device, and two passports.”
A 22-year-old Sri Lankan student in Singapore has been sentenced to three and a half months in prison and fined S$1,100 (around US$800) for allowing scammers to funnel money through her bank account. Rajadi Rajasinghe Manamendra Patabadilage Vishwa Madavi pled guilty to one count under the Computer Misuse Act.
A Singapore court also denied bail to the brother and girlfriend of an alleged Cambodia-based scam syndicate leader on Oct. 2. Singaporeans Ng Wei Kang and Christy Neo Wei En have been remanded since Sept. 11. They face a charge of being a member of an organised crime group. The syndicate leader remains at large.
// Crypto circus
A new law in Arizona targeting cryptocurrency ATMs came into effect last week, aiming to curb their misuse by victims unknowingly sending money to scammers. It comes as U.S. Senator Cynthia Lummis (R-WY) has also called for stronger safeguards around crypto ATMs nationally. She hopes to address the issue in an upcoming market structure bill. Last month, ATM operator Athena Bitcoin was sued by Washington D.C. Attorney General Brian L. Schwalb, who alleged the company profited from scams and imposed hidden fees of up to 26%. Complaints involving crypto kiosks have nearly doubled, with more than 10,956 incidents reported last year to the FBI’s Internet Crime Complaint Center. The agency noted that adults over 60, despite being among the least likely to use crypto services, accounted for more than two-thirds of reported losses.
The return of Pump.fun’s livestream feature in recent months has brought back the hoaxes and stunts that originally led to its shutdown. Last week, livestreamers staged a fake private jet crash in an attempt to boost engagement. The feature had previously been taken offline after incidents of child and animal abuse, as well as staged suicides, were broadcast by users trying to pump their memecoins.
India’s Ministry of Finance has issued notices to 25 offshore cryptocurrency platforms for failing to comply with the country’s anti-money laundering and counter-terrorism financing (AML/CTF) regulations. The list includes Cambodian company Huione and trading platforms Paxful, CoinEx, Poloniex, BitMex, HitBTC, BTSE, AscendEx and Phemex.
Tornado Cash developer Roman Storm has asked a U.S. judge to dismiss his conviction for unlicensed money transmission, as well as the hung counts of money laundering and sanctions violations. His lawyers argue that prosecutors failed to prove he intended for bad actors to use Tornado Cash. The U.S. Office of Foreign Assets Control (OFAC) has previously stated that the crypto mixer processed more than $7 billion since 2019, roughly 30% of which was linked to illicit activities.
Disney is the latest company to have their social media hacked in order to promote a cryptocurrency. Fans of the entertainment giant claim to have lost hundreds of thousands of dollars investing in “Disney Solana”. Disney has since deleted the posts.
// Proof of stupidity
The top source for financial information for ChatGPT is… Reddit.
In a piece on advice to marketers about getting noticed by AI search, Semrush noted:
“Reddit dominates ChatGPT citations across professional verticals: 141.20% in business services, 121.88% in technology, and 127.31% in consumer electronics. Which confirms that community-edited content carries significant AI authority, especially in ChatGPT. Often even over expert credentials.”
// ScamurAI
The flood of AI nonsense has just gotten worse with the release of Sora 2. This latest iteration of the AI video generator meets social media app is technically an upgrade. Users can now create far higher-quality videos of Sam Altman shoplifting, among other fake clips. Other recent fan-made Altman fabrications include videos of him asking, “are my piggies enjoying their slop?”
Character.AI has removed Disney characters from its chatbot platform following a request from the studio to stop using its copyrighted properties without authorisation. Disney reportedly sent the company a cease-and-desist letter in the middle of last month. Founded in 2021, Character.AI offers personalised AI chatbots for users to interact with. Some users have modelled bots on copyrighted characters, including Disney favourites like Elsa and Moana. The company has likened the practice to writing fan fiction. Character.AI has faced multiple lawsuits over how its content has affected children. One case alleges that a chatbot contributed to the suicide of a 13-year-old girl in 2023.
Meta has announced that starting December 16, it will use users’ conversations with its AI services to create personalised content and advertising. There will be no opt-out for most users, except those in the EU, UK and South Korea, who are excluded from the change. The company said it will not use AI conversations to personalise ads related to religion, sexual orientation, politics, health, race, ethnicity, philosophical beliefs or trade union membership.
Meta is also flooded with deepfake scam ads, according to the Tech Transparency Project. The group identified 63 scam advertisers who have collectively run over 150,000 political ads on Meta platforms, spending $49 million. “Meta is allowing this activity even though it prohibits scams and claims to invest in scam prevention to keep users safe,” the report noted.
// Law & disorder
The “Forbes 30 Under 30 to prison pipeline” has a new addition. Charlie Javice, founder of fintech startup Frank, was sentenced to just over seven years in prison for defrauding JPMorgan Chase. The bank acquired her company for $175 million in 2021.
The FTC is taking action against the anonymous messaging app Sendit for unlawfully collecting personal data from children, misleading users with messages from fake “people,” and tricking consumers into purchasing paid subscriptions by falsely promising to reveal the senders of anonymous messages.
A “finfluencer” in Alberta, Canada, has been hit with an almost CAD$42,000 ($30,000) fine for providing financial advice to over 50,000 followers without disclosing conflicts of interest. James Domenic Floreani, who operated on YouTube, Facebook and Instagram under the name Jayconomics, promoted four companies — Tenet Fintech Group, Gold Mountain Mining Corp, Levitee Labs and Sekur Private Data — over two years without revealing that the posts were sponsored. “Floreani presented himself as knowledgeable and sophisticated in finance and investment, demonstrating familiarity and competence with the relevant terminology, but in reality, he did not have any formal education in finance or investing,” the Alberta Securities Commission noted.
// Consumer rights
Revolut has once again topped the Financial Ombudsman Service (FOS) in fraud and scam complaints, according the Which? in the UK. In 2024, customers of the e-money provider referred 3,242 APP (Authorised Push Payment) fraud cases—more than any bank. Monzo came second with 2,344 complaints, followed by Barclays with 1,704.
// In other news
McDonald’s is bringing back Monopoly for the first time since the ‘McMillions’ scammer was exposed for stealing $24 million in prizes. This fan-favourite promotion returns after nearly 10 years away, having been shelved following the exposure of one of the biggest frauds in corporate marketing history. (Nick Lichtenberg / Fortune)
Chat Control Is Back on the Menu in the EU. It Still Must Be Stopped. Chat Control is a dangerous legislative proposal that would make it mandatory for service providers, including end-to-end encrypted communication and storage services, to scan all communications and files to detect “abusive material.” (Thorin Klosowski/EFF)
Note: This article was updated 03/10/25 at 9:07 GMT to include a response from Multiverse regarding their (lack of) involvement in the UK digital ID scheme.
Get this newsletter straight to your inbox every week by subscribing. If you can, consider supporting Scamurai with a paid subscription.
Tips, vitriol and all other messages should be directed to Callan Quinn at callan@scamurai.io. Or get in touch below.