{"id":779,"date":"2026-06-02T00:36:55","date_gmt":"2026-06-02T00:36:55","guid":{"rendered":"https:\/\/quantusintel.group\/osint\/blog\/2026\/06\/02\/ghosts-of-ayala\/"},"modified":"2026-06-02T00:36:55","modified_gmt":"2026-06-02T00:36:55","slug":"ghosts-of-ayala","status":"publish","type":"post","link":"https:\/\/quantusintel.group\/osint\/blog\/2026\/06\/02\/ghosts-of-ayala\/","title":{"rendered":"Ghosts of Ayala"},"content":{"rendered":"
\"\"<\/figure>\n

How Chinese and Vietnamese cyber-fraud syndicates rebuilt the POGO economy inside Makati\u2019s condominium towers, eighteen months after the law banned them \u201cout of existence\u201d.<\/h3>\n

A note before the reporting begins. I live in Salcedo Village, in the middle of the Makati CBD. At five in the morning, before the rest of the city wakes, the shift changes are visible from the sidewalks, vans idling with their engines on, workers in lanyards moving in groups of six or eight into and out of specific residential towers, Mandarin and Vietnamese in the air at an hour when the streets should be empty. The buildings are named. The leases are signed. The police cars pass. And as part of my own OSINT and investigative work, the evidence, wallet trails, infrastructure pivots, registration records, not seldom resolves to addresses inside this same district, sometimes within walking distance of my front\u00a0door.<\/p><\/blockquote>\n

In the official record of the Philippine state, the Philippine Offshore Gaming Operator industry no longer exists. Executive Order 74, issued by President Ferdinand Marcos Jr. on November 5, 2024, ordered every licensed POGO and Internet Gaming Licensee to cease operations by December 31 of that year. Republic Act 12312, the Anti-POGO Act of 2025, signed into law on October 23 last year, made the prohibition permanent. The Act repealed RA 11590, the Duterte-era statute that taxed and authorized offshore gaming, and criminalized not only the operation of such enterprises but the supply of equipment, the leasing of property, the registration of dummy entities, and the supply of false identification used to staff them. PAGCOR, by its own chairman Alejandro Tengco\u2019s count, the regulator had issued 298 licenses at the industry\u2019s 2019 peak, of which only 48 remained legitimate by late 2024, was stripped of the authority to ever again license such an operation. By the time the Department of Justice was discussing implementation publicly in early 2026, the institutional position was unambiguous: the hubs had been dismantled.<\/p>\n

The institutional position is not wrong, exactly. It is incomplete in a way that the institutions themselves now acknowledge. On April 22, 2026, Executive Secretary Ralph Recto convened a ceremony at Malaca\u00f1ang to sign an inter-agency Standard Operating Procedure consolidating enforcement of EO 74 and RA 12312 under a single framework covering intelligence, raids, evidence handling, prosecution, and asset preservation. The SOP exists because the legal regime, by itself, has not been sufficient. Recto\u2019s own framing was that the syndicates are now \u201cevolving,\u201d and that the work has shifted from shutdown to interdiction, \u201cpreserving assets, seizing illicit resources, securing convictions, protecting victims, and cutting these criminal enterprises off from the financial and corporate networks that sustain them.\u201d Translated out of bureaucratic register: the operators did not leave. They reorganized.<\/p>\n

What follows is an account of that reorganization, drawn from the public record of raids conducted between March 2025 and February 2026, from the documented arrest demographics released by the Criminal Investigation and Detection Group (CIDG), the Presidential Anti-Organized Crime Commission (PAOCC), the Bureau of Immigration (BI), and the National Bureau of Investigation (NBI), from Colliers Philippines and Leechiu Property Consultants data on the commercial real estate aftermath, from the November 2025 conviction of former Bamban mayor Alice Guo on human trafficking charges, and from the July 2025 report of the U.S.-China Economic and Security Review Commission. The pattern is consistent across all of these sources. The POGO economy in Makati did not die. It splintered, miniaturized, decentralized into condominiums and shell companies, and, in a development that the 2024 enforcement architecture was never designed to handle, went digital in ways that local law enforcement cannot easily\u00a0follow.<\/p>\n

I. The Splinter\u00a0Effect<\/h3>\n

The pre-ban POGO geography was visible. At its 2019 peak, Colliers Philippines estimated that POGO-related operations occupied roughly 1.3 million square meters of office space in Metro Manila, or roughly 11 percent of the total office supply, with the Bay Area, Alabang, and Makati Central Business District absorbing the bulk of the demand. These were not discreet operations: they were leased floors and entire buildings, staffed by visa-holding foreign nationals in declared numbers, with corporate signage and PAGCOR accreditation numbers displayed. The compounds, particularly the rural ones in Bamban, Tarlac and Porac, Pampanga, were self-contained, dormitories, kitchens, surveillance perimeters, guard towers, and were, in the most documented cases, also sites of forced labor. In March 2024, PAOCC raided the Zun Yuan Technology Inc. compound in Bamban, the facility tied to Alice Guo, and rescued more than 800 workers, the demographic breakdown of which included 432 Chinese, 371 Filipino, 57 Vietnamese, and smaller numbers of Malaysian, Taiwanese, Indonesian, and Rwandan nationals; the warrant had been issued after Malaysian diplomats reported that one of their nationals had been tortured, including by electrocution, inside the compound. On June 4, 2024, PAOCC dismantled the sprawling Lucky South 99 Outsourcing Inc. complex inside the Royal Garden Estate at the Porac, Angeles boundary in Pampanga, a 46-building site with villas and a golf course, and rescued 186 foreign and Filipino workers. The Lucky South 99 investigation, later documented in detail by the Inter-Agency Council Against Trafficking and in a Senate inquiry led by Senator Sherwin Gatchalian, established a debt-bondage trafficking pipeline in which Chinese gambling losers in Metro Manila casinos were loaned money, allowed to lose it at mahjong tables, and then sold to the POGO for labor at a premium above the unpaid debt. One rescued Chinese worker had been sold after losing a P450,000 mahjong loan. Two victims were found with confirmed torture injuries; torture devices were recovered on the premises. Lucky South 99\u2019s incorporators were subsequently linked back to Zun Yuan Technology, a connection that would later anchor the Department of Justice\u2019s understanding of the two compounds as branches of a single\u00a0network.<\/p>\n

What EO 74 accomplished, and what RA 12312 institutionalized, was the destruction of this visible geography. The compounds were raided, the licenses cancelled, the leases broken. Colliers and Leechiu have since documented the commercial consequences: Bay Area residential vacancy stood at 57.3 percent in the fourth quarter of 2025, driven almost entirely by the POGO exit; Metro Manila average office vacancy was 19.4 percent at the end of 2025, easing only marginally to 19 percent by the first quarter of 2026, the highest sustained level in over a decade; office rents in CBDs that had peaked near P1,500 per square meter have normalized lower, with landlords offering concessions of three to thirty percent. Makati CBD, less POGO-dependent than the Bay Area but still affected, has been spared the worst of the vacancy crisis by absorbing demand from government agencies, banks, and IT-BPM tenants, the traditional occupiers whom POGO money had displaced for a\u00a0decade.<\/p>\n

The visible economy disappeared. The underlying business, staffed by trafficked labor, financed by cryptocurrency flows, targeting victims overseas, did not. It miniaturized.<\/p>\n

The mechanics of the miniaturization are visible in the 2025 and 2026 raid records. On March 19, 2025, a PAOCC-CIDG team executing a robbery arrest warrant at Flying Future Services Inc., on the 21st floor of Yuchengco Tower 1 at RCBC Plaza in Makati, was tipped off by a foreign national inside the building and uncovered an illegal POGO operation running through three sub-companies, Intech World, Omniach, and Urban Ideas, each registered to a different alias-using Chinese boss. The raid produced 131 arrests, 96 of them foreigners: 58 Chinese, 13 Malaysian, 12 Taiwanese, 8 Japanese, 2 Vietnamese, 1 Mongolian, 1 Brazilian, and a citizen of St. Kitts and Nevis. Flying Future was, on paper, a software development company.<\/p>\n

On April 10, 2025, the CIDG and BI Fugitive Search Unit raided 100 West Condominium on Sen. Gil Puyat Avenue, acting on a mission order targeting a Chinese national suspected of human trafficking. The trigger was a distress message from a Chinese worker, smuggled out to a Filipina friend, alleging illegal detention. The operation netted 86 foreign nationals, 82 Chinese, three Vietnamese, one Malaysian, and a shell called Sales Street Online-Gaming Supported Provider running scams disguised as e-commerce. On February 23, 2026, the NBI and BI raided a residential unit on Estrella Street, Makati, and arrested six South Korean nationals running a game-fixing and scam operation targeting Korean victims, seized eight personal computers, multiple mobile devices, and several One-Time Password generators. In the same week, NBI-NCR served search warrants on a scamming hub in Muntinlupa and seized further digital evidence.<\/p>\n

A different category of raid tells a more revealing story: the empty one. In early March 2025, a joint PAOCC-DOJ-CIDG team raided several floors of PBCom Tower on Ayala Avenue, the heart of the Makati CBD, based on intelligence that 21 companies operating in the building under different corporate names and ownership were in fact a single POGO. They arrived to find empty workstations, computers still warm, half-eaten meals, scattered scam scripts, abandoned company phones and SIM cards. The estimated 600 workers had been gone for hours. CIDG director Maj. Gen. Nicolas Torre III acknowledged the obvious in the post-raid press conference: someone had tipped them\u00a0off.<\/p>\n

The Makati of 2026 is built on this pattern. The footprint is small: a condominium unit, often in Salcedo Village and Legaspi in the older but very spacious units, sometimes a floor in a B-grade commercial tower, sometimes a co-working space leased under a shell registration. The corporate front is a registered Philippine entity, a software company, a BPO, an insurance brokerage, an e-commerce or \u201cfintech\u201d startup, with a clean SEC filing, a Filipino incorporator, and a serviced address. The workforce is small enough to evacuate in under two hours. The hardware is portable. The leases turn over fast. Where the pre-ban model concentrated risk, the post-ban model distributes it. Where the pre-ban model was easy to find, the post-ban model is easy to\u00a0abandon.<\/p>\n

II. The Chinese-Vietnamese Nexus<\/h3>\n

Across the verifiable arrest data from PAOCC, CIDG, NBI, and BI operations between 2024 and 2026, two foreign nationalities recur with structural consistency: Chinese and Vietnamese. The pattern is hierarchical. Chinese nationals dominate ownership, management, and the technical layers, the cryptocurrency wallets, the platform engineering, the deepfake infrastructure, the relationships with offshore handlers. Vietnamese operatives appear most often in the middle tiers, frequently handling regional scripting for markets where a Mandarin-speaking handler would be a giveaway. In the documented raids that yielded mixed-nationality arrests, Flying Future at RCBC Plaza, 100 West on Gil Puyat, the Zun Yuan compound in Bamban, and the Lucky South 99 complex in Porac, Chinese numbers run three to five times those of any other foreign nationality. Vietnamese arrest counts are smaller, but their operational role is disproportionate to their headcount.<\/p>\n

Filipinos are present in three distinct functions, none of them strategic. The first is front-end recruitment: legitimate-looking job ads on Facebook and informal referral networks in Pasay, Caloocan, and Quezon City pull in younger workers as customer service or \u201conline support\u201d staff who, once inside the operation, perform the social-engineering or first-contact functions where a local face or voice is required. The second is paperwork: Filipinos serve as incorporators of the shell companies, as registered owners of leases and SIM cards, as the names on the bank accounts that receive crypto-to-fiat off-ramp transfers. Some are willing fronts; others are identity-theft victims. In the Hongsheng POGO case being litigated in 2026, Filipino market vendors have testified that their identities were appropriated without their knowledge to register the entity. The third function is protective: bribed property managers, complicit barangay officials, lower-tier law enforcement contacts.<\/p>\n

The reference case for how this stack works at scale remains the conviction of Alice Guo, the dismissed mayor of Bamban, Tarlac, sentenced to life imprisonment on November 20, 2025 by the Pasig Regional Trial Court for qualified human trafficking. Guo, whom Philippine investigators identified as Guo Huaping, a Chinese national who entered the country as a child and acquired fraudulent Filipino documentation, incorporated the real estate firm Baofu, which leased the seven-hectare scam compound directly behind her municipal hall. Her business partner was Huang Zhiyang, a Chinese gang figure wanted in his home country. The compound was forfeited to the government at an estimated value of six billion pesos, one of the largest forfeitures in Philippine history. The structural lesson of the Guo case is not that a single mayor was corrupt. It is that a Chinese national was inserted into the Filipino political class with fraudulent documentation, that the corporate vehicle was registered cleanly through the Philippine system, that the property was held through a Filipino-fronted entity in a manner that the Anti-Dummy Law (Commonwealth Act 108) was specifically designed to prohibit, and that none of the existing safeguards, SEC scrutiny, civil registry verification, COMELEC candidacy review, Anti-Money Laundering Council monitoring, caught any of it before the syndicate began operating.<\/p>\n

Behind the operators sits a supply chain. Elliptic, the blockchain forensics firm, has documented in its 2025 reporting the emergence of Chinese-language \u201cguarantee marketplaces\u201d, vertically integrated wholesalers that sell pre-built scam platforms, victim datasets, money-laundering services, AI-generated deepfake assets, synthetic identity documents, and live deepfake KYC bypass services to syndicate buyers across Southeast Asia. The Makati operations are downstream consumers, not architects. The architecture sits offshore, and the architects are not Filipino.<\/p>\n

III. The 2026 Tech\u00a0Playbook<\/h3>\n

The change in tooling between the pre-ban POGO and the post-ban Makati operation is more consequential than the change in geography. The 2019 POGO sold predominantly online gambling to Mainland Chinese clients via call centers. The 2026 Makati hub runs pig-butchering\u00a0, long-form romance-and-investment scams in which a victim is groomed for weeks or months on dating apps, LinkedIn, or encrypted messaging platforms, then steered into a fraudulent crypto trading platform that displays fabricated profits, allows small early withdrawals to cement the sunk-cost illusion, and then snaps shut when the victim attempts a real liquidation. The model is industrialized in three phases, grooming, fattening, slaughter, and each phase has been transformed by generative AI.<\/p>\n

Industry analysts and blockchain forensics teams tracking 2026 syndicate behavior describe the deployment of agentic AI to maintain thousands of personalized \u201crelationships\u201d simultaneously. Large language models, both commercial systems used adversarially and illicit variants such as WormGPT and FraudGPT, have eliminated the grammar tells that once exposed Southeast Asian operators to English-speaking targets. Deepfake voice and video tools have advanced to the point where live video verification, once the victim\u2019s last defense, no longer disqualifies the scammer. The Arup engineering firm deepfake in early 2024, in which a finance employee was tricked into wiring $25 million by AI-rendered \u201cexecutives\u201d on a Zoom call, is no longer an outlier. It is a published proof of concept now circulating through the guarantee-marketplace supply chain. Sumsub, the identity verification firm, found in its 2025\u20132026 Identity Fraud Report that deepfakes now account for roughly 11 percent of all first-party fraud schemes globally, placing them on par with money-mule activity and just behind synthetic identity fraud, chargeback abuse, and application fraud.<\/p>\n

The structural enablers on the Philippine side have not been hardened in any meaningful way. RA 11934, the SIM Registration Act, was passed in 2022 as a cybercrime countermeasure. It has not functioned as one. The PNP Anti-Cybercrime Group has testified that the registration system can be defeated by absurdly fake credentials, that documented individuals have been linked to as many as 600 registered SIMs each, and that 608 individuals were arrested between December 2024 and June 2025 for selling pre-registered SIM cards. The law\u2019s design flaw is more fundamental than these implementation failures, however: a substantial share of scam SMS traffic in Metro Manila is no longer sent through registered SIMs at all. It is broadcast directly to handsets in range of IMSI catchers, \u201cstingrays,\u201d rogue cellular base stations, and rogue access points, many of them small enough to fit inside a backpack or the trunk of a car, and operated in transit through densely populated commercial corridors. The technique bypasses the carrier network entirely; the SIM Registration Act, by design, governs only what passes through the carrier network. Encrypted messaging platforms and foreign-origin SIMs sit entirely outside the law\u2019s reach. Crypto off-ramps have shifted from centralized exchanges, which have improved their KYC practices, toward decentralized exchanges, cross-chain bridges, and permissionless DeFi protocols that no Philippine subpoena can reach. The Anti-Money Laundering Council can freeze a domestic bank account; it cannot freeze a self-hosted wallet pooling victim deposits.<\/p>\n

IV. The Cat-and-Mouse Game<\/h3>\n

The Philippine enforcement architecture is, in formal terms, robust. The Presidential Anti-Organized Crime Commission, established in 2021 and expanded under the Marcos administration, coordinates with the CIDG, the NBI Cybercrime Division, the BI Fugitive Search Unit, the Anti-Money Laundering Council, and local police. The April 2026 Recto SOP integrates these agencies under a single framework. Charges available include violations of RA 12312, the Expanded Anti-Trafficking in Persons Act (RA 9208 as amended by RA 10364 and RA 11862), the Cybercrime Prevention Act (RA 10175), Presidential Decree 1602 on illegal gambling, the Anti-Money Laundering Act (RA 9160), and immigration law.<\/p>\n

The operational record, however, is one of structural lag. The PBCom Tower raid found empty workstations because the operation was tipped off; the same has occurred repeatedly. Intelligence developed on a Monday can be operationally stale by Friday. A raid yields hardware that is encrypted, bodies that are mid-tier or trafficked, and a money trail that has already moved to a non-cooperative jurisdiction through self-hosted wallets. Mid-level operatives, even foreign ones, are deported rather than prosecuted to conclusion: the BI deported 23 Chinese linked to illegal POGO and cyber fraud activity on a single Philippine Airlines flight to Shanghai Pudong on November 21, 2025. Conviction of high-value operators is rare. Alice Guo\u2019s conviction is genuinely a landmark precisely because it is so unusual. The architects upstream of the Makati cells remain offshore, untouched by any Philippine prosecution.<\/p>\n

Cooperation with the upstream jurisdictions is politically constrained. The U.S.-China Economic and Security Review Commission report of July 2025 documents Philippine intelligence findings, made public by Senator Risa Hontiveros, that scam compounds in the Philippines have been used for surveillance and hacking activity, that sophisticated listening equipment was seized in raids near Clark Air Base and Basa Air Force Base\u200a\u2014\u200aboth EDCA sites with U.S. access, and that evidence of Chinese state-sponsored hackers operating out of scam compounds has been recovered. The Diplomat reported in November 2025 that the Philippines, in regional comparison, has produced the most successful enforcement against scam-center economies, and that the Philippine enforcement, by the same comparative measure, has still left the upstream structures intact. The unresolved tensions in the West Philippine Sea make a deep bilateral enforcement framework with Beijing politically infeasible. Hanoi\u2019s interest in its own nationals is\u00a0uneven.<\/p>\n

V. The Geometry of\u00a0Failure<\/h3>\n

The conclusion that emerges from the data is not that Philippine enforcement is incompetent or that the legal regime is weak. RA 12312 is, by regional comparison, the strongest such statute in Southeast Asia. PAOCC has conducted more raids, secured more arrests, deported more foreign nationals, and forfeited more assets than any comparable agency in Cambodia, Laos, or Myanmar. The April 2026 inter-agency SOP is a serious administrative instrument. The conviction of Alice Guo is a serious deterrent precedent.<\/p>\n

What the data shows is that the post-ban Makati syndicate model is built on the assumption that all of this will happen, and that none of it is sufficient. The model is built to absorb periodic raids. It is built to lose the bottom tier of operators to deportation. It is built to write off seized hardware. The economics work because a leased two-bedroom unit, a stack of pre-registered SIM cards bought from a registration syndicate, a thousand-dollar generative AI subscription, and ten trafficked workers from a Chinese-language guarantee marketplace produce enough pig-butchering revenue per quarter to capitalize three replacement cells in three different Makati towers before law enforcement closes the first one. The infrastructure layer, Anti-Dummy Law loopholes, SIM Registration Act failures, the absence of effective AML reach into self-hosted wallets, the diplomatic difficulty of upstream cooperation, the labor surplus produced by trafficking flows from Vietnam, Cambodia, and Mainland China, is\u00a0intact.<\/p>\n

A POGO industry can be banned. The infrastructure it ran on cannot be banned, because the infrastructure is not itself illegal. It is the misuse of legal commercial real estate, legal corporate registration, legally registered SIM cards, and legal AI services. Until the underlying enablers are reformed, until the SIM Registration Act is rebuilt with real-time identity validation and<\/em> paired with a credible legal and technical regime against IMSI catchers and rogue base stations, until the Anti-Dummy Law is enforced against the Chinese capital that quietly controls Filipino-fronted SPVs, until self-hosted crypto wallets are within reach of AMLC freezing authority, until property managers who lease to dummy entities face the same criminal exposure as the operators themselves, until upstream enforcement cooperation can be detached from the West Philippine Sea, the towers of Ayala Avenue will continue to glitter, and behind some statistically inevitable fraction of their lighted windows, the work will continue.<\/p>\n

The POGOs are not coming back. They do not need to. Their afterlife is already operational.<\/p>\n

Sources<\/h3>\n

Legal and regulatory framework<\/h3>\n

Executive Order \u211674<\/strong> (Marcos, signed November 5, 2024; publicly released November 8, 2024). Bans all Philippine Offshore Gaming Operators, Internet Gaming Licensees, and offshore gaming services; mandates cessation by December 31,\u00a02024.<\/p>\n