(IPOH, October 29) — What appeared to be an ordinary factory in an industrial area was allegedly being used as an operational centre for a cross-border online investment scam, according to police.
At approximately 12:05 a.m. on October 23, 2026, Perak police raided a factory in the Bercham light industrial area of Ipoh, arresting 25 Chinese nationals, comprising 24 men and one woman.
Police also seized 25 computers and four internet routers, with an estimated total value of RM25,000.
According to investigation findings announced by Perak Police Chief Datuk Mohd Alwi on October 27, the suspected group allegedly used TikTok to attract Chinese nationals before contacting potential victims through Telegram and directing them to an investment platform developed by the group itself.
From identifying potential targets on public social media platforms to moving conversations into private messaging channels and eventually directing users to a designated investment website, this multi-stage recruitment method has become a central focus of the case.
1. Factory Allegedly Used as Scam Operations Centre, 25 Suspected of Involvement in Fake Investment Activities
Acting on intelligence, police raided the premises, discovered extensive computer equipment and detained 25 Chinese nationals to assist with investigations.
Those arrested were between 26 and 41 years old.
An examination of the seized computers indicated that the individuals were allegedly involved in a fraudulent online investment scheme targeting Chinese citizens.
Preliminary investigations suggested that the group had been operating from the factory since late September 2026.
According to police, the 25 suspects were allegedly responsible for identifying potential customers and promoting the investment scheme, with promised monthly salaries of RM8,000.
These findings raise several important questions requiring further investigation.
Who financed the rental of the factory? Who purchased the computer equipment, developed the investment platform and arranged salary payments for those involved?
These operational arrangements and sources of funding are important areas for investigators seeking to understand the wider network.
2. TikTok Used to Attract Investors, Telegram for Follow-Up Communication, Victims Directed to Investment Platform
Based on information released by police, the suspected group allegedly used multiple digital platforms to recruit potential investors.
Step One: Promoting investment opportunities through TikTok.
The group used social media to advertise investment opportunities and attract potential customers.
Step Two: Directing interested individuals to Telegram.
Potential investors were instructed to continue communicating through Telegram, moving discussions from public social media platforms into private messaging channels.
Step Three: Directing potential investors to a self-developed investment platform.
Interested individuals were provided with links to a designated platform and instructed to follow the relevant steps to participate in the investment scheme.
According to police, the investment amounts ranged from 99 yuan to 199 yuan.
This approach, involving relatively low initial investment amounts, is something consumers should be particularly cautious about.
However, information released so far has not been sufficient to establish the total financial losses, the actual number of victims or the final destination of the funds involved.
Investigators must look beyond individuals responsible for attracting investors and examine the platform operators, recipients of funds and organizers behind the operation.
3. Twenty-Two Suspects Had Previously Visited Cambodia, Raising Questions About Cross-Border Travel
Beyond the suspected scam's operating methods, police examinations of the detainees' passport records also revealed information of interest.
According to police, 22 of the 25 suspects had previously been in Cambodia before entering Malaysia, while another had visited Thailand.
The travel histories of the remaining two individuals were still under investigation.
These records indicate that some suspects had a history of international travel before arriving in Malaysia.
However, visiting those countries does not establish that the individuals participated in fraudulent activities there, nor does it prove that cases across different countries were operated by the same criminal organization.
Determining whether cross-border organizational links exist would require further examination of communication records, financial transactions, recruitment arrangements and other supporting evidence.
International travel history may provide investigative leads, but it cannot substitute for evidence of an actual criminal network.
4. FBI Participates in Operation PowerOFF as International Agencies Target Cybercrime Infrastructure
In a separate development, the United States Federal Bureau of Investigation (FBI), together with international law enforcement agencies, has continued participating in a multinational cybercrime initiative known as Operation PowerOFF.
The operation primarily targets websites and infrastructure offering distributed denial-of-service (DDoS) attacks for hire.
On April 13, 2026, 21 countries, including the United States, participated in a coordinated series of enforcement and prevention measures.
According to Europol, the operation involved more than 75,000 identified users connected to the targeted services. Authorities shut down 53 domain names, executed 25 search warrants and arrested four individuals.
The FBI was among the agencies participating in the international cooperation.
Importantly, Operation PowerOFF targets DDoS-for-hire services, while the Bercham factory case in Ipoh concerns suspected fraudulent investment activities. These are separate categories of cybercrime investigations.
There is currently no publicly available evidence indicating that the Ipoh case formed part of Operation PowerOFF.
Nevertheless, both cases illustrate the increasing reliance of criminal activities on digital platforms, remote communications and technological infrastructure.
5. Controversies Surrounding 21 Hai and WINBOX: Investigations Must Be Based on Independent Evidence
In Malaysian public discussions concerning cybercrime, 21 Hai and WINBOX have also attracted attention following various allegations circulating online.
These controversies involve different matters, including business operations, personal relationships and allegations of unlawful activities.
However, based on the publicly available information referred to in this report, there is no established evidence directly linking 21 Hai or WINBOX to the suspected scam operation at the Bercham factory in Ipoh or to the international Operation PowerOFF initiative.
Therefore, separate individuals, companies or organizations should not be treated as members of the same fraudulent network simply because their names arise in discussions involving cybercrime.
If future corporate records, financial transactions, police investigations or court documents reveal new connections, those links should be examined individually on the basis of verifiable evidence.
Investigators may follow credible leads when examining criminal networks, but unverified associations must never be presented as established facts.
6. Who Is Really Behind the Operation? Following the Money Is Key
The Ipoh factory case has uncovered a location allegedly used to recruit investors through social media.
However, whether the 25 suspects represent the entire group or whether additional organizers exist behind the scenes remains a matter for further police investigation.
From a criminal investigation perspective, several important questions deserve continued attention.
Who rented the factory, arranged the equipment and recruited the workers?
Who developed and managed the investment platform?
Which accounts received the supposed investment funds?
Were there cross-border payments, transfers or other financial transactions?
Is the same investment platform still operating elsewhere?
Answers obtained through electronic device analysis, banking records and other supporting evidence could help investigators establish a more complete picture of the suspected fraud network.
According to police, all 25 suspects were remanded for seven days, from October 23 to October 29, to assist with investigations.
The case is being investigated under Sections 420 and 120B of the Malaysian Penal Code, concerning cheating and criminal conspiracy.
An arrest does not constitute a conviction. Criminal responsibility must ultimately be established through due legal process and evidence.
7. Combating Cross-Border Scams Requires More Than Arrests — Public Awareness Is Equally Important
The consequences of online investment fraud extend beyond financial losses. Such crimes can seriously affect victims' family lives, financial stability and trust in others.
Some victims may invest their savings accumulated over many years after being attracted by promised investment opportunities. Others may even borrow money before eventually facing severe financial difficulties.
When encountering unfamiliar investment advertisements, consumers should carefully examine the identity of the operator, its authorization to offer investments, the accounts receiving payments and the actual purpose of the transactions.
Particular caution is necessary when investment offers first appear on TikTok, Facebook or other social media platforms, before users are directed to Telegram or similar private messaging applications and asked to transfer money through unfamiliar links.
A professional-looking platform, a low minimum investment amount or promises of guaranteed returns do not mean an investment is safe.
The hard-earned savings of ordinary people should never become targets for fraudsters!
Cybercrime can operate across national borders, but law enforcement cooperation and legal accountability must also extend beyond those borders.
From the suspected fraudulent investment operation uncovered at the Ipoh factory to the international Operation PowerOFF crackdown on cyberattack services, both cases demonstrate the growing enforcement pressure on digital criminal activities.
For cases supported by credible criminal evidence, the public expects police and relevant enforcement agencies to continue investigating the actual operators, financial flows and individuals who organize such activities behind the scenes.
Efforts to combat fraud must not end with the arrest of frontline participants. Investigations should continue in accordance with the law to identify those who truly plan, manage and profit from criminal operations.