AFP logo at EBB Canberra

Four men charged in Sydney for sophisticated cyber scam - world-wide losses expected to top US$100 million

09 December 2022, 7:26am
Media Release

Four men charged in Sydney for sophisticated cyber scam - world-wide losses expected to top US$100 million

Editor’s Note: Vision of the search warrant in Pyrmont and audio grabs from AFP Detective Sergeant Salam Zreika are available via Hightail.

Four Chinese nationals living in Sydney have been charged as part of an investigation into an organised criminal syndicate involved in a cyber-enabled investment scam that has resulted in more than US$100 million in losses world-wide.

The four men, aged 27, 24, 19 and 19, have been charged with proceeds of crime related offences, and are scheduled to next appear in Downing Centre Local Court in January 2023.

The highly-sophisticated scam involves the unlawful manipulation of legitimate electronic trading platforms, normally licensed to foreign exchange brokers who then provide the software to their clients.

The United States Secret Service (USSS) notified the AFP-led Joint Policing Cybercrime Coordination Centre (JPC3) about Australian links to the predominantly US-based scam in August 2022. AFP Cyber Command then began a parallel investigation – codenamed Operation Wickham – in cooperation with an investigation by the New South Wales Police Force.

The results of this investigation have so far resulted in the AFP-led Criminal Assets Confiscation Taskforce restraining $22.5 million in 24 bank accounts allegedly linked to the criminal syndicate. Investigations into the true scope of the fraud on potential Australian victims are ongoing.

The organised crime syndicate employs a sophisticated mix of social engineering techniques, including the use of dating sites, employment sites and messaging platforms to gain the victim’s trust before mentioning investment opportunities.

The victims are then directed to both fraudulent and legitimate investment applications that deal in foreign exchange and cryptocurrency, which have been maliciously manipulated to show a false positive return on investments.

The syndicate recruits victims to subscribe to a financial investment service, and manipulates the data provided through the legitimate application to encourage further investment, while concealing the fact their money has actually been stolen.

An analysis of victim reports by police has identified more than US$100 million in losses world-wide attributed to this organised crime syndicate, with the majority of victims being based in the United States.

AFP Cybercrime Operations Eastern Command investigators identified the syndicate was using Chinese nationals living in Australia, predominantly students, to undertake a variety of activities to build the infrastructure required to facilitate their fraudulent activities.

It will be alleged in court the four people arrested were used to register Australian companies with the Australian Securities and Investments Commission (ASIC), to enhance the legitimate appearance of fraud efforts, and also establish Australian business bank accounts to launder the proceeds of crime.

Investigators from NSW Police and AFP Cybercrime Operations Eastern Command executed a search warrant at the residence of two Chinese nationals in Pyrmont on Thursday, 20 October 2022. NSW Police officers charged the men, both 19, with one count each of recklessly dealing with proceeds of crime, contrary to section 193B(3) of the Crimes Act 1900 (NSW).

Two further Chinese Nationals alleged to be Australian ‘controllers’ of the syndicate were arrested by AFP investigators on Thursday, 24 November 2022, at Sydney and Melbourne Airports while attempting to leave Australia on flights to Hong Kong, which had been purchased as one-way tickets.

Two men, aged 27 and 24, were each charged with one count of dealing in proceeds of crime etc.—money or property worth $10,000,000 or more, contrary to section 400.2B(4) of the Criminal Code (Cth). The maximum penalty for this offence is 15 years’ imprisonment.

AFP Cybercrime Operations Eastern Command Detective Sergeant Salam Zreika said greater numbers of people are falling victim to these types of cyber-enabled scams every day and, in some instances, losing their life savings.

“It is essential people exercise the utmost caution if cold-approached online or on the phone by people trying to sell financial or investment services. Criminals are ruthless and will stop at nothing to take your money,” she said.

“Refrain from investing in foreign exchange, crypto-currency or speculative investments with people you’ve only ever encountered in the online environment. If you are unsure, get a second opinion from a professional, in-person.”

Det-Sgt Zreika said criminals in Australia are using a network of remittance businesses controlled by overseas shadow entities to offset the value of criminal funds, enabling the movement of illicit cash in Australian dollars overseas.

The AFP-led CACT is targeting similar alleged activity in this matter by obtaining restraining orders in the NSW Supreme Court for over 24 bank accounts relating to Operation Wickham, which hold a mixture of Australian and foreign currency totalling about $22.5 million.

NSW Police Sydney City Police Area Commander, Detective Superintendent Martin Fileman, said scams are becoming increasingly sophisticated, with many of the victims were among the most vulnerable in the community.

“The people behind these scams have zero concern for those members of the community who may have lost their lifesavings or have been financially crippled. People need to take extra care need to protect themselves: the old adage, if it sounds too good to be true, it probably is,” he said.

US Secret Service Attaché Ike Barnes said, “this joint investigation between the Australian Federal Police and the US Secret Service is a prime example of collaboration in law enforcement’s effort to combat transnational organized criminal organizations attempting to exploit international boundaries in the hope of avoiding detection and arrest”.

The two men arrested last week have been remanded in custody to re-appear before Downing Centre Court on 18 January 2023. The two 19-year-old men are next scheduled to appear in Downing Centre Local Court on 19 January 2023.

Victims of cybercrime can report to police using Report Cyber at

Media enquiries

AFP Media: (02) 5126 9297

Connect with us: Follow our Facebook, Twitter, LinkedIn, Instagram and YouTube pages to learn more about what the AFP does to keep Australia safe.