top of page
Image by KOBU Agency

CAMBODIA Scorecard

Cambodia is a high-threat, low-trust environment from a cybercrime and scam-compound perspective. While formal cyber and data laws are emerging, implementation is widely criticized, and authorities are accused of enabling or tolerating fraud factories that underpin global pig-butchering operations.

​

For defenders and policymakers, Cambodia is less about classic APT risk and more about being a global source of fraud, laundering, and human-trafficking-linked cyber operations. Any regional threat model or SEA cyber report that omits Cambodia’s scam-compound role is incomplete.

​

            High-risk, low-maturity environment that has become a global epicenter for scam compounds and trafficking-linked cybercrime

​

Cyber Maturity                                     3/10                                                        Draft laws and institutions exist, but governance and protections are weak and politicized.

​​

Threat Activity                                     8 /10                                                                        High volume of scam operations, cybercrime, and abuse of local infrastructure.

​

Digital Exposure                                   6/10                                                      Growing mobile/internet use and casino/online sectors but smaller economy than ID/PH.

​

Law Enforcement Capability                3/10                                                                Capable of large raids, but widely accused of selective enforcement and complicity.

​​​​

Geopolitical Risk                                  5/10                Close ties to China and regional tensions; not a frontline military actor but heavily entangled in transnational crime.

​

Scam/Fraud/Trafficking                      9.5/10                                  One of the world’s main hubs for pig-butchering scam compounds and trafficking-enabled cybercrime.

 CYBER MATURITY ASSESSMENT

3/10

Cambodia has drafted a Cybersecurity Law and a personal data protection framework, but these remain contested and incomplete as of 2023-25. Observers worry these tools may be used for surveillance and political control rather than genuine resilience and rights protection.

​

  • Draft Cybersecurity Law aimed at governing Critical Information Infrastructure.

  • Draft data protection law focusing on collection and use of personal data.

  • Existing cybercrime law framework criticized for rights and due-process concerns.

  • Limited transparency on incident reporting or national CERT operations.

  • Net effect: formal structures emerging, but trust and effectiveness are low.

​

​

DIGITAL EXPOSURE

6/10

Cambodia’s economy is smaller, but it has high digitalization in specific verticals—casinos, online platforms, and mobile connectivity. Digital growth increases exposure even without massive national-scale infrastructure.

​

  • Strong mobile and internet growth, particularly in urban and border areas.

  • Heavy use of online platforms for gambling, e-commerce, and messaging.

  • Casino and SEZ infrastructure repurposed for online operations (legit and criminal).

  • Scale is lower than Indonesia/Philippines but deeply leveraged by criminal networks.

GEOPOLITICAL & ECONOMIC DRIVERS

5/10

Cambodia is not a military heavyweight, but its tight relationship with China, involvement in scam centers, and friction with neighbors introduce significant geopolitical risk.

​​

  • Close alignment with China economically, politically, and via criminal networks.

  • Tensions with Thailand over borders, crime, and scam compounds.

  • Deep involvement in transnational organized crime networks.

  • Moderate APT risk, very high crime-driven geopolitical scrutiny.

CURRENT THREAT ACTIVITY

8/10

Threat activity in Cambodia is extremely high, driven not by classic APT state-on-state campaigns but by vast scam centers and transnational organized crime.

​

  • Scam compounds in converted casinos/hotels running global fraud operations.

  • Heavy abuse of local infrastructure for messaging, phishing, and investment scams.

  • Frequent regional law enforcement and international media coverage of cybercrime.

  • Lower visibility of “classic” espionage APTs compared to PH/SG/VN, but cybercrime volume is enormous.

LAW ENFORCEMENT & CYBERCRIME CONTROL

3/10

Cambodia has demonstrated the ability to carry out large-scale raids and mass arrests, but human rights groups argue enforcement is selective and often fails to protect victims of trafficking.

​

  • Recent campaigns arrested over 2,000 people in weeks during anti-scam drives.

  • Yet many compounds remain active and allegedly operate with local complicity.

  • Victims often treated as offenders rather than trafficked persons.

  • Legal framework exists but enforcement is inconsistent and politically constrained.

​

SCAM / HUMAN TRAFFICKING / FRAUD 

9/10

Cambodia is one of the world’s most notorious hubs for pig-butchering scam compounds, with tens of thousands trafficked and billions stolen worldwide.

​

  • Amnesty documented at least 53 scam centers with forced labor, torture, and trafficking.

  • US, UN, and NGOs describe an industrial-scale fraud industry rivaling narco-profits.

  • Victims lured from across Asia and beyond with fake jobs, then forced to scam.

  • Country image increasingly tied to scam compounds and cyber-enabled trafficking.

bottom of page