NBI Mandaluyong Crypto Scam Raid, 15 Individuals Arrested

In a significant victory against rising cyber-enabled financial fraud in the Philippines, agents from the National Bureau of Investigation (NBI) arrested 15 individuals on May 9, 2026, for allegedly operating a sophisticated cryptocurrency investment scam from a condominium unit in Mandaluyong City. The operation highlights the growing threat of organized scam hubs in the country, where foreign and local operatives use advanced digital tools to deceive investors.

The raid, executed by the NBI’s Dangerous Drugs Division (NBI-DDD) in coordination with the NBI-Digital Forensic Laboratory Division and the Philippine Air Force Intelligence Unit, was based on a Warrant to Search, Seize, and Examine Computer Data (WSSECD). Authorities targeted a location linked to an individual known by the alias “Boss Choi,” who reportedly led the network.

Details of the Operation

Agents arrived at the condominium and found the suspects actively working at desktop computers. Those arrested included one Chinese national, one Malaysian national, 12 Filipino males, and one Filipino female. Multiple computer devices were seized on-site and subjected to immediate digital forensic examination.

Forensic analysis revealed critical evidence of computer-related forgery, including tools and data used to create and maintain spoofed websites mimicking legitimate cryptocurrency trading platforms. These fake sites were designed to solicit investments from unsuspecting victims, promising high returns typical of fraudulent schemes.

NBI officials stated that the setup indicated a fully operational scamming network. Suspects were presented for inquest proceedings before the Mandaluyong City Prosecutors Office on charges under Republic Act No. 10175, the Cybercrime Prevention Act of 2012. Specific violations include:

Section 6: Social engineering schemes and economic sabotage.
Section 5(a): Misuse of devices.
Computer-related forgery under Section 4(b)(1).
Aiding or abetting in the commission of cybercrime.

The involvement of foreign nationals raises questions about potential international links, a common feature in Philippine-based scam operations that often target both local and overseas victims.

Understanding the Scam: Spoofed Websites and Investment Fraud

This Mandaluyong bust fits the pattern of “pig butchering” scams, a prevalent form of cryptocurrency fraud. Scammers build trust with victims through social engineering—often via dating apps, social media, or messaging platforms—before directing them to invest in fake crypto platforms.

Victims are shown fabricated dashboards with impressive gains to encourage larger deposits. When withdrawal attempts are made, scammers demand additional fees or taxes, or the platform simply disappears. Funds are typically moved through cryptocurrency mixers or converted quickly to evade tracing.

In this case, the use of spoofed websites allowed the group to appear professional and legitimate. Such platforms often replicate interfaces of established exchanges, complete with real-time charts and support features, all controlled by the perpetrators.

Broader Context: Surge in Crypto Scams in the Philippines

The Philippines has seen a sharp rise in cryptocurrency-related investment scams. Philippine National Police (PNP) data from 2025 reported over 311 investment scam cases, many involving crypto, resulting in substantial financial losses for Filipinos.

Globally, Chainalysis estimates that cryptocurrency scams stole around $17 billion in 2025, with impersonation and fake investment tactics surging dramatically. The Philippines, with its large English-speaking population, young tech-savvy demographic, and growing crypto adoption (driven by platforms like Coins.ph), has become a hotspot for both victims and operators of these schemes.

Previous NBI operations underscore the trend. In 2025, authorities dismantled similar hubs in Pasay and other areas, arresting dozens including foreign nationals. In early 2026, raids in Pampanga and Parañaque targeted other cyber-financial scams. These operations often involve condominiums or villas converted into call-center-like facilities equipped with multiple workstations.

Foreign involvement is notable. Chinese and other Southeast Asian nationals have been linked to scam compounds in Myanmar and Cambodia, with some operations relocating to urban Philippine locations for better infrastructure and anonymity. The Bureau of Immigration has conducted parallel arrests for illegal employment and overstay violations in similar cases.

Impact on Victims and the Economy

While specific victim counts or loss amounts for the Mandaluyong hub have not been publicly detailed, such operations can defraud hundreds or thousands. Victims range from everyday Filipinos to overseas workers lured by promises of quick wealth amid economic pressures.

The psychological and financial toll is severe. Many lose life savings, retirement funds, or borrowed money. Recovery is difficult due to the borderless nature of crypto transactions and jurisdictional challenges.

This scam also undermines legitimate cryptocurrency adoption in the Philippines. The country has embraced blockchain and digital assets, with regulatory efforts by the Bangko Sentral ng Pilipinas (BSP) and Securities and Exchange Commission (SEC) to foster innovation while protecting consumers. High-profile frauds fuel skepticism and calls for stricter oversight.

Law Enforcement Response and Challenges

The NBI’s use of digital forensics and inter-agency collaboration (including military intelligence) demonstrates improving capabilities against cybercrime. However, challenges persist:

Rapid evolution of scam tactics, including AI-generated deepfakes and sophisticated phishing.
Anonymity provided by cryptocurrencies.
Resource constraints for full investigations and international cooperation.
Proliferation of recruitment into scam operations, sometimes involving trafficked individuals.

Authorities urge vigilance. Red flags include unsolicited investment offers, guarantees of high returns, pressure to invest quickly, and platforms without proper regulation.

Tips to Avoid Crypto Investment Scams:

Verify platforms through official regulators (e.g., BSP, SEC).
Research independently; avoid decisions based solely on social proof or “testimonials.”
Never send crypto to unknown wallets or unverified sites.
Use hardware wallets and enable two-factor authentication.
Consult licensed financial advisors.
Report suspicious activity to the NBI, PNP Anti-Cybercrime Group, or BSP.

Looking Ahead

As the case proceeds through the justice system, further details may emerge about the scale of the operation, victim numbers, and any laundered funds recovered. The NBI-DDD continues leading the investigation.

This Mandaluyong raid serves as both a deterrent and a wake-up call. With crypto scams projected to grow, sustained law enforcement pressure, public education, and international partnerships are essential. The Philippines must balance its position as a crypto-friendly nation with robust protections against exploitation.

In the fight against digital fraud, operations like this reaffirm that while technology enables crime, it also empowers authorities to detect, disrupt, and dismantle these networks. Investors should remain cautious: if an opportunity sounds too good to be true, it almost certainly is.