American technology infrastructure is being weaponized at industrial scale to defraud consumers, with U.S. companies playing a central role in what an AP/"FRONTLINE" investigation describes as the globalization of fraud. The Federal Trade Commission estimates these scams cost Americans nearly $200 billion in 2024—a staggering figure that raises hard questions about corporate accountability and the adequacy of voluntary compliance measures.
The investigation reveals a troubling pattern: while public attention focuses on social media platforms where victims encounter scams, the actual machinery of fraud runs through upstream infrastructure controlled by American tech companies and internet service providers. These firms possess the technical capacity to disrupt scammers but lack the financial incentives to do so under current U.S. regulatory frameworks.
The Infrastructure Problem
One in five signals from devices at scam compounds linked to sanctioned entities in Myanmar was carried by a U.S.-registered company, according to AP's analysis of more than 200,000 device connections. No other non-regional country came close. Among the major carriers were Cogent Communications, Oracle, AT&T, and DigitalOcean. These companies claim they cannot monitor content flowing through their networks due to privacy-by-design constraints, yet they simultaneously maintain they respond to abuse reports and cooperate with law enforcement.
The logic presents a familiar tension in tech policy: companies invoke privacy protections to avoid responsibility while simultaneously claiming they're responsive partners in fighting crime. The question becomes whether privacy architecture is a genuine limitation or a convenient excuse for inaction when enforcement costs money.
Starlink, Elon Musk's satellite internet service, remains the number one internet service provider in Myanmar despite Congressional scrutiny and a widely publicized crackdown last fall. The company claimed it cut off 2,500 kits near scam compounds, yet satellite imagery and device data show at least 25 new scam sites have been constructed since then, with at least 13 using Starlink to get online. Starlink declined to respond to detailed questions but has stated it cooperates with law enforcement and remains committed to being "a force for good."
AI Tools at Industrial Scale
OpenAI's ChatGPT and Google's Gemini are being weaponized by scammers operating from compounds in Southeast Asia. The AP identified two suites of software used by scammers that incorporate these AI models, allowing fraudsters to operate across dozens of languages, generate automated replies, develop credible characters, and track employee performance. Blockchain analysis by TRM Labs found that scammers purchasing these tools took in tens of millions of dollars.
OpenAI responded by banning three accounts after AP shared information about their abuse. Google and OpenAI both claim they have "robust programs" to disrupt scammers, yet the investigation found these tools actively enabling industrial-scale fraud. The companies' reactive approach—banning accounts after journalists identified them—suggests their proactive systems aren't sufficiently aggressive.
The Regulatory Gap
Cyber security analysts point to a straightforward market failure: in the United States, the cost of facilitating scamming is zero. Sascha Meinrath, the Palmer chair in telecommunications at Penn State University, stated bluntly: "If there's no disincentive to continuing this, if there's no cost to actually facilitating scamming, then why would I spend a dollar to prevent scamming? This is the problem. It's identifiable, it's addressable — at least somewhat — but it costs something. And right now the cost of facilitating scamming is zero."
Meanwhile, the United Kingdom, the European Union, Australia, and Singapore have introduced regulations requiring companies to prevent scams or face financial penalties. American lawmakers and government officials have been asking tech companies to cooperate on a voluntary basis. U.S. Attorney Jeanine Pirro, who leads a new Scam Center Strike Force, acknowledged the irony: "The amazing part of this tragedy is that the criminals use our own infrastructure to commit the crime."
The investigation found no evidence that these companies were doing anything illegal. However, the patterns of abuse raise serious questions about how vigorously they're enforcing their own terms of service, which explicitly prohibit illegal activity. The distinction matters: legal compliance and contractual enforcement are different standards, and companies appear to be meeting the former while neglecting the latter.
Why This Matters:
This investigation exposes a fundamental problem in American tech regulation: the absence of financial consequences for facilitating crime creates perverse incentives. When companies can carry scam traffic, host scammers' infrastructure, and power their AI tools without bearing costs, they have no rational reason to invest in prevention. The $200 billion annual fraud toll represents a massive transfer of American wealth enabled by American companies operating in a regulatory void. Unlike their international competitors facing statutory penalties, U.S. firms can rely on voluntary cooperation frameworks that have demonstrably failed. The voluntary approach assumes companies will self-regulate out of goodwill—an assumption contradicted by the data showing continued Starlink use by scammers despite public commitments to crackdown, and AI tools actively enabling fraud despite claims of robust safeguards. Policymakers must decide whether market incentives alone can address infrastructure-level crime, or whether regulatory requirements—matching those already in place internationally—are necessary to align corporate interests with national security and consumer protection.