The situation
Caseworkers at a coalition of anti-trafficking organizations had interviewed dozens of survivors with strikingly similar experiences. Each had answered an online advertisement for hotel, farm or warehouse work abroad. Each had paid a recruitment fee, traveled, and then found their identity documents taken and their wages consumed by debts for travel, housing and food.
Survivors usually knew only a first name and a messaging handle for the person who recruited them. The coalition suspected one network was responsible for many of the cases, but it had nothing that connected them. The work was carried out as part of our pro bono program.
The question
Are these cases connected? Who is doing the recruiting, how are they finding people, and where are they targeting potential victims right now?
What we did
A lead investigator, four analysts, linguists covering all four recruitment languages and a victim-safety adviser worked the case over eight weeks, with a red-team reviewer assigned throughout.
1. Started from survivor accounts, safely
Caseworkers shared anonymized details from survivor interviews: the wording of advertisements, the handles that recruiters used and the instructions for paying fees. We never contacted survivors directly. Case data was held in a compartmented workspace with access limited to the case team, and we recorded only the personal information the investigation strictly required.
2. Collected the advertisements
Over 18 months of history, we collected 1,480 job advertisements in four languages from classified sites, job boards and social platforms, including archived copies of advertisements that had since been removed. Every advertisement was preserved, timestamped and hashed.
3. Clustered the advertisements into one network
Three kinds of reuse tied the advertisements together. The same contact identifiers recurred under different recruiter names. The same 96 workplace photographs appeared across 640 advertisements, matched by perceptual hashing even where they had been cropped or recolored. And the same salary figures, fee amounts and template phrases recurred across languages, including identical translation errors.
4. Followed the fees
Fee instructions in the advertisements and in survivor accounts directed payments to accounts at money transfer services and to two registered recruitment agencies. Registry filings showed that both agencies shared directors, and licensing records showed that neither held the license required to recruit for work abroad.
5. Identified the recruiters
The advertisements used dozens of recruiter personas. By following reused profile photographs, handles and phone-based messaging identifiers into public business listings and social profiles held in real names, we mapped those personas to 23 individuals. Two of them recurred across every cluster and appeared as directors of the agencies.
6. Found people at risk
Replies and comments under the advertisements came from people asking about the jobs, often sharing their own circumstances. We identified 61 people whose public posts indicated they had engaged with the network's recruiters and, in many cases, had already traveled. We did not contact them. Their details went only to trained caseworkers in the coalition.
No one on our team contacted a potential victim or a recruiter. All outreach was carried out by trained caseworkers through safe channels. Information went to law enforcement only with the coalition's agreement, through secure channels, and only after caseworkers had assessed the risk to the people involved.
What we found
- High confidence: the advertisements formed a single recruitment network operated by 23 recruiters and coordinated through two agencies.
- Moderate confidence: two individuals, both directors of the agencies, organized the network.
- Likely: the network had placed workers with at least five employers in two countries.
| Reused element | Scale | Method |
|---|---|---|
| Workplace photographs | 96 images across 640 advertisements | Perceptual hashing |
| Contact identifiers | Recurring under dozens of recruiter names | Identifier pivoting |
| Salary and fee structures | Identical figures in four languages | Text clustering, native-language review |
| Payment destinations | Two unlicensed agencies with shared directors | Registry and licensing records |
The outcome
- The coalition delivered referral packages to law enforcement in three jurisdictions. Those investigations are ongoing.
- Regulators closed both recruitment agencies for operating without a license.
- All 61 potential victims were referred to support services. Caseworkers reached 44 of them within the first month.
- Platforms and classified sites removed the network's active advertisements after receiving evidence packages.
What made the difference
Survivor testimony and open-source evidence each held half of the picture. Testimony explained how the scheme worked, and the advertisements showed its scale and the people behind it. Bringing the two together, with caseworkers rather than investigators in contact with the people affected, produced evidence that law enforcement could use and kept everyone involved as safe as possible.