The third floor was a call center. The script was love.

At 11:14 PM on a Tuesday in March, Daniel held his phone over the kitchen counter and watched a woman named Mei wave at him from a balcony in Singapore.

Daniel is fifty-eight. He runs a small contracting business in Sacramento. He has been divorced for nine years. He met Mei on a dating app in late November, and by March they had moved to WhatsApp, then to Telegram, then to a video call she finally agreed to after weeks of saying her camera was broken.

The call was forty seconds long. She laughed. She covered her mouth the way she always said she did when she was embarrassed. She said his name. The connection cut out, the way she had warned him it might, and she sent a voice note two minutes later apologizing.

Daniel believed it.

He had a reason to. The woman on the screen had a face that matched the photos. The voice on the notes matched the voice on the call. The story about her aunt in Shenzhen who taught her crypto investing matched the screenshots she had been sending him for six weeks, the ones that showed her account on a site called cexonline.uk climbing, climbing, climbing.

He sent the first wire on April 2.

He does not know yet that the face on the screen was generated by a computer in a room on the third floor of a house in Parañaque, Philippines. He does not know that the woman typing the messages was one of fourteen Filipino workers and three foreign nationals running scripts off a shared drive. He does not know that the "balcony in Singapore" was a stock background, and the woman who waved was a deepfake skinned over a model who was sitting in a separate room with a ring light and a chair.

He will know on May 15.

That is the day the Philippine National Bureau of Investigation's Special Action Unit serves a warrant on the house.

II. The Room

The NBI's account, released after the May 16 inquest, describes a setup that anyone who has spent time inside the crypto industry will recognize immediately. It is not new. It is not even rare. It is a factory floor.

Third floor of a residential building. Multiple computers in a row. Mobile phones charging on a power strip, each one logged into a different dating app under a different name. Internet routers blinking green. A whiteboard, probably, though the NBI did not photograph one. A schedule. A script binder.

This is what a pig butchering operation looks like from the inside. The term comes from the Mandarin shā zhū pán, a phrase the operators themselves use. The pig is the mark. The butchering is the slow process of fattening them with affection, then taking everything at the end. The industry has been calling it that for at least six years. Law enforcement has only recently caught up to the vocabulary.

The Parañaque house had one feature that older operations did not.

A separate room. One computer. The NBI says it was installed with AI-based face-swapping software. Deepfake. The agency described the people who sat in that room as "models." They were the faces underneath the faces Daniel saw on his video call.

Read that slowly. The woman who waved at him was a real human being in a chair in Parañaque, wearing a different face in real time, lip-syncing to a script someone else had written, while a third person ran the chat on a phone in the next room.

The romance was a relay race. Daniel was the baton.

III. The Pipe

Here is how the money moved, based on the NBI's description and the pattern from the April 17 and May 9 busts that preceded this one.

Dating app to private message. Private message to WhatsApp. WhatsApp to Telegram. Telegram to a "tip" about an investment platform her aunt uses. The platform is cexonline.uk, a website built to look like a real crypto exchange. It is not a real exchange. It is a dashboard. The dashboard shows whatever the operators want it to show.

The victim deposits. The dashboard shows the deposit. The victim watches a number climb. The victim sends more. The number climbs more. The victim tries to withdraw a small amount, and the small amount actually arrives, because the early withdrawal is the part of the machine that builds the trust to authorize the large deposit later.

Then the large deposit. Then the withdrawal request that does not process. Then the "tax." Then the "compliance fee." Then the second tax. Then the silence.

The money does not sit on cexonline.uk. It never did. The deposits go to a crypto wallet the operators control. From there it moves through a chain of addresses designed to make the trail unreadable to anyone who is not a forensic accountant with a subpoena.

A crypto wallet, for readers who have not held one: it is a string of letters and numbers that functions like a bank account, except no one has to know your name to open it, and once the money is in, only the person with the password can move it out. That is the entire technology. That is also the entire problem.

IV. The Floor

Seventeen people were presented for inquest on May 16. Fourteen Filipinos. Three foreign nationals the NBI has not yet publicly identified. The charges under consideration fall under Republic Act 10175, the Cybercrime Prevention Act of 2012.

These are the people who were in the building when the door came down. They are not necessarily the people who built the building.

This is worth pausing on. The call-floor workers in operations like this are often recruited under false pretenses, sometimes trafficked from neighboring countries, sometimes paid a flat rate that is a small fraction of what flows through the wallets. The April 17 bust in Parañaque, which netted 48 arrests, included 41 Filipino women working scripts and seven foreign nationals who appear to have been higher up the structure. The May 9 bust in Mandaluyong followed a similar pattern.

The pattern is the story.

Three busts in roughly thirty days, all in the Metro Manila area, all running variations of the same machine. Different houses. Different scripts. Same architecture. Same crypto exit. Same victim profile: middle-aged, foreign, lonely, technologically literate enough to install Telegram but not technologically literate enough to verify a wallet address.

The NBI is not chasing seventeen criminals. They are chasing a template that can be rebuilt in any apartment with a fiber connection and a shipment of laptops. Arrest seventeen. The next seventeen are already hiring.

V. The Counter

Daniel still has the messages.

He has scrolled through them twice since the news from Manila reached him through a fraud-recovery Facebook group he joined in late April, after the second "tax" payment did not unlock his account. He has read what Mei said to him on March 4 when he told her about his son's wedding. He has read what she said on March 19 when he mentioned he was tired. He has read the voice note from the night of the forty-second video call.

He cannot tell which parts were a script and which parts were not. He cannot tell if anyone he spoke to for four months was a single human being or a roster of strangers rotating through a shift schedule. He does not know if the "models" in the deepfake room ever read what was sent in their face's name.

That part may be the heaviest. The money is gone. He has more or less accepted that. What he has not accepted is that he cannot point to a person and say: you. You did this. You meant it.

Because the answer might be that no one did. The script did. The software did. The wallet did. The seventeen people on the third floor were running a relay, and the baton was him, and the finish line was a crypto address in a country he could not name.

The NBI's complaint alleges fraud. The inquest will determine charges. The courts will eventually determine guilt. None of that will give Daniel back the four months in which he believed he was loved.

The machine is the villain. The mark is the reader. The next house is already being rented.