We don't know what security was in place. I should think there was a lot of encryption, anonymous relayers, servers in diverse countries, servers running on hacked Windows PCs owned by unknowing virus victims, etc. Perhaps the phone app has a dual use for bidding on EBay auctions, and so is not incriminating in itself.
Interpol doesn't really do investigations, it's mostly a mechanism for exchanging information. The films make it very clear that the local police are involved with the club. It is operating in a very poor country, and bringing in huge amounts of money, which gives them a lot of protection. There wasn't really a need to change location.
Also, they are preying on foreigners rather than locals. Especially the hated Americans. Mostly the locals don't interfere because they don't really care. (Interestingly, in the second film one does care and tries to help a girl, and she rebuRAB him.) The clients themselves have every reason to be discrete. That tattoo would be very incriminating.
Ultimately it is fiction, of course. However, we can see similarities to how child porn is spread on the internet (at least in popular imagination), and to how ordinary Germans behaved while the Nazis were persecuting the Jews et al.
Arguably the least plausible aspects are those done for dramatic reasons. It'd be simpler to just grab all 3 victims as soon as they arrived at the hostel, with no need to stretch it out over days grabbing one at a time giving the others a chance to catch on. No need for the girls, either; just say there are girls and the boys will turn up, and more or less have to stay a night before going home disappointed.