QUESTION
We have a problem with a particular loan. Out of an abundance of caution, we filed a SAR on it. But we are not sure if we should have filed one.
Our concern began when we found that our customer was involved in unusual account activity, Even though she always maintained high balances. When our manager asked her why there were sudden increases in activity, she said that she was involved in converting her money to virtual currency.
Since it did not appear her account activity was without an economic purpose nor used for criminal activity, we took no action. But then she applied for a HELOC, and alarm bells went off in our compliance department. We found she used the proceeds to wire her funds to a virtual provider to buy virtual currency.
At this point, we filed the SAR. FinCEN contacted us, and they are now investigating. I have never seen anything like this and wonder if you can tell us what is happening. Thank you for your awesome weekly newsletter.
Why are home equity proceeds causing a red flag when used to buy virtual currency?
COMPLIANCE SOLUTION
Anti-Money Laundering Test and Training
ANSWER
Your question is the first we’ve received from our readership that describes an insidious scam that takes a wrecking ball to an individual’s financial stability. The Financial Crimes Enforcement Network (FinCEN) has known about this scam for some time, but the problem is growing quickly. This con is one of the many cryptocurrency investment scams.
Perhaps you have not heard the term before, but this type of scam operates by fraudsters gaining the confidence of their victims before eventually enticing them to invest in fraudulent virtual currency trading platforms.
The scam has a rather gruesome term: Pig Butchering.
This grisly term comes from a Chinese term[i] that translates to pig butchering. The pig butchering confidence game originated in Southeast Asia and has spread globally. ProPublica published a detailed article last year about this scam and how it works.[ii] There has been considerable media attention to pig butchering and regulatory interest in this scam, including, most recently, a FinCEN alert.[iii]
Update your AML Program with guidelines for staying notified of SAR compliance. You should conduct an AML Test and AML Training annually to ensure that you comply with all BSA’s Anti-Money Laundering Program requirements. For information and scheduling, please contact us here.
These scams are called “pig butchering” because they resemble the practice of fattening a hog before slaughter. Victims in this situation are referred to as “pigs” by the scammers who leverage fictitious identities, the guise of potential relationships, and elaborate storylines to “fatten up” the victim into believing they are in trusted partnerships. The scammers then refer to “butchering” or “slaughtering” the victim after their assets are stolen, causing financial and emotional harm to the victim.
In many cases, the “butchering” phase involves convincing victims to invest in virtual currency or, in some cases, over-the-counter foreign exchange schemes. But scammers go beyond virtual currency into other modalities, such as electronic funds transfers, foreign currency and dollar-denominated Forex gold contracts, as well as wire transfers – as was the case with your customer.
The goal is to defraud the victims of their investment. Indeed, U.S. law enforcement agencies estimate victims in the United States have lost billions of dollars to these scams and other virtual currency investment frauds.[iv] In fact, in 2022, investment fraud, as a general category, caused the highest losses of any scam reported by the public to the FBI, totaling $3.31 billion. Fraud involving cryptocurrency, including pig butchering, represented the majority of these scams and increased 183% from $907 million in 2021 to $2.57 billion in reported losses in 2022.[v]
SAR COMPLIANCE
Your customer may be a victim of a Pig Butchering scam. You acted appropriately by filing a Suspicious Activity Report (SAR). In the future, when you file the SAR, the narrative should include the key term “FIN-2023- PIGBUTCHERING” and select “Fraud-Other” under SAR field 34(z) with the description “Pig Butchering.”[vi]
PIG BUTCHERING
There are four parts to the Pig Butchering scam: Initial Contact, Sales Pitch, Promising Huge Profits, and Point of No Return.
Initial Contact
A scammer typically makes initial contact with a potential victim through text messages, instant messaging, professional networking sites, social media, dating sites, or other communication tools and platforms. A common ruse is to contact a victim under the guise of accidentally reaching the wrong number or trying to re-establish a connection with an old friend.[vii] The scammer, who may claim to be an investor or money manager, may also create a social media profile that showcases wealth and an enviable lifestyle. Once the scammer elicits a response from a victim, the scammer will communicate with them over time to establish trust and build a relationship.[viii]
Sales Pitch
Once trust or a relationship is established, the scammer introduces the victim to a supposedly lucrative investment opportunity in virtual currency, directing them to use virtual currency investment websites or applications designed to appear legitimate[ix] – but which are fraudulent and ultimately controlled or manipulated by the scammer. Legitimate applications with third-party plugins allow the scammer to manipulate or falsify information presented to the victim.[x]
According to the FBI, many victims also report being directed to make wire transfers to overseas accounts or purchase large amounts of prepaid cards to buy virtual currency. Wire transfers appear to be the method used by your scammed customer.
Once the victim acquires the virtual currency, the scammer directs them to “invest” the funds through the bogus investment websites or applications. However, the funds are funneled to virtual currency addresses and accounts controlled by scammers and their co-conspirators.
Occasionally, scammers leverage high-pressure sales tactics such as telling their victims that they will lose out on the opportunity if they do not invest by a certain deadline.[xi] A scammer may also encourage the victim to bring their friends and family to invest in the scheme.[xii]
Promising Huge Profits
At this point, the victim has been snookered. They have invested in the scam, and the scammer shows them incredible returns on their investment. All those returns, of course, are fabricated. To convince the victim of the authenticity of their investment, the scammer may even allow the victim to withdraw a small amount of that investment to further build the victim’s confidence before urging the victim to invest more. Victims have been known to liquidate holdings in tax-advantaged accounts or take out home equity lines of credit (HELOCs) and second mortgages on their homes to increase their investments. And that seems to have happened to your customer!
Point of No Return
If a victim slows or stops investing, the scammer uses aggressive tactics to extract final payments. For instance, the scammer may present the victim with supposed losses on the investment and ask them to make up the difference through additional deposits. But if the victim attempts to withdraw their investment, the scammer demands that the victim pay purported taxes or early withdrawal fees. Inevitably, once the victim cannot pay more into the scam, the scammer abruptly ceases communication, making off with the victim’s entire investment.
RED FLAGS
FinCEN compiled three types of red flags relating to pig butchering: behavioral, financial, and technical, consisting of a total of fifteen indicators. Lenders Compliance Group has a checklist for these red flag indicators. Please contact us here if you would like a copy of the Red Flags Indicators.
Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director
[i] “Sha Zhu Pan” is the Chinese term that
loosely translates to pig butchering.
[ii] What’s a Pig Butchering Scam? Here’s
How to Avoid Falling Victim to One, by Podkul, Cezary, September 19, 2022,
ProPublica
[iii] FinCEN Alert on Prevalent Virtual
Currency Investment Scam Commonly Known as “Pig Butchering”,
FIN-2023-Alert005, September 8, 2023, Financial Crimes Enforcement Network
[iv] See The FBI Warns of a Spike in
Cryptocurrency Investment Schemes, Public Safety Announcement, Alert
I-031423-PSA, March 14, 2023, FBI
[v] See 2022 Internet Crime Report,
FBI, March 9, 2023, at p. 12.
[vi] Idem
[vii] See Cryptocurrency Investment
Schemes, Public Service Announcements, Alert I-100322-PSA, October 3, 2022,
FBI
[viii] Idem
[ix] The term for this is “spoofing.” The
term “spoofed” refers to a cyberattack in which fraudsters or hackers seek to
persuade individuals that a web address or email belongs to a legitimate and
generally trusted company, when in fact it links the user to a false site
controlled by a cybercriminal.
[x] A scammer may also request remote
access to the victim’s devices to register accounts with virtual currency
service providers (i.e., virtual asset service providers, or VASPs) on the
victim’s behalf. The scammer may also instruct their victims to take
screenshots of their device so that the scammer can direct them through the
process of purchasing virtual currency.
[xi] See Scammers Defaud Victims of
Millions of Dollars in New Trend in Romance Scams, Public Service
Announcement, Alert I-091621-PSA, September 16, 2021, FBI
[xii] See Criminals Steal Cryptocurrency
through Play-to-Earn Games, Public Service Announcement, Alert I-030923-PSA
March 9, 2023, FBI. The scammer may also invite the victim to join online or
mobile games, advertised as “play-to-earn” games offering financial incentives
to players, but which in reality are fake gaming applications created by the
scammer to steal virtual currency from players.
