QUESTION
We have a problem with a particular
loan. Out of an abundance of caution, we filed a SAR on it. But we are not sure
if we should have filed one.
Our concern began when we found that our
customer was involved in unusual account activity, Even though she always maintained
high balances. When our manager asked her why there were sudden increases in activity,
she said that she was involved in converting her money to virtual currency.
Since it did not appear her account activity
was without an economic purpose nor used for criminal activity, we took no
action. But then she applied for a HELOC, and alarm bells went off in our
compliance department. We found she used the proceeds to wire her funds to a
virtual provider to buy virtual currency.
At this point, we filed the SAR. FinCEN
contacted us, and they are now investigating. I have never seen anything like
this and wonder if you can tell us what is happening. Thank you for your
awesome weekly newsletter.
Why are home equity proceeds causing a
red flag when used to buy virtual currency?
COMPLIANCE SOLUTION
Anti-Money Laundering Test and Training
ANSWER
Your question is the first we’ve
received from our readership that describes an insidious scam that takes a
wrecking ball to an individual’s financial stability. The Financial Crimes
Enforcement Network (FinCEN) has known about this scam for some time, but the problem
is growing quickly. This con is one of the many cryptocurrency investment
scams.
Perhaps you have not heard the term
before, but this type of scam operates by fraudsters gaining the confidence of
their victims before eventually enticing them to invest in fraudulent virtual
currency trading platforms.
The scam has a rather gruesome term: Pig
Butchering.
This grisly term comes from a Chinese
term[i] that translates to pig butchering.
The pig butchering confidence game originated in Southeast Asia and has spread
globally. ProPublica published a detailed article last year about this scam and
how it works.[ii]
There has been considerable media attention to pig butchering and regulatory
interest in this scam, including, most recently, a FinCEN alert.[iii]
Update your AML Program with guidelines
for staying notified of SAR compliance. You should conduct an AML Test and
AML Training annually to ensure that you comply with all BSA’s Anti-Money
Laundering Program requirements. For
information and scheduling, please contact us here.
These scams are called “pig butchering” because
they resemble the practice of fattening a hog before slaughter. Victims in this
situation are referred to as “pigs” by the scammers who leverage fictitious
identities, the guise of potential relationships, and elaborate storylines to
“fatten up” the victim into believing they are in trusted partnerships. The
scammers then refer to “butchering” or “slaughtering” the victim after their
assets are stolen, causing financial and emotional harm to the victim.
In many cases, the “butchering” phase
involves convincing victims to invest in virtual currency or, in some cases,
over-the-counter foreign exchange schemes. But scammers go beyond virtual
currency into other modalities, such as electronic funds transfers, foreign currency
and dollar-denominated Forex gold contracts, as well as wire transfers – as was
the case with your customer.
The goal is to defraud the victims of
their investment. Indeed, U.S. law enforcement agencies estimate victims in the
United States have lost billions of dollars to these scams and other virtual
currency investment frauds.[iv] In fact, in 2022,
investment fraud, as a general category, caused the highest losses of any scam
reported by the public to the FBI, totaling $3.31 billion. Fraud involving
cryptocurrency, including pig butchering, represented the majority of these
scams and increased 183% from $907 million in 2021 to $2.57 billion in reported
losses in 2022.[v]
SAR COMPLIANCE
Your customer may be a victim of a Pig
Butchering scam. You acted appropriately by filing a Suspicious Activity Report
(SAR). In the future, when you file the SAR, the narrative should include the
key term “FIN-2023- PIGBUTCHERING” and select “Fraud-Other” under SAR field
34(z) with the description “Pig Butchering.”[vi]
PIG BUTCHERING
There are four parts to the Pig
Butchering scam: Initial Contact, Sales Pitch, Promising Huge Profits, and
Point of No Return.
Initial Contact
A scammer typically makes initial
contact with a potential victim through text messages, instant messaging,
professional networking sites, social media, dating sites, or other
communication tools and platforms. A common ruse is to contact a victim under
the guise of accidentally reaching the wrong number or trying to re-establish a
connection with an old friend.[vii] The scammer, who may
claim to be an investor or money manager, may also create a social media
profile that showcases wealth and an enviable lifestyle. Once the scammer
elicits a response from a victim, the scammer will communicate with them over
time to establish trust and build a relationship.[viii]
Sales Pitch
Once trust or a relationship is
established, the scammer introduces the victim to a supposedly lucrative
investment opportunity in virtual currency, directing them to use virtual
currency investment websites or applications designed to appear legitimate[ix] – but which are
fraudulent and ultimately controlled or manipulated by the scammer. Legitimate
applications with third-party plugins allow the scammer to manipulate or
falsify information presented to the victim.[x]
According to the FBI, many victims also
report being directed to make wire transfers to overseas accounts or purchase
large amounts of prepaid cards to buy virtual currency. Wire transfers appear
to be the method used by your scammed customer.
Once the victim acquires the virtual
currency, the scammer directs them to “invest” the funds through the bogus investment
websites or applications. However, the funds are funneled to virtual currency
addresses and accounts controlled by scammers and their co-conspirators.
Occasionally, scammers leverage high-pressure
sales tactics such as telling their victims that they will lose out on the
opportunity if they do not invest by a certain deadline.[xi] A scammer may also encourage the victim to
bring their friends and family to invest in the scheme.[xii]
Promising Huge Profits
At this point, the victim has been
snookered. They have invested in the scam, and the scammer shows them
incredible returns on their investment. All those returns, of course, are fabricated.
To convince the victim of the authenticity of their investment, the scammer may
even allow the victim to withdraw a small amount of that investment to further
build the victim’s confidence before urging the victim to invest more. Victims
have been known to liquidate holdings in tax-advantaged accounts or take out
home equity lines of credit (HELOCs) and second mortgages on their homes to
increase their investments. And that seems to have happened to your customer!
Point of No Return
If a victim slows or stops investing,
the scammer uses aggressive tactics to extract final payments. For instance,
the scammer may present the victim with supposed losses on the investment and ask
them to make up the difference through additional deposits. But if the victim
attempts to withdraw their investment, the scammer demands that the victim pay
purported taxes or early withdrawal fees. Inevitably, once the victim cannot
pay more into the scam, the scammer abruptly ceases communication, making off
with the victim’s entire investment.
RED FLAGS
FinCEN compiled three types of red flags
relating to pig butchering: behavioral, financial, and technical, consisting of
a total of fifteen indicators. Lenders Compliance Group has a checklist for these
red flag indicators. Please
contact us here if you would like a copy of the Red Flags Indicators.
Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director Lenders Compliance Group
[i] “Sha Zhu Pan” is the Chinese term that
loosely translates to pig butchering.
[ii] What’s a Pig Butchering Scam? Here’s
How to Avoid Falling Victim to One, by Podkul, Cezary, September 19, 2022,
ProPublica
[iii] FinCEN Alert on Prevalent Virtual
Currency Investment Scam Commonly Known as “Pig Butchering”,
FIN-2023-Alert005, September 8, 2023, Financial Crimes Enforcement Network
[iv] See The FBI Warns of a Spike in
Cryptocurrency Investment Schemes, Public Safety Announcement, Alert
I-031423-PSA, March 14, 2023, FBI
[v] See 2022 Internet Crime Report,
FBI, March 9, 2023, at p. 12.
[vii] See Cryptocurrency Investment
Schemes, Public Service Announcements, Alert I-100322-PSA, October 3, 2022,
FBI
[ix] The term for this is “spoofing.” The
term “spoofed” refers to a cyberattack in which fraudsters or hackers seek to
persuade individuals that a web address or email belongs to a legitimate and
generally trusted company, when in fact it links the user to a false site
controlled by a cybercriminal.
[x] A scammer may also request remote
access to the victim’s devices to register accounts with virtual currency
service providers (i.e., virtual asset service providers, or VASPs) on the
victim’s behalf. The scammer may also instruct their victims to take
screenshots of their device so that the scammer can direct them through the
process of purchasing virtual currency.
[xi] See Scammers Defaud Victims of
Millions of Dollars in New Trend in Romance Scams, Public Service
Announcement, Alert I-091621-PSA, September 16, 2021, FBI
[xii] See Criminals Steal Cryptocurrency
through Play-to-Earn Games, Public Service Announcement, Alert I-030923-PSA
March 9, 2023, FBI. The scammer may also invite the victim to join online or
mobile games, advertised as “play-to-earn” games offering financial incentives
to players, but which in reality are fake gaming applications created by the
scammer to steal virtual currency from players.
