Treasury flags scam center red flags

When a customer walks into a bank to wire money to a cryptocurrency exchange, the transaction might look routine. But according to a new alert from the U.S. Treasury's Financial Crimes Enforcement Network, that same transaction could be the final step in a chain of coercion, trafficking, and fraud run by industrial-scale scam centers in Southeast Asia. The agency is now asking financial institutions to pay closer attention to the red flags that precede such transfers.

FinCEN issued the warning alongside a detailed list of indicators that banks can monitor, noting that scams originating from these centers have become a multi-billion-dollar problem. The alert, which cites analysis of Bank Secrecy Act reporting and law enforcement information, describes a criminal ecosystem that is far more organized and brutal than the common stereotype of a lone fraudster.

Inside the scam center machinery

These operations are not small-time cons. According to FinCEN, they are large, well-organized crime machines responsible for billions of dollars in damages worldwide each year. The organizations are primarily based in Cambodia, Burma, and Laos, where they have trafficked hundreds of thousands of people into compounds, confiscated their passports, and forced them to participate in online fraud. Those who fail to meet quotas are often beaten, and some victims have been liberated only after their families paid ransom demands. Others, the alert states, were coerced into commercial sex work.

The centers are also resilient to law enforcement pressure because some are either endorsed or outright operated by corrupt local officials, FinCEN said. That protection makes traditional disruption efforts difficult, leaving financial institutions as one of the few chokepoints where the flow of money can be intercepted.

Investment fraud is by far the most common scheme, the agency stressed. Scammers typically reach out by posing as a romantic interest or a financial advisor, and sometimes open with a claim that they have simply mistyped a phone number. After building rapport over an extended period, they steer the victim toward an "investment," often in cryptocurrency, and promise unrealistically high returns.

The crypto payment trail

FinCEN's analysis pinpoints the payment stage as the moment when scams are most easily identified. The alert describes how victims are directed to use money services businesses (MSBs) that offer digital asset services, including digital asset kiosks, to purchase specific cryptocurrencies. The victim is then told to send those funds to a digital asset address controlled by the scammers.

Most digital asset payments by victims to scam center operators originate from money services businesses (MSBs) offering digital asset services, including digital asset kiosks, according to FinCEN analysis and law enforcement information. Based on FinCEN's analysis of BSA reporting, scammers often instruct their victims to open accounts with MSBs offering digital asset services to purchase specific types of digital assets. Then, the victim is told to send these funds to a digital asset address controlled by the scammers.

— FinCEN, in its alert to financial institutions

That pattern gives banks a concrete window for intervention. A customer who suddenly opens an account with a digital asset MSB, buys a narrow set of tokens, and immediately transfers them to an external address may be following instructions from a scammer rather than making an independent investment choice.

Double-dipping on victims

The fraud does not end when the money is gone. FinCEN says scammers return to victims, exploiting their emotional distress to extract even more. They impersonate law enforcement, financial institutions, or even FinCEN itself, claiming they are investigating the theft or have recovered the funds, and asking for a fee to return the money.

In other cases, the fraudsters pose as investment advisors and instruct victims to liquidate their holdings, buy gold and silver bars, and hand them to a courier for "safe keeping." These recovery scams add a second layer of loss and can be harder to detect because they often involve traditional assets and in-person handoffs rather than crypto transfers.

Banks are also being urged to consider context rather than relying on any single red flag. FinCEN notes that no individual indicator is "determinative of illicit or other suspicious activity," and that institutions should weigh a customer's historical financial activity, whether transactions align with prevailing business practices, and whether multiple related red flags appear together.

Following the money offshore

Stealing the funds is only half the operation. The proceeds must be laundered back into the legitimate financial system, and FinCEN describes a three-stage process that relies on professional money launderers and Chinese money laundering networks.

In the first stage, the criminals extract payments in digital assets using bank accounts, money mules, shell companies, or fraudulent money services businesses. During the second stage, known as on-chain laundering, they obfuscate the origins of the stolen money by rapidly moving it across addresses, using mixers, and swapping tokens across blockchains. The final stage integrates the funds into the traditional financial system through money mules, stablecoin transfers to offshore exchanges, and Chinese underground banking networks.

Each stage offers potential visibility for compliance teams, but the speed and cross-border nature of the transfers make detection challenging. The use of mixers and token swaps, in particular, can break the audit trail that banks rely on when filing suspicious activity reports.

The billions at stake

The scale of the losses puts the alert in stark terms. FinCEN's figures show that the problem is not marginal, and the money involved is large enough to affect thousands of victims and the institutions that serve them.

• In 2025 alone, U.S. victims lost more than $7.2 billion to these scams.
• Between September 2023 and December 2025, nearly $13 billion was stolen from Americans.
• Hundreds of thousands of people were trafficked into scam centers across Cambodia, Burma, and Laos.

The full list of red flags is available in the FinCEN alert, which also stresses that the circumstances around each case should be carefully considered. The agency's guidance is aimed at helping banks distinguish between legitimate high-risk activity and the specific patterns that indicate scam center involvement.

Why this matters for banks and customers

For financial institutions, the alert is a reminder that anti-money laundering controls are not just a regulatory checkbox. The scam centers rely on the banking system to move and launder funds, which means banks that fail to spot the patterns described by FinCEN could find themselves handling the proceeds of trafficking and fraud. That carries reputational, legal, and compliance risks.

For consumers, the red flags offer a practical checklist. Unsolicited investment advice, pressure to buy specific cryptocurrencies, instructions to send funds to an external wallet, and any demand for a fee to recover lost money are all signals that a scam may be underway. Once funds are sent through mixers and offshore exchanges, recovery is unlikely.

FinCEN's warning suggests that the most effective intervention point may be the moment a victim is first instructed to open an account with a digital asset MSB or send funds to a scammer-controlled address. Banks that can recognize that moment, and report it, could help disrupt a pipeline that has already moved billions of dollars and destroyed lives far beyond the financial losses.