FinCEN Ties $12.7 Billion in Suspicious Activity to Overseas Crypto Scam Centers

Oct 30

6 min read

The Treasury Department's Financial Crimes Enforcement Network (FinCEN) on September 3, 2026, issued an alert, FIN-2026-Alert005, on money laundering tied to digital asset investment scam centers, together with a Financial Trend Analysis of what U.S. banks and other financial institutions have been reporting. The analysis found that about 1,300 institutions filed 33,904 Bank Secrecy Act reports describing roughly $12.7 billion in suspicious activity linked to these scams between September 8, 2023, and December 31, 2025. Victims were located in all 50 states, the District of Columbia and several U.S. territories.

The schemes are widely known as "pig butchering," a name taken from the way victims are fattened with attention and apparent gains before being drained. FinCEN attributes the industrial-scale version to transnational criminal organizations operating compounds mainly in Cambodia, Burma and Laos. Gene Lange, who is performing the duties of Treasury's under secretary for terrorism and financial intelligence, called the scams "one of the most significant fraud threats facing Americans today."

What FinCEN found

Who reported it: Money services businesses, which include cryptocurrency exchanges, filed 18,568 reports (54.8 percent) covering $5.5 billion. Banks and other depository institutions filed 13,810 reports (40.7 percent) covering $6.4 billion. Securities and futures firms filed 1,504 reports covering about $784.5 million.
Growth: Reports grew an average of 10.9 percent a month, and dollar volume about 18 percent a month. FinCEN notes that some of the increase may reflect wider use of its reporting key term rather than faster growth in the scams themselves.
Older victims: Institutions flagged elder financial exploitation in 10,082 of the reports.
Losses on the ground: Citing FBI complaint data, the alert says U.S. victim losses from digital asset investment scams rose from about $907 million in 2021 to $7.2 billion in 2025.

FinCEN cautions that report totals can include duplicates, attempted transactions and both inbound and outbound transfers, so they may overstate actual losses.

Who runs the schemes

According to the alert, criminal gangs have trafficked hundreds of thousands of people into Southeast Asian scam compounds, where workers may have their passports taken, be forced to defraud strangers and face beatings for missing quotas. The organizations have expanded to South Asia, the Pacific Islands, Africa, the Middle East and South America. FinCEN also highlights "guarantee marketplaces," largely Chinese-language Telegram groups where scam operators buy money laundering, account creation and mass phishing services.

How the scheme works

FinCEN's analysis traces a consistent arc.

First contact. It often starts with a "wrong number" text or an unsolicited message on social media, a dating site, a messaging app or a job-search site. The conversation then moves to an encrypted messaging service.
The relationship. The scammer poses as a romantic interest, friend or business contact and builds trust.
The opportunity. The victim is steered to a website or app that imitates a legitimate investment service, or in some cases to a legitimate third-party brokerage account.
The bait. Small early payouts, often in digital assets, encourage larger deposits.
The drain. Victims fund the account from checking and savings, then from retirement withdrawals, securities sales, home equity lines of credit, credit card advances and personal loans. A smaller share solicit money from other people.
The exit trap. When the victim tries to withdraw, the scammers say taxes or fees must be paid first. FinCEN says this often marks the final stage.
The second bite. Victims are then targeted by "recovery" services that promise to retrieve the lost money for a fee.

Most victims buy cryptocurrency through centralized exchanges; some feed cash into crypto kiosks. In less common cases, victims wire money to accounts they believe are buying digital assets for them. Once the scammers have the funds, FinCEN says, they nearly always convert them to stablecoins, almost exclusively Tether (USDT), and move them through multiple transactions, decentralized finance protocols and foreign exchanges. Professional launderers set up accounts and shell companies, and proceeds enter the formal financial system through money mule networks and stablecoin transfers to exchanges outside the United States.

Red flags for individuals and families

A stranger who contacts you by "mistake" and keeps the conversation going.
A new online friend or romantic interest who steers the conversation to investing or cryptocurrency.
A platform you can reach only through a link someone sent you, with returns that look unusually steady or high.
Pressure to move retirement savings, take out a home equity loan or borrow money to invest more.
A demand to pay taxes or fees before you can withdraw.
Anyone, including a supposed law enforcement officer or law firm, who offers to recover lost funds for an upfront payment.

Red flags for businesses and financial institutions

The alert lists 16 indicators. Among those most relevant to front-line staff:

A customer says a law enforcement or government representative directed a payment in digital assets, by international wire, in precious metals or in gift cards.
A customer withdraws investment or retirement funds to buy gold and says a courier will collect it.
A customer wants to pay a firm to recover fraud losses but has no documentation showing the firm is legitimate.
A money transmitter receiving customer funds claims to be "approved by FinCEN," or an exchange advertises that it requires no identity verification.
A customer trades heavily in a stablecoin whose issuer says it does not cooperate with law enforcement or that its tokens cannot be frozen.

FinCEN asks institutions to include the key term FIN-2026-SCAMCENTERS in field 2 and the narrative of suspicious activity reports, select "Fraud-Other" with the description "Scam Centers," and attach technical details such as chat logs, phone numbers, wallet addresses and transaction hashes. Businesses filing Form 8300 for large cash receipts should check the suspicious-transaction box and include the same key term.

Controls that prevent or detect it

For individuals: Verify any investment professional or platform independently before sending money; the SEC's Investor.gov and FINRA BrokerCheck are starting points. Never install trading apps or visit platforms from links supplied by someone you met online. Treat any request to pay to withdraw your own money as proof of fraud.

For families: Watch for sudden retirement account withdrawals, new loans or secrecy about an online relationship. Brokerage firms are required to try to obtain a trusted contact for individual accounts; naming one gives the firm someone to call if it suspects exploitation.

For employers and plan sponsors: FinCEN found that victims commonly tap retirement and investment accounts. Benefits staff who process unusual distribution or loan requests can share scam-awareness information without prying, and payroll teams should verify any employee request to redirect pay to a new account.

For banks, credit unions, exchanges and kiosk operators: Train staff on the alert's indicators, build in a pause and conversation for large first-time transfers to exchanges, and file promptly using the key term.

The enforcement backdrop

The alert builds on several federal actions. In October 2025, FinCEN issued a final rule cutting Cambodia-based Huione Group off from the U.S. financial system, finding it had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. In June 2026 FinCEN proposed extending that rule to successor entities. The U.S. Attorney's Office for the District of Columbia formed a Scam Center Strike Force in November 2025 with the FBI, Secret Service and IRS Criminal Investigation; on July 21, 2026, it announced the seizure of more than $25 million in cryptocurrency, which it said was part of more than $800 million recovered through the Strike Force.

What to do if you are victimized

Stop sending money, including any "tax," "fee" or "unlock" payment.
Call your bank or exchange immediately and ask it to stop or recall pending transfers. Speed is critical: according to the analysis, FinCEN's Rapid Response Program has, since 2015, helped interdict $1.8 billion and recover more than $1 billion in stolen proceeds for 5,790 U.S. victims.
File a complaint at www.ic3.gov, typing the address directly. Include wallet addresses, transaction hashes, dates, amounts, platform names, usernames and screenshots of conversations. You may also contact your nearest U.S. Secret Service field office.
If the victim is 60 or older, the National Elder Fraud Hotline is 1-833-FRAUD-11 (1-833-372-8311).
Ignore recovery offers. In a July 20, 2026 alert, the FBI warned that criminals pose as FBI and IC3 staff to re-victimize scam victims. IC3 does not contact people through social media and never asks for payment to recover funds.
Talk to a tax professional. IRS Chief Counsel advice released in 2025 (CCA 202511015) concluded that a victim of a pig-butchering investment scam who transferred funds with a profit motive could claim a theft loss deduction, while a romance-scam victim whose transfers were not for profit could not. The analysis is fact-specific and depends on timing and any prospect of recovery.

Sources

This article is general information, not tax, legal, or accounting advice. Consult a qualified professional about your situation.