FINCEN Traces $12.7bn Crypto Scam Trail To Southeast Asian Fraud Compounds

• US financial intelligence agency flags industrial-scale scam networks, stablecoin flows, money mules and professional laundering infrastructure

The United States Financial Crimes Enforcement Network, FinCEN, has linked approximately $12.7 billion in suspected financial activity to digital asset investment scams operated from Southeast Asian scam compounds, exposing an industrial-scale fraud ecosystem that combines social engineering, cryptocurrency and professional money laundering.

The findings, released on September 3, 2026, are based on an analysis of 33,904 Bank Secrecy Act reports submitted by financial institutions between September 2023 and December 2025. The reports covered suspected digital asset investment scam activity across all 50 US states and several territories.

FinCEN said the scams are largely operated by transnational criminal organisations based in Southeast Asia, where large-scale compounds have become operational bases for targeting victims around the world.

The schemes commonly involve so-called pig butchering, romance baiting and cryptocurrency confidence scams. Victims are approached through fake romantic relationships, friendships or business opportunities before being persuaded to transfer money into fraudulent digital asset investment platforms.

The criminal infrastructure behind the schemes, however, extends well beyond the person communicating with the victim.

FinCEN’s analysis shows a sophisticated financial ecosystem involving money mules, shell companies, professional money launderers, cryptocurrency exchanges and online marketplaces that provide criminal services to scam operators.

THE MONEY TRAIL..

The $12.7 billion figure emerged from reports filed by about 1,300 financial institutions.

Money services businesses, predominantly cryptocurrency firms, accounted for 55 per cent of the reports and identified approximately $5.5 billion in suspicious activity. Banks accounted for another 41 per cent, flagging around $6.4 billion.

The reporting pattern also points to an expanding threat

Monthly reports rose from 590 involving approximately $485.7 million in October 2023 to 2,482 reports involving about $833.5 million in December 2025.

FinCEN cautioned that the increase should not automatically be interpreted as an equivalent increase in underlying criminal activity. Changes in reporting practices, including the wider use of search terms introduced following an earlier 2023 alert, may have contributed to the growth. The totals can also include duplicate transfers, attempted payments and reporting errors.

Even with those qualifications, the volume demonstrates the extent to which cryptocurrency has become embedded in the financial infrastructure supporting online fraud.

STABLECOINS AT THE CENTRE

The investigation also highlights the role of stablecoins in moving scam proceeds.

FinCEN identified at least 22 digital assets used in reported activity, with Ethereum, USDT and USDC among the most frequently observed.

According to the agency, illicit funds were often converted into stablecoins, particularly USDT, before being moved through decentralised finance protocols or exchanges outside the United States.The compliance significance is substantial.

Stablecoins offer criminal networks a mechanism for transferring value across borders while reducing exposure to the volatility associated with many other cryptocurrencies.

Once funds leave the jurisdiction where the victim or originating financial institution is located, investigators may face additional obstacles involving foreign exchanges, different regulatory regimes and fragmented ownership structures.

The laundering process can therefore become a race between investigators tracing the money and criminals moving it through successive layers of the financial system.

 THE CRIMINAL MARKETPLACE

One of the more significant findings concerns the emergence of what FinCEN describes as “guarantee marketplaces”.

These online markets allow scam operators to purchase specialised illicit services, including account creation, phishing infrastructure and money laundering.

Professional money launderers also provide financial accounts and shell companies and help move proceeds through the formal financial system.

The result is a financial crime model that increasingly resembles a service industry. A scam operator does not necessarily need to build every component of the operation.

Specialists can supply accounts. Others can provide victims, move the money and even convert proceeds into cryptocurrency

Others can provide access to exchanges and offshore financial infrastructure.

This division of labour makes the underlying criminal network harder to dismantle because removing one operator does not necessarily remove the infrastructure supporting the wider ecosystem.

WHEN MONEY MULES BECOME THE BRIDGE…

FinCEN also identified networks of money mules as a significant component of the laundering process.

These accounts help criminals introduce scam proceeds into the formal financial system before funds are transferred onwards, frequently through cryptocurrency.

For banks and other financial institutions, this creates a difficult detection problem.

A mule account may not initially appear to belong to a sophisticated criminal organisation. It may instead resemble an ordinary personal or business account receiving payments from multiple sources.

The risk becomes clearer when transaction behaviour is examined across multiple accounts, counterparties and jurisdictions.

That is why FinCEN’s latest alert focuses heavily on identifying patterns rather than relying solely on individual transactions.

 THE SCAM COMPOUND PROBLEM

The financial activity has been traced primarily to scam compounds concentrated in Cambodia, Laos and Burma, according to FinCEN.

These compounds have become associated with transnational criminal organisations that run large-scale online fraud operations targeting victims far beyond Southeast Asia. FinCEN warned that the model is also spreading beyond the region.

The geographical distance between the victim and the criminal operation creates a major enforcement challenge.

A victim may be sitting thousands of kilometres away from the person orchestrating the fraud. The victim’s bank may be in one country. The cryptocurrency exchange may be registered in another. The money mule may operate somewhere else, while the criminal organisation controlling the operation is based in Southeast Asia.

The transaction itself can cross borders in seconds.The investigation cannot.

A NEW AML WARNING FOR FINANCIAL INSTITUTIONS….

FinCEN has now issued red flags intended to help financial institutions identify activity associated with scam centres.

The indicators include the use of money mules, shell companies, stablecoin transfers, accounts established by professional money launderers and transactions involving overseas digital asset exchanges.

The agency is also encouraging financial institutions to use voluntary information sharing under Section 314(b) of the USA PATRIOT Act.

That mechanism allows participating institutions to share information relating to suspected money laundering and terrorist financing while receiving statutory safe harbour protections.

The emphasis on information sharing reflects a central problem in modern financial crime detection.

No single institution necessarily sees the entire transaction chain. One bank may see the first suspicious payment. A crypto business may see the conversion into digital assets. Another institution may see the movement into a shell company. A fourth institution may see the final transfer. Without intelligence sharing, each institution may see only an apparently isolated transaction. Together, the transactions can reveal a laundering network.

THE CROSS-BORDER RESPONSE

FinCEN said its Rapid Response Program allows it to share financial intelligence rapidly with counterpart financial intelligence units and encourages foreign authorities to use their own legal and regulatory powers to stop and repatriate fraudulent transactions.

That cooperation will be increasingly important as scam networks move beyond their traditional operating locations.

The latest US findings also reinforce a broader trend in financial crime enforcement. Criminal organisations are no longer necessarily tied to a single jurisdiction or financial channel

They can combine traditional bank accounts with digital assets, offshore companies, social media platforms and informal payment networks.

For regulators, the implication is straightforward. The compliance perimeter can no longer stop at the bank account

THE BIGGER RISK

The FinCEN findings point to a wider transformation in the economics of fraud.

Cryptocurrency has not created online fraud, but it has given criminal networks another mechanism for moving value across borders.

Artificial intelligence, social media and increasingly convincing digital identities are simultaneously making it easier to manufacture trust.

The result is a fraud model that can operate at scale.

A single criminal organisation can target thousands of people while outsourcing parts of the operation to specialised service providers.

That changes the compliance challenge from identifying an individual fraudster to identifying the infrastructure that enables thousands of fraudulent transactions.

For banks, fintechs, crypto exchanges and other financial institutions, that means customer due diligence alone is not enough

Transaction monitoring must be capable of identifying relationships between accounts, wallets, counterparties and jurisdictions.

The ability to detect the financial footprint of a scam network may ultimately matter more than identifying the person who first contacted the victim.

THE COMPLIANCE TEST

FinCEN’s $12.7 billion finding is not simply another warning about cryptocurrency scams.

It is a warning about the financial infrastructure that allows industrial-scale fraud to operate across borders

The emerging threat combines human manipulation with digital assets and professional laundering services.

For financial institutions, the message is increasingly clear.The suspicious transaction may not look suspicious when viewed in isolation. The risk becomes visible when the transaction is connected to the wider network.

That makes intelligence sharing, effective transaction monitoring, stronger virtual asset controls and rapid cross-border cooperation central to the next phase of the fight against crypto-enabled fraud.

The criminals are already operating as networks.The compliance response will have to do the same.