What are the red flags of pig butchering or similar investment scams involving crypto?
FinCEN groups pig butchering red flags into behavioral, financial and technical categories, and no single flag is determinative, so look at clusters and context (FIN-2023-Alert005).
What the guidance says:
- Weigh the customer's historical activity, whether transactions fit prevailing business practices, and whether several flags appear together. Additional due diligence is encouraged where appropriate (FIN-2023-Alert005).
- Behavioral: a customer with no virtual currency history tries to exchange a high amount of fiat or send high-value transfers to VASPs; mentions a high-return crypto investment from an unsolicited new contact; was told by a recent contact to buy at a kiosk and deposit at a supplied address; or seems anxious to access funds to meet an investment's timeline (FIN-2023-Alert005).
- Financial: early liquidation of savings such as a CD, or a HELOC, home equity loan or second mortgage, with proceeds going to crypto; a virtual currency deposit at or slightly above the amount the customer earlier transferred out, followed by substantially larger outgoing transfers; inactive large-balance accounts suddenly showing large withdrawals to a VASP; transfers described as "taxes," "fees," or "penalties"; small transfers to a VASP, then abruptly high-value wires to holding companies, LLCs or individuals with no prior history (FIN-2023-Alert005).
- Technical: access from IP addresses, device IDs or geographies inconsistent with prior patterns; a site or app with poor spelling, dubious testimonials or amateurish design; a lookalike or recently registered domain, no physical address, or chat or email only contact; an app downloaded from a third-party website; a large crypto receipt converted to a lower-fee coin such as TRX, then abruptly sent out (FIN-2023-Alert005).
- Another indicator is a supposedly legitimate business not registered with FinCEN as an MSB; registrations can be searched on FinCEN's MSB registrant search (FIN-2023-Alert005).
In practice: train staff on the scam arc of unsolicited contact, fabricated returns, small allowed withdrawals, then demands for fees (FIN-2023-Alert005). Record which flags you saw and the surrounding facts.
When it becomes a SAR question: a SAR is required if the institution knows, suspects, or has reason to suspect the activity meets the SAR criteria. FinCEN requests the key term "FIN-2023-PIGBUTCHERING" in SAR field 2 and the narrative, and "Fraud-Other" in field 34(z) with the description "Pig Butchering." Include technical cyber indicators, and consider referring victims to the FBI's IC3 (FIN-2023-Alert005).
Sources
- FinCEN FIN-2023-Alert005: https://www.fincen.gov/sites/default/files/shared/FinCEN_Alert_Pig_Butchering_FINAL_508c.pdf
This answer is general information, not legal advice. Forteris is not a law firm.
Have a question this doesn't cover?
The Forteris Compliance Assistant answers your team's BSA/AML questions in Slack, from the same checked library, with every answer reviewed by Forteris before it is posted. Free for 14 days or 10 questions.