Money Laundering and Terrorist Financing Red Flags

Money Laundering and Terrorist Financing Red Flags Although there is no exhaustive list of tried-and-true suspicious activity indicators for businesses, there are many common indicators of financial crime, money laundering, and terrorist-financing activity that organizations can watch for. Methods of money laundering have become more sophisticated as the complexity of financial relationships has grown and the paths through which funds move worldwide through financial organizations have multiplied. Worldwide terrorist threats are also a concern. Financial organizations and NBFIs play a critical part in efforts to disrupt the movement of funds used to support and carry out terrorist attacks. Although it may be difficult to detect terrorist financing transactions, there is guidance available from a variety of authoritative sources. Red flag indicator guidance should be used when building out and refining transaction monitoring programs. The following situations might warrant additional scrutiny, as they can indicate money laundering or terrorist financing. These lists are not exhaustive, but they will help to determine whether an activity is suspicious or does not appear to have a reasonable business or legal purpose. Unusual Customer Behavior • Customer has an unusual or excessively nervous demeanor. • Customer discusses a financial organization’s recordkeeping or reporting requirements with the apparent intention of avoiding them. • Customer threatens an employee in an effort to discourage required recordkeeping or reporting. • Customer is reluctant to proceed with a transaction after being told it must be reported. • Customer suggests paying a gratuity to an employee. • Customer appears to have a hidden agenda or behaves abnormally, such as declining a higher interest rate on a large account balance. • Customer, who is a public official, opens an account in the name of a family member, who begins making large deposits that are not consistent with the known sources of legitimate family income. • Customer, who is a student, uncharacteristically transfers or exchanges large sums of money. • Account shows high velocity in the movement of funds, but it maintains low beginning and ending daily balances. • Transaction involves offshore organizations whose names resemble those of well-known legitimate financial organizations. • Transaction involves unfamiliar countries or islands that are difficult to locate on an atlas or map. • Agent, attorney, or financial advisor acts for another person without proper documentation, such as a power of attorney. Unusual Customer Identification Circumstances • Customer provides unusual or suspicious identification documents or declines to produce original documents for verification. • Customer is unwilling to provide personal background information when opening an account. • Customer tries to open an account without identification, references, or complete local address. • Customer’s permanent address is outside of the organization’s service area. • Customer’s home or business telephone is disconnected. • Customer does not want a statement of his account or any other mail to be sent to him. • Customer asks many questions about how the financial organization shares information about the identification of its customers. • A business customer is reluctant to provide complete information about the nature and purpose of its business, anticipated account activity, and other details about the business, or to provide financial statements or other documents about a related business entity. • Customer provides no record of past or present employment on a loan application. • Customer’s Internet Protocol (IP) address or online device tracing does not match the identifying information or government-issued identification provided during online registration. Unusual Cash Transactions • Customer makes a large cash deposit without having counted the cash. • Customer frequently exchanges small bills for large bills. • Customer’s cash deposits often contain counterfeit bills or musty or extremely dirty bills. • Customer enters the bank with another customer, and they go to different tellers to conduct currency transactions under the reporting threshold. • Customer makes a large cash deposit containing many high-denomination bills. • Customer opens several accounts in one or more names, and then makes several cash deposits under the reporting threshold. • Customer withdraws cash in amounts under the reporting threshold. • Customer withdraws cash from one of her accounts and deposits it into another account the customer owns. • Customer conducts unusual cash transactions through night deposit boxes, especially large sums that are not consistent with the customer’s business. • Customer makes frequent deposits or withdrawals of large amounts of currency for no apparent business reason or for a business that generally does not generate large amounts of cash. • Customer conducts large cash transactions at different branches on the same day or coordinates other individuals to do so on his behalf. • Customer deposits cash into several accounts in amounts below the reporting threshold, consolidates the funds into one account, and then wire transfers them abroad. • Customer attempts to take back a portion of a cash deposit that exceeds the reporting threshold after learning that a CTR will be filed. • Customer conducts several cash deposits below the reporting threshold at ATMs. • Corporate account has deposits or withdrawals primarily in cash, rather than checks. • Customer frequently deposits large sums of cash wrapped in currency straps. • Customer frequently purchases monetary instruments with cash in amounts lower than the reporting threshold. • Customer conducts an unusual number of foreign currency exchange transactions. • Customer conducts foreign currency exchange transactions/currency swaps without seeming to care about the margins. • A noncustomer deposits cash into a customer account, which is subsequently withdrawn at a different geographic location. Unusual Noncash Deposits • Customer deposits a large number of traveler’s checks, often in the same denominations and in sequence. • Customer deposits large numbers of consecutively numbered money orders. • Customer deposits checks and/or money orders that are not consistent with the stated purpose of the account or nature of business. • Customer deposits a large number of third-party checks. • Deposited funds are moved quickly out of the account via payment methods inconsistent with the established purpose of the account. Unusual Wire Transfer Transactions • Wire transfers are sent or received from the same person to or from different accounts. • Customer uses message type (MT) 202 for a covered payment in SWIFT messaging to obscure wire transfer information. • Nonaccount holder sends wire transfer with funds that include numerous monetary instruments, each in an amount under the reporting threshold. • An incoming wire transfer includes instructions to convert the funds to cashier’s checks and mail them to a nonaccount holder. • Wire transfer activity occurs to and from secrecy havens or high-risk geographic locations without apparent business reason or inconsistent with a customer’s transaction history. • An incoming wire transfer is followed by the immediate purchase by the beneficiary of monetary instruments for payment to another party. • There is an increase in international wire transfer activity in an account with no history of such activity or when the stated business of the customer does not warrant it. • Customer frequently shifts purported international profits by wire transfer out of the country. • Customer receives many small incoming wire transfers and then orders a large outgoing wire transfer to another country. • Customer deposits bearer instruments followed by instructions to wire the funds to a third party. • An account in the name of a currency exchange house receives wire transfers and/or cash deposits under the reporting threshold. Unusual Safe Deposit Box Activity • Customer spends an unusual amount of time in the safe deposit box area, possibly indicating the safekeeping of large amounts of cash. • Customer often visits the safe deposit box area immediately before making cash deposits of sums under the reporting threshold. • Customer rents multiple safe deposit boxes. Unusual Activity in Credit Transactions • A customer’s financial statement makes representations that do not conform to accounting principles. • A transaction is made to appear more complicated than necessary by the use of nonsensical technical terms, such as emission rate, prime bank notes, standby commitment, arbitrage, and hedge contracts. • Customer requests loans either made to offshore companies or secured by obligations of offshore banks. • Customer suddenly pays off a large problem loan with no plausible explanation regarding the source of funds. • Customer purchases certificates of deposit and uses them as collateral for a loan. • Customer collateralizes a loan with cash deposits. • Customer uses cash collateral located offshore to obtain a loan. • Customer’s loan proceeds are unexpectedly transferred offshore. Unusual Commercial Account Activity • Business customer presents financial statements that are noticeably different from those of similar businesses. • Large business presents financial statements that are not prepared by an accountant. • Retail business that provides check-cashing services does not make withdrawals of cash against check deposits, possibly indicating that it has another source of cash. • Small business makes deposits that are inconsistent with its expected activity or receives funds from other unrelated businesses. • Customer maintains an inordinately large number of accounts for the type of business purportedly being conducted. • Corporate account shows little or no regular, periodic activity. • A transaction includes circumstances that would cause a banker to reject a loan application because of doubts about the collateral. • Multiple high-value payments or transfers occur between shell companies with no apparent legitimate business purpose. • Transacting businesses share the same address, provide only a registered agent’s address, or raise other address-related inconsistencies. Unusual Trade Financing Transactions • Customer seeks trade financing on the export or import of commodities with stated prices that are substantially higher or lower than those in a similar market situation or environment. • Customer requests payment of proceeds to an unrelated third party. • Customer presents significantly amended letters of credit without reasonable justification or changes the location of payment or the beneficiary just before payment is made. • Customer changes the place of payment in a letter of credit to an account in a country other than the beneficiary’s stated location. • Customer’s standby letter of credit is used as a bid or performance bond without the typical reference to an underlying project or contract or designates unusual beneficiaries. • Letter of credit is inconsistent with customer’s business. • Letter of credit covers goods that are in little demand in importer’s country. • Letter of credit covers goods that are rarely, if ever, produced in the exporter’s country. • Documents arrive without title documents. • Letter of credit is received from a country that is considered high risk for money laundering. • Obvious overpricing or underpricing of goods and services. • The structure of a transaction appears unnecessarily complex and designed to obscure the true nature of the transaction. • Commodities are shipped through one or more jurisdictions for no apparent economic or logistical reason. • Transaction involves the use of repeatedly amended or frequently extended letters of credit. • Size of a shipment appears inconsistent with the regular volume of business of the importer or exporter. Unusual Investment Activity • Customer uses an investment account as a pass-through vehicle to wire funds to offshore locations. • Investor seems disinterested in the typical decisions made about investment accounts, such as risk, commissions, fees, and the suitability of the investment vehicles. • Customer wants to liquidate a large position through a series of small transactions. • Customer deposits cash, money orders, traveler’s checks, or cashier’s checks in amounts under the reporting threshold to fund an investment account. • Customer cashes out annuities during the free-look period or surrenders the annuities early. Other Unusual Customer Activity • Customer conducts an unusually high number of transactions over the internet or by telephone. • Customer purchases several open-end prepaid cards for large amounts, inconsistent with normal business activity. • Funds withdrawn from accounts are not consistent with the normal business or personal activity of the account holder or include transfers to suspicious international jurisdictions. • Customer uses a personal account for business purposes. • Customer repeatedly uses bank or branch locations geographically distant from the customer’s home or office without sufficient business purpose. Unusual Employee Activity • Employee exaggerates the credentials, background, financial ability, or resources of a customer in written reports the bank requires. • Employee is involved in an excessive number of unresolved exceptions. • Employee lives a lavish lifestyle that could not be supported by her salary. • Employee frequently overrides internal controls or established approval authority or circumvents policy (e.g., removes the name of a high-risk person from a wire, known as wire stripping). • Employee uses company resources to further private interests. • Employee facilitates transactions in which the identity of the ultimate beneficiary or counterparty is undisclosed. • Employee avoids taking periodic vacations. • Employee functions performed by vendors or contractors have unusual billing or payment terms. To mitigate these risks, employees should be made aware that willfully violating AML requirements can be a criminal offense, for which the individual could be subject to fines and/or imprisonment. Unusual Activity in a Money Remitter or Currency Exchange House Setting • Customer uses money orders, traveler’s checks, or funds transfers in an unusual manner. • Two or more people work together in transactions. • Transaction is altered to avoid filing a CTR. • Customer comes into the bank frequently to purchase less than US$3,000 in instruments each time (or whatever the local recordkeeping threshold is). • Transaction is altered to avoid completing a record of funds transfer, money order, or traveler’s checks of US$3,000 or more (or whatever the local recordkeeping threshold is). • The same person uses multiple locations in a short time period. • Two or more people use the same identification. • One person uses multiple identification documents. Unusual Activity for Virtual Currency • Repeated receipt of funds transfers from virtual currency exchanges is inconsistent with customer profile. • Multiple transfers are made to one common end user. • Transactions involving virtual currency exchanges are followed within a brief time by funds transfers to high-risk geographies or ATM withdrawals in high-risk geographies. • Purchase of virtual currency quickly follows the receipt of funds transfers from unconnected third parties. • Multiple accounts are used to collect and funnel funds to a small number of virtual currency accounts. • Multiple purchases of virtual currency are at or just below US$3,000, or the local recordkeeping requirement. • Key words entered into the transaction could relate to the sale of suspicious products. Unusual Activity in an Insurance Company Setting • Cash payments are made on insurance policies. • Customer overfunds an insurance policy and then moves money out of it, despite early-withdrawal fees. • Customer uses multiple currency equivalents (e.g., cashier’s checks and money orders) from different sources to make insurance policy or annuity payments. • Customer purchases products that appear outside his normal range of financial wealth or estate planning needs. • Customer makes an early withdrawal of insurance bond, disregarding applicable fees. • Customer requests refunds during a policy’s legal cancellation period or free-look period. • Policy premiums are paid from abroad or by a third party, especially from an offshore financial center. • A policy stipulates the periodic payment of premiums in large amounts. • Customer changes the named beneficiary of a policy to a person with no clear relationship to the policyholder. • There is a lack of concern for significant tax or other penalties assessed when cancelling a policy. • Insurance bonds that were originally subscribed to by an individual in one country are redeemed by a business entity in another country. Unusual Activity in a Broker-Dealer Setting In 2002, the predecessor to FINRA, the US National Association of Securities Dealers (NASD), a self-regulatory organization that oversaw the NASDAQ Stock Market under the authority of the US Securities and Exchange Commission, offered in its Special NASD Notice to Members signs of suspicious activity to the securities field, including: • The customer appears to be acting as an agent for an undisclosed principal, but declines or is reluctant, without legitimate commercial reasons, to provide information, or is otherwise evasive regarding that person or entity. • For no apparent reason, the customer has multiple accounts under a single name or multiple names, with a large number of inter-account or thirdparty transfers. • The customer’s account has unexplained or sudden extensive wire activity, especially in accounts that had little or no previous activity. • The customer makes a funds deposit for the purpose of purchasing a longterm investment that is followed shortly thereafter by a request to liquidate the position and transfer the proceeds from the account. • The customer engages in excessive journal entries between unrelated accounts without any apparent business purpose. • The customer requests that a transaction be processed in a manner that avoids the organization’s typical documentation requirements. • The customer, for no apparent reason or in conjunction with other red flags, engages in transactions involving certain types of securities, such as penny stocks, Regulation S (Reg S) stocks, and bearer bonds, which, although legitimate, have been used in connection with fraudulent schemes and money laundering activity. • The customer’s account shows an unexplained high level of activity with very low levels of securities transactions. Unusual Real Estate Activity • Borrower/buyer submits invalid documents in order to cancel mortgage obligations or pay off her loan balances(s). • The same notary public and/or other authorized representative works with and/or receives payments from an unusually high number of borrowers. • Certified checks, cashier’s checks, or noncash item checks are falsified and drawn against a borrower/buyer’s account, rather than from the account of a financial organization. • Borrower/buyer applies for a loan for a primary residence, he but does not reside in the new primary residence, as indicated on the loan application. Other individuals occupy the borrower/buyer’s new primary residence, indicating the property is being used as a secondary residence or incomegenerating property. • Borrower/buyer requests refinancing for her primary residence, although public and personal documents indicate that she resides somewhere other than the address on the loan application. • Low appraisal values, non-arms-length relationships between short-sale buyers and sellers, and previous fraudulent sale attempts in short-sale transactions are unusual real estate activities. • The agent of the buyer and/or seller in a mortgage transaction is unlicensed. • Past misrepresentations were made by the borrower/buyer in attempts to secure funding, property, refinance, and/or short sales. • Improper/incomplete file documentation, including borrower/buyer reluctance to provide more information and/or unfulfilled promises to provide more information, represents unusual activity. • The apparent resubmission of a rejected loan application with key borrower/buyer details modified from the individual borrower to company/corporation could represent the same person attempting to secure a loan fraudulently through a straw-borrower or nonexistent person. • Borrower/buyer attempts to structure currency deposits and withdrawals, or otherwise hides or disguises the true value of assets, in order to qualify for loan-modification programs intended for homeowners in financial distress. • There is a request from third-party affiliates on behalf of distressed homeowners to pay fees in advance of the homeowner receiving mortgage counseling, foreclosure avoidance, loan modification, or other related service. • A third party solicits distressed homeowners for purported mortgage counseling, foreclosure avoidance, loan modification, or other related services. These third parties might also claim to be associated with legitimate mortgage lenders, the US government, or a US government program. Unusual Activity for Dealers of Precious Metals and Other High-Value Items The FATF Report, Money Laundering and Terrorist Financing Through Trade in Diamonds, describes transactional and other red flag indicators related to trade practices, including: • Diamonds originate from a country where there is limited production or no diamond mines at all. • Trade is conducted in large volumes with countries that are not part of the diamond pipeline. • The volume of purchases and/or imports grossly exceeds the expected sales amount. • Gold bars, coins, and loose diamonds are sold from a jewelry store (i.e., retail). • There is an increase in the volume of activity in a diamond dealer’s account, despite a significant decrease in the industry-wide volume. • An intermediary located abroad facilitates the selling and buying of diamonds between two local companies (lack of business justification and/or uncertainty as to actual passage of goods between companies). • Payments related to the appearance of rare or unique diamonds are made in the international market outside of known trading procedures (e.g., Argyle’s rare pink diamond appearing in the international marketplace outside of the annual tender process). • A single bank account is used by multiple businesses. • A single bank account has multiple deposit handlers (retail and wholesale). • Third parties are used to deposit funds into a single dealer’s or multiple diamond dealers’ accounts. • Financial activity is inconsistent with practices in the diamond trade. • Deposits or transfers to a diamond dealer’s account from foreign companies are followed by the immediate transfer of similar amounts to another jurisdiction. • Open export is settled by offsetting to, and receiving payment from, a third party. • Funds are received/transferred for import/export, and the ordering customer/beneficiary is an MSB. • The name of receiver in the payment from the diamond dealer is not the exporter/supplier. Unusual Activity Indicative of Trade-Based Money Laundering • Payment is made by virtually any method (e.g., cash, wire, check, or bank drafts) by a third party with no connection to the underlying transaction. • Structured currency deposits are made to individual checking accounts with multiple daily deposits to multiple accounts at different branches of the same bank on the same day. • There are discrepancies between the description of goods or commodity in the invoice and the actual goods shipped. • Letters of credit are amended without justification. • There is no apparent business relationship between the parties and transactions. • Frequent transactions are conducted in round or whole dollars. • Funds are transferred into an account and moved to a high-risk country in the same amount. • Companies operate in jurisdictions where their business purpose is not fully understood, and there are difficulties in determining ownership. • There is a lack of appropriate documentation to support transactions. • Negotiable instruments are used to fund transactions in sequential numbers and/or have missing payee information. Unusual Activity Indicative of Human Smuggling According to FinCEN, the following are red flags for human smuggling: • Multiple wire transfers, generally kept below the US$3,000 reporting threshold, are sent from various locations across the United States to a common beneficiary located in a US or Mexican city along the southwest border. • Multiple wire transfers are conducted at different branches of a financial organization to or from US or Mexican cities along the southwest border on the same day or on consecutive days. • Money flows do not fit common remittance patterns: o Wire transfers that originate from countries with high migrant populations (e.g., Mexico, Guatemala, El Salvador, and Honduras) are directed to beneficiaries located in a US or Mexican city along the southwest border. o Beneficiaries receive wire transfers from countries with high migrant populations (e.g., Mexico, Guatemala, El Salvador, and Honduras), but they are not nationals of those countries. • Unusual currency deposits into US financial organizations are followed by wire transfers to countries with high migrant populations (e.g., Mexico, Guatemala, El Salvador, and Honduras) in a manner that is inconsistent with expected customer activity. This might include sudden increases in cash deposits, rapid turnover of funds, and large volumes of cash deposits with unknown sources of funds. • Multiple apparently unrelated customers send wire transfers to the same beneficiary, who might be located in a US or Mexican city along the southwest border. These customers might also use similar transactional information, including, but not limited to, common amounts, addresses, and phone numbers. When questioned to the extent circumstances allow, the customers might have no apparent relation to the recipient of the funds or know the purpose of the wire transfers. • A customer’s account appears to function as a funnel account, whereby cash deposits (often kept below the US$10,000 reporting threshold) occur in cities/states where the customer does not reside or conduct business. Frequently, in the case of funnel accounts, the funds are quickly withdrawn (same day) after the deposits are made. • Checks deposited from a possible funnel account appear to be presigned, bearing different handwriting in the signature and payee fields. • A customer who is not in a cash-intensive industry frequently exchanges small denomination for larger denomination bills. This type of activity might occur when smugglers prepare proceeds for bulk cash shipments. • When customer accounts near the southwest border are closed due to suspicious activity, new customers might begin transacting on behalf of the customers whose accounts have been closed, as a means to continue illicit activities. In this case, new accounts often reflect activity similar to that of the closed accounts; transactions might be frequently occurring, currency-intensive, and involve individuals who used to receive/send funds from/to accounts previously closed due to suspicious activity. • Customer exhibits an unexplained/unjustified lifestyle that is not commensurate with his employment or business line, or profits/deposits are significantly greater than that of peers in similar professions/business lines. • Inflows are largely received in cash, and substantial cash receipts are inconsistent with the customer’s line of business; there is an extensive use of cash to purchase assets and conduct transactions. Unusual Activity Indicative of Human Trafficking According to FinCEN’s Guidance on Recognizing Activity that May be Associated with Human Smuggling and Human Trafficking—Financial Red Flags, the following are red flags for human trafficking: • A business customer does not exhibit normal payroll expenditures (e.g., wages, payroll taxes, and social security contributions); payroll costs might be nonexistent or extremely low for the size of the customer’s alleged operations, workforce, and/or business line/model. • Wages are substantially deducted. To the extent a financial organization is able to observe, a customer with a business might deduct large amounts from the wages of its employees, alleging extensive charges (e.g., housing and food costs), and the employees only receive a small fraction of their wages. These deductions might occur before or after the payment of wages. • Payroll checks are cashed, but the majority of the funds are kept by the employer or deposited back into the employer’s account. This activity might be detected by financial organizations that have access to paystubs and other payroll records. • Frequent outbound wire transfers, with no business or apparent lawful purpose, are directed to countries at high risk for human trafficking or to countries that are inconsistent with the customer’s expected activity. • A customer’s account appears to function as a funnel account, whereby cash deposits occur in cities/states where the customer does not reside or conduct business. Frequently, in the case of funnel accounts, the funds are quickly withdrawn (same day) after the deposits are made. • Multiple apparently unrelated customers send wire transfers to the same beneficiary. These customers might also use similar transactional information, including, but not limited to, a common address and phone number. When questioned to the extent circumstances allow, the customers might have no apparent relation to the recipient of the funds or know the purpose of the wire transfers. • Transactions are conducted by individuals and escorted by a third party (e.g., under the pretext of requiring an interpreter) to transfer funds, which seem to be their salaries, to other countries. • Frequent payments are made to online escort services for advertising, including small posting fees to companies of online classifieds and more costly, high-end advertising and website hosting companies. • Frequent transactions, inconsistent with expected activity and/or line of business, are carried out by a business customer in an apparent effort to provide sustenance to individuals, such as payment for housing, lodging, regular vehicle rentals, and purchases of large amounts of food. • Payments are made to employment or student recruitment agencies that are not licensed/registered or that have labor violations. • A customer establishes an account or visits a branch to conduct transactions while escorted by a third party (e.g., under the pretext of requiring an interpreter). The third party escorting the customer might have possession of the customer’s ID. • A common signer/custodian is used in apparently unrelated business and/or personal accounts. Similarly, common information (e.g., address, phone number, and employment information) is used to open multiple accounts in different names. • An employer or employment agency serves as a custodian for the accounts of foreign workers or students. • Customer exhibits an unexplained/unjustified lifestyle that is not commensurate with his employment or business line, or profits/deposits are significantly greater than that of peers in similar professions/business lines. • Inflows are largely received in cash, and substantial cash receipts are inconsistent with the customer’s line of business; there is an extensive use of cash to purchase assets and conduct transactions. The following two red flags might signal anomalous customer activity; however, they should be applied in tandem with other indicators when determining whether transactions are linked to human trafficking: • Transactional activity (e.g., credits and/or debits) is inconsistent with a customer’s alleged employment, business, or expected activity, or transactions lack a business or apparent lawful purpose. • Cash deposits or wire transfers are kept below US$3,000 or US$10,000 in an apparent effort to avoid recordkeeping and CTR filing requirements, respectively. Unusual Activity Indicative of Potential Terrorist Financing The Egmont Group reviewed 22 terrorist financing cases submitted by FIUs and identified the following financial and behavioral indicators that were most frequently associated with terrorist financing: Behavior indicators • Parties to the transaction (e.g., owner, beneficiary) from countries known to support terrorist activities and organizations • Use of false corporations, including shell companies • Inclusion of the individual on the United Nations 1267 Sanctions list • Media reports that the account holder is linked to a known terrorist organization or engaged in terrorist activities • Beneficial owner of the account is not properly identified • Use of nominees, trusts, family member, or third-party accounts • Use of false identification • Abuse of nonprofit organizations Indicators linked to financial transactions • Use of funds by nonprofit organization inconsistent with the purpose for which it was established • Transaction not economically justified, considering the account holder’s business or profession • Series of complicated transfers of funds from one person to another as a means to hide their source and intended use • Transactions that are inconsistent with the account’s typical activity • Deposits structured below the reporting requirements to avoid detection • Multiple cash deposits and withdrawals with suspicious references • Frequent domestic and international ATM activity • No business rationale or economic justifications for the transactions • Unusual cash activity in foreign bank accounts • Multiple cash deposits in small amounts in an account, followed by a large wire transfer to another country • Use of multiple foreign bank accounts Unusual Activity Indicative of Cyber Criminal Activity Cybercrimes are crimes committed using the internet or other computer technology to target individuals. The incidence of cybercrime is growing, and it is becoming one of the most prevalent financial crimes around the world. Cybercriminals are motivated by financial or ideological goals. Some of the most common cybercrimes include: • Phishing Scams: Phishing is the fraudulent practice of sending emails or texts purporting to be from a reputable company to try to obtain an individual’s login credentials or personal identifiable information. This practice is done on an individual basis and in mass (bulk phishing). • Spear Phishing: Similar to phishing, spear phishing messages appear to come from a trusted source that is familiar to the victim. Typically spear phishing uses information about the victim that was collected using social media. • Ransomware: This is an attack conducted by a hacker in which malicious software designed to block access to a computer system is installed and not removed until a sum of money is paid. • Business Email Compromise (BEC): BEC is a scam in which an attacker obtains access to a business email account and imitates an executive’s identity in order to defraud the company. FinCEN has an advisory on red flags that describes cybercrimes and the types of reviews that should be conducted when suspecting a cybercrime.