FinCEN links $12.7 billion in suspicious activity to Southeast Asian crypto scam networks

The U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) has linked $12.7 billion in suspicious financial activity to crypto scam networks largely run by transnational criminal organizations in Southeast Asia, according to an alert published Sept. 3.

FinCEN cautioned that the $12.7 billion figure represents suspected financial activity reported by financial institutions rather than confirmed losses suffered by victims. The figure can include attempted or unpaid transactions, amended reports, transfers between accounts, as well as both legitimate and illicit activity associated with a reported subject.

The scale of the reported activity nevertheless highlights the growing challenge posed by crypto scams and the international networks behind them.

“Criminals use fake personas and social engineering tactics to manipulate victims, who are often American, into transferring funds to fraudulent digital asset investments,” FinCEN stated.

The agency said many of the schemes originate from transnational criminal organizations operating in Southeast Asia.

“These scams are largely perpetrated by transnational criminal organizations based in Southeast Asia, which operate industrial-scale scam compounds and leverage vast networks of criminal actors to facilitate and profit from scams,” FinCEN stated.

The Treasury findings come against a broader backdrop of cryptocurrency-related fraud reported by U.S. authorities. Separately, the FBI recorded $11.37 billion in victim-reported cryptocurrency losses during 2025, with approximately $7.2 billion attributed to cryptocurrency investment fraud.

Southeast Asian networks drive crypto scams operations

According to the FinCEN alert, criminal organizations operating in Southeast Asia have developed large-scale operations designed to build trust with prospective victims before directing them toward fraudulent investment platforms.

Operators reportedly use false identities and social engineering to establish personal or business relationships. Once trust has been established, victims may be directed to websites and applications designed to resemble legitimate investment services.

The platforms can display fictitious profits, creating the impression that an investment is performing successfully. Victims are then pressured to transfer additional funds, potentially increasing their exposure to crypto scams.

The criminal infrastructure extends beyond the initial interaction with victims. FinCEN said operators can obtain phishing, account-creation and money-laundering services through online markets known as guarantee marketplaces.

Professional money launderers also play a role by establishing shell companies and financial accounts, moving funds through networks of money mules and transferring proceeds to digital asset exchanges outside the United States.

Blockchain analysis cited by FinCEN found that nearly all the proceeds associated with the reported scam activity ended up in stablecoins, almost exclusively Tether’s USDT.

That reliance on stablecoins provides investigators with a traceable digital transaction trail while also giving criminal networks a mechanism for moving funds rapidly across jurisdictions.

Enforcement efforts target crypto scams infrastructure

U.S. authorities have increasingly focused on the infrastructure supporting crypto scams rather than limiting enforcement to individual perpetrators.

Federal agencies have used seizures, sanctions, criminal prosecutions and international cooperation to disrupt networks associated with Southeast Asian scam centers. Earlier enforcement efforts had resulted in more than $580 million in cryptocurrency being frozen or seized by March, according to reporting cited in the supplied material.

Another international operation announced in April resulted in at least 276 arrests and the dismantling of nine scam centers. Prosecutors said the alleged networks relied on fake investment platforms, relationship-building tactics and rapid cryptocurrency transfers to take control of victims’ assets.

The enforcement actions reflect the increasingly international nature of crypto scams, with victims, financial accounts, digital asset exchanges and criminal operators often located in different jurisdictions.

FinCEN’s latest analysis provides financial institutions with additional information intended to help identify transactions connected to these networks.

Treasury urges banks to detect crypto scams warning signs

FinCEN is asking financial institutions to monitor transactions involving suspected scam operators, money mules, shell companies, guarantee marketplaces and professional laundering networks.

The agency also encouraged voluntary information sharing among financial institutions under Section 314(b) of the USA Patriot Act. Banks and other covered institutions filing suspicious activity reports related to the alert are asked to include the key term “FIN-2026-SCAMCENTERS.”

The guidance supports the objectives of a March 6 White House executive order establishing a policy of protecting Americans from cybercrime, fraud and predatory schemes.

FinCEN emphasized that Bank Secrecy Act reporting plays an important role in law enforcement investigations and efforts to recover funds connected to crypto scams.

Warning signs identified in the supplied material include unsolicited messages, promises of unusually high returns, requests to use unfamiliar investment platforms and demands for additional fees before withdrawals can be processed.

Fraud schemes can also involve fake cryptocurrency exchanges, romance-based investment pitches and phishing attempts intended to gain a target’s confidence before funds are transferred.

For consumers who believe they have fallen victim to crypto scams, FinCEN advises contacting their financial institution immediately. Victims can also report incidents to the FBI’s Internet Crime Complaint Center or the nearest U.S. Secret Service field office.

The Treasury’s findings underscore the importance of scrutiny by both financial institutions and consumers as authorities attempt to disrupt the networks responsible for large-scale digital asset fraud.