A Treasury Department analysis has tied roughly $12.7 billion in financial activity to suspected crypto investment scams, drawing on nearly 34,000 suspicious activity reports filed by US financial institutions between September 2023 and December 2025. The Financial Crimes Enforcement Network, or FinCEN, published the findings in a financial trend analysis this week, describing a fraud industry run largely by transnational criminal organizations based in Southeast Asia. FinCEN said victims came from all 50 states and several US territories, and ranged in age across the spectrum. Nobody fits the profile of a typical victim, because there is no typical victim.
What the reports show
FinCEN reviewed 33,904 Bank Secrecy Act reports filed by about 1,300 institutions. The filings described suspected digital asset investment scams, a category that includes the schemes better known as “pig butchering,” romance baiting and cryptocurrency confidence scams. Criminals build fake personas, often over weeks or months, then convince victims to move money into fraudulent investment platforms that show fake gains on screen. Victims only discover the fraud when they try to withdraw.
The number of reports grew by an average of 10.9 percent month over month during the review period. The dollar value behind them grew faster, at roughly 18 percent a month, which suggests individual losses were climbing, not just the count of victims. That gap between report volume and dollar volume is the number that should worry compliance teams most, since it points to larger average transfers per case.
Money services businesses filed more than half of the reports, accounting for $5.5 billion in activity. Depository institutions, meaning banks and credit unions, filed about 41 percent and reported $6.4 billion. The remainder came from other filer types, including casinos and card issuers.
| Filer type | Share of reports | Reported activity |
|---|---|---|
| Money services businesses | More than 50% | $5.5 billion |
| Depository institutions | About 41% | $6.4 billion |
| Other filers | Remainder | About $800 million |
Scam centers and their supply chain
The analysis goes beyond the fraud itself and maps the service economy around it. FinCEN describes “guarantee marketplaces,” online venues where scam operators buy illicit services such as bulk account creation, phishing infrastructure and professional money laundering. The name comes from the sellers’ practice of guaranteeing delivery. Fraud has become a division of labor, with specialist vendors for every step, which lowers the skill floor for running a large-scale operation.
Investigators also flagged behavioral patterns banks can watch for. They include a customer who suddenly sends large sums to a newly created investment platform after meeting someone online, accounts used as pass-throughs for many unrelated people, and transaction chains consistent with laundering. None of these signals alone proves fraud, but FinCEN wants them filed even when the picture is incomplete.
The enforcement message
Gene Lange, performing the duties of Under Secretary for Terrorism and Financial Intelligence, said the criminal organizations behind these scams “exploit both emerging technologies and human vulnerabilities, resulting in devastating financial losses for innocent American victims.”
The report does not announce new enforcement actions or new rules. It functions as guidance: banks are expected to use the listed red flags when filing their own suspicious activity reports, and the data gives regulators a baseline for measuring whether the problem is shrinking. Future analyses can be compared against this one, which is how Treasury tends to build its case for tighter oversight of specific sectors.
The timing matters for the industry. Congress is still working through crypto market structure legislation, and reports like this one tend to surface in hearings as evidence that consumer protections need teeth. The CLARITY Act, which passed the House in 2025, is awaiting a Senate vote scheduled for mid-September, and anti-money-laundering provisions are part of the negotiated text. Industry groups have argued the bill already adds AML duties for exchanges and stablecoin issuers. Fraud data like this strengthens the hand of senators who want more.
Why recovery is so hard
For victims, the picture is grim. Recovery rates for funds moved through mixing services and cross-border wallets are low, and most cases documented in the report involve losses that were never recovered. By the time a victim contacts their bank, the money has usually passed through several exchanges, been converted between assets and left the jurisdiction. Law enforcement can occasionally seize funds when they land at a compliant venue, but those cases are the exception.
FinCEN urges institutions to flag the behavioral patterns early, since funds are typically dispersed within hours of arriving on an exchange. Speed is the whole game. A suspicious activity report filed the same day a deposit lands has a chance of mattering; one filed two weeks later almost never does. The agency’s message to banks is that early, imperfect reporting beats late, complete reporting.
The human cost
The report also serves as a public warning. The scams it documents start with a text message, a wrong-number conversation or a social media connection, and they end with a drained savings account. Retirement funds, college savings and home equity have all appeared in case files. Some victims took out loans to keep “investing” in platforms that never existed.
Anyone who is asked to move money into a crypto platform by someone they have never met in person is, in FinCEN’s data, following a well-worn path that 33,904 institutions have already reported. The agency’s advice is blunt: no legitimate investment opportunity arrives through an online acquaintance, and no real platform blocks withdrawals while demanding more deposits.
discussion