FinCEN Says Stopping Crypto Scams Means Catching How Customers Fund Them

The most useful fraud signal in a cryptocurrency investment scam may not be the cryptocurrency transaction. It may be the customer’s balance sheet deteriorating in real time.

That is among the key takeaways from a Financial Crimes Enforcement Network (FinCEN) analysis released Thursday (Sept. 3), which examined 33,904 Bank Secrecy Act reports filed between September 2023 and December 2025 involving approximately $12.7 billion in suspected digital asset investment scam activity. The FinCEN analysis showed how financial institutions may have an underused advantage against authorized payment scams. They can potentially see a victim financing the fraud before they can prove the ultimate payment is fraudulent.

A retirement account is liquidated. Savings begin disappearing. A home equity line is opened. Personal loans are requested. Money moves between previously quiet accounts. Then comes the wire to a crypto exchange or unfamiliar beneficiary.

Viewed individually, each transaction can look legitimate because the customer authorized it. Viewed as a sequence, the customer can look like they are liquidating their financial life to fund a scam.

Read also: Compliance Is Crypto’s New Cost of Doing Business

Banks See What Happens Before the Blockchain in Crypto Fraud Detection

For banks, the implication is bigger than better crypto monitoring. Fraud prevention is becoming a problem of recognizing financial trajectory, not simply scrutinizing the final payment.

Money services businesses, predominantly those connected to digital assets, submitted 18,568 reports, or 54.8% of the total, representing $5.5 billion in suspected activity, according to the analysis. Depository institutions filed 13,810 reports, but those filings represented an even larger $6.4 billion.

Digital asset businesses frequently identified victims sending crypto to scammer-affiliated addresses, giving them visibility into the destination of the money and, in some cases, networks of victims converging on common addresses. Banks saw something else.

Depository institutions reported customers transferring large sums between their own accounts, applying for loans and second mortgages, seeking other financing and ultimately sending money to crypto businesses or scam-affiliated beneficiaries. They also encountered customers who insisted they were following trusted investment advisers but were reluctant to provide details about them.

In other words, crypto platforms can see where the scam money is going. Banks may be able to see what the victim is doing to obtain it.

FinCEN provided an extreme example. One customer withdrew nearly $150,000 from a retirement account, opened a home equity line of credit, took out a personal loan and refinanced a mortgage to generate money for suspected scammers. The customer had also been denied personal loans twice and said he was following investment advice from someone he believed was a romantic partner.

See also: $154B in Illicit Crypto Flows Raises Stablecoin Questions

The Fraud Pattern Looks Like Financial Self-Liquidation

The opportunity is not necessarily to invent another crypto-specific fraud model. It is to connect signals financial institutions already possess.

The industry still hasn’t found a solution to prevent criminals from exploiting the technology, and until it does, expanding access without enhanced guardrails mostly expands harm, Andrew Balthazor, associate and co-lead of the crypto asset disputes team at Holland and Knight LLP, told PYMNTS in February during a discussion for a “From the Block“ podcast with PYMNTS CEO Karen Webster and Citi Global Head of Digital Assets for Treasury and Trade Solutions Ryan Rugg.

But a bank evaluating a $50,000 transfer in isolation may see an authenticated customer moving their own money. A bank evaluating that transfer alongside a retirement liquidation, depleted savings, a new HELOC and multiple credit applications sees a fundamentally different risk.

That is where behavioral analytics and artificial intelligence potentially become useful, not as another mechanism for labeling crypto transactions risky, but as a way to identify combinations of otherwise ordinary financial decisions that become extraordinary when viewed together.

FinCEN’s own description of the scam lifecycle reinforces that point. Scammers cultivate personal relationships, show victims fictitious investment gains and encourage large investments. Victims can eventually be pushed into liquidating savings and investments, borrowing against their homes, and seeking money from family and friends.

The challenge for banks is ultimately moving beyond detect and decline. Financing a six-figure scam can leave footprints across deposits, investments, credit and payments. An authorized-payment scam can require an institution to recognize that the person who legitimately controls the account may have been manipulated into making an economically destructive decision. That creates a different fraud control problem, one combining data, intervention design and human judgment.

The strategic opportunity for financial institutions is to assemble those footprints quickly enough to recognize what they mean. The biggest finding from FinCEN is that banks may already possess many of the signals needed to identify the scam before the final payment disappears.

The next generation of fraud prevention will not just ask whether a transaction looks suspicious. It will ask whether the financial story leading to that transaction makes sense.

For all PYMNTS digital transformation coverage, subscribe to the daily Digital Transformation Newsletter.

The post FinCEN Says Stopping Crypto Scams Means Catching How Customers Fund Them appeared first on PYMNTS.com.