The U.S. Treasury’s financial intelligence unit, FinCEN, has linked $12.7 billion in suspicious financial activity to digital asset investment scams run from industrial-scale compounds in Southeast Asia. The analysis, based on 33,904 Bank Secrecy Act reports filed by roughly 1,300 U.S. financial institutions between September 8, 2023 and December 31, 2025, is the first comprehensive quantification of the flow.
The report identifies the stablecoin USDT as the primary laundering vehicle, with most proceeds converted into it before moving offshore. FinCEN cautioned that the $12.7 billion figure is not a direct victim-loss total, as it may include double-counted or attempted transactions.
The scam compounds of Cambodia, Laos, and Burma are built on a workforce that did not apply for the job. Hundreds of thousands of people, the United Nations estimates, have been trafficked into guarded compounds where they are forced to run romance-baiting and investment fraud scripts under threat of violence. Their output—the billions extracted from Western victims—is what FinCEN has now measured moving through U.S. banks and crypto firms.
The number is $12.7 billion in suspicious activity flagged over 28 months. But the real story is the industrial model behind it: forced labor producing financial crime at a scale that now registers in Treasury filings. The money trail runs from a victim’s home equity line in Ohio through a U.S. exchange, into USDT, and out to a laundering network that funds the next compound expansion. FinCEN’s report, issued on September 3, 2026, gives enforcement a data baseline. It also makes clear that the headline figure is an upper-bound signal, not a settled loss tally.
The money moved faster than the reporting
The monthly volume of suspicious activity reports tied to these scams grew by an average of 10.9% during the review period. The dollar amounts flagged rose even faster, climbing 18% per month on average. In October 2023, FinCEN received 590 reports worth $485.7 million. By December 2025, the monthly count hit 2,482 reports totaling more than $833.5 million.
Money services businesses, mostly crypto-focused firms, filed 55% of the reports and identified $5.5 billion in suspicious activity. Banks accounted for 41% of filings and flagged $6.4 billion. The remainder came from securities firms and other institutions, which reported $784.5 million. The pattern was consistent across filers: regardless of the initial cryptocurrency used, proceeds were almost always converted into stablecoins—overwhelmingly USDT—and then routed through decentralized finance protocols or exchanges outside the United States.
Some financial institutions spotted collection addresses receiving transfers from multiple victims simultaneously, a pattern that helped connect separate transactions to the same scam network. At least 22 cryptocurrencies appeared in the filings, with Ethereum, Tether’s USDT, and Circle’s USDC among the most common. But the conversion step was nearly uniform. USDT was the exit rail.
FinCEN’s alert instructs institutions to reference the advisory by including the key term “FIN-2026-SCAMCENTERS” in Suspicious Activity Report field 2 and to select SAR field 34(z) Fraud–Other with the text “Scam Centers.” Under Section 314(b) of the USA PATRIOT Act, institutions that voluntarily share information about suspected scam-center activity can obtain liability protections if they follow registration and record-keeping requirements. The framework exists. The question is whether it can move at the speed of a stablecoin transfer.
The labor behind the ledger
The financial architecture is sophisticated, but the production model is brutally simple. Criminal groups lure workers with fake employment offers, confiscate their passports, and confine them in compounds where they run investment scams under performance quotas. Interpol warns the model has spread beyond Southeast Asia. A February 2026 Chainalysis study found crypto-linked payments tied to human trafficking increased 85% in 2025, including services linked to labor recruiters for these compounds.
U.S. prosecutors have pursued networks accused of combining investment fraud with forced labor. Authorities sought forfeiture of more than 127,000 Bitcoin linked to Chen Zhi, identified by U.S. and U.K. authorities as founder of Cambodia-based Prince Group, whom those authorities accuse of involvement in cryptocurrency fraud, money laundering, and forced labor. The company denies the allegations. According to U.S. and Cambodian authorities, in January, Cambodian authorities detained Chen and transferred him to China. Separately, Cambodia’s Huione network has been linked to more than $89 billion in crypto transactions; U.S. authorities designated it a primary money laundering concern.
The Justice Department’s Scam Center Strike Force has restrained more than $701.96 million in cryptocurrency allegedly tied to laundering funds stolen through these schemes. In March, the FBI and Thai police froze approximately $580 million in cryptocurrency and seized around 8,000 phones in an operation against organized pig-butchering groups. These figures are large. Set against $12.7 billion in suspicious activity flagged over 28 months, they also show how much moves before enforcement can reach it.
Beyond the headline
The Human Cost
The scam-center economy runs on workers who were themselves deceived and trafficked, held in guarded compounds where attempting to leave triggers physical retaliation or crushing debt penalties. Their daily reality is grueling shifts of scripted manipulation on dating apps and messaging platforms, enforced by supervisors tracking output. For Western victims, knowing that stolen savings fund coerced labor—not anonymous hackers—sharpens both the moral stakes and the urgency of dismantling the system.
The Money Trail
Beneath the individual romance-baiting chats sits a layered financial structure: domestic banks and payment apps feed into U.S.-accessible crypto on-ramps, after which funds are converted into USDT on lightly regulated exchanges and OTC desks in jurisdictions with weak enforcement. The real beneficiaries are not the scammers in chat windows but the professional launderers and regional business networks that monetize these flows, buying political protection and new infrastructure that stabilizes the compounds themselves.
What Isn’t Being Said
Public framing centers on U.S. victims and foreign criminals, but far less attention goes to the local elites and business groups that own the land, utilities, and corporate shells behind scam compounds. As long as these networks remain profitable and only a fraction of assets are restrained, enforcement can appear robust while the underlying political economy stays largely intact. Including those incentives in the story changes expectations about how quickly the scam-center model can truly be dismantled.
The exposure is broader than the victims
With FinCEN’s alert now live and the Strike Force accelerating restraints, four groups face distinct decisions.
- US-based investor with stablecoin exposure
Your holdings are now subject to heightened regulatory scrutiny, particularly if they interact with platforms that have not publicly aligned with FinCEN’s alert. Review your exchange’s AML policies and its history of cooperating with U.S. seizure orders. The Department of Justice has demonstrated it can trace and restrain funds; holding assets on a platform that resists compliance introduces a risk you cannot diversify away.
- Compliance officer at a US financial institution
FinCEN’s alert gives you specific SAR filing instructions and red-flag indicators for scam-center transactions. Update your institution’s monitoring rules to incorporate the “FIN-2026-SCAMCENTERS” key term and the “Scam Centers” designation in field 34(z). Evaluate whether your firm should register for voluntary information sharing under Section 314(b)—the liability protections are real, and the intelligence flowing through that channel is becoming operationally useful.
- Western individual targeted by online investment scams
The grooming pattern is consistent: trust built over weeks, then a referral to a bogus crypto platform. If an online contact steers you toward an investment site you did not independently verify, stop contact and file a report with the FBI’s Internet Crime Complaint Center at ic3.gov. If you have already sent funds, contact your financial institution immediately and request a fraud hold—speed matters more than embarrassment.
- NGO worker focused on human trafficking in Southeast Asia
The FinCEN data quantifies what field reports have long described: the financial scale of scam compounds is inseparable from the forced labor that powers them. Use the $12.7 billion suspicious-activity figure and the Chainalysis 85% trafficking-payment increase as advocacy tools when pressing for cross-border financial investigations and victim repatriation resources. The money trail is now documented; the policy response has not yet caught up.
FAQ
How do scam compounds recruit and control workers?
Justice Department and human-rights reports describe recruitment through online job ads promising legitimate customer-service work. Upon arrival, passports are seized and workers are confined in compounds in Cambodia, Laos, or Myanmar, where they are forced to run investment scams under threat of violence or inflated debts. Internal supervisors track performance metrics, and the labor pool is continually replenished, which helps explain why scam activity persists even when some organizers are arrested.
What is the difference between suspicious-activity figures and actual losses?
FinCEN’s $12.7 billion figure reflects suspicious financial activity reported in Bank Secrecy Act filings, not confirmed victim losses. Individual transactions can be double-counted across institutions, include attempted or blocked transfers, or contain filer errors. By contrast, FBI IC3 loss numbers record victim-reported losses—which still undercount reality because many cases go unreported. Readers should treat SAR-based totals as an upper-bound signal of scale, not a precise measure of what victims lost.
Explainer
- FinCEN
- The Financial Crimes Enforcement Network is the U.S. Treasury’s financial intelligence unit, responsible for collecting and analyzing Bank Secrecy Act data to combat money laundering. It issues alerts and advisories to financial institutions and runs a Rapid Response Program that has interdicted $1.8 billion since 2015. Its September 2026 alert on scam centers introduced a dedicated SAR key term to improve tracking of Southeast Asian fraud proceeds.
- USDT
- Tether-issued USDT is the largest stablecoin by market capitalization, designed to maintain a 1:1 peg with the U.S. dollar. Its speed and pseudonymity make it the dominant vehicle for moving funds across borders in crypto-related fraud, as confirmed by FinCEN’s finding that scam proceeds were almost exclusively converted into USDT before leaving U.S. jurisdiction. Tether has cooperated with some U.S. seizure actions but faces ongoing scrutiny over its role in illicit finance.
- Suspicious Activity Report (SAR)
- A SAR is a filing that U.S. financial institutions must submit to FinCEN when they detect transactions that may involve money laundering, fraud, or other criminal activity. The 33,904 SARs analyzed in FinCEN’s September 2026 report were flagged using a search term introduced in a 2023 pig-butchering alert. FinCEN cautioned that SAR totals can include double-counted or attempted transactions and are not a direct measure of victim losses.
- Section 314(b)
- A provision of the USA PATRIOT Act that allows U.S. financial institutions to voluntarily share information about suspected money laundering or terrorist financing with one another. Participants who register with FinCEN and maintain required records receive liability protections. FinCEN’s September 2026 alert encourages institutions to use Section 314(b) to collaborate on identifying scam-center transactions.
RELATED STORIES
