“They use bank accounts like burner phones.” – Alison Jimenez

DSA president, Alison Jimenez, was quoted in a recent MoneyLaundering.com article by Fred Williams detailing a seizure of millions of dollars from a Deltec bank account at MUFG. The Secret Service affidavit supporting the seizure alleges that the funds were connected with “pig butchering” and other crypto scams.

What is Pig Butchering?

Homeland Security Investigations (HSI) defines pig butchering as a “prolific financial fraud scheme, which combines elements of traditional romance and investment fraud whilst also targeting people trafficking and modern slavery victims.”

Pig Butchering & Bank Accounts

In the MoneyLaundering.com article, Alison Jimenez discussed the high turnover of bank accounts by the alleged scammer. The scammer appeared to anticipate that banks would close the accounts.

“One takeaway for banks might be that the bad guys know that you’re looking for red flags, so perhaps how long we have to catch activity is getting compressed,” said Jimenez. “They use bank accounts like burner phones.”

The affidavit included a table of the opening and closing dates of the pig butchering ring’s bank accounts. Notably, most of the banks either restricted or closed the accounts within two months of opening, yet the suspects were allegedly able to move millions of dollars in a short period.

Pig Butchering bank accounts closures — Source: Secret Service Affidavit

Pig Butchering & Transnational Criminal Organizations

The Secret Service affidavit describes a Transnational Criminal Organization (TCO) allegedly engaging in pig butchering, collecting and moving funds offshore.

An HSI Cornerstone Alert provides additional information on the role of Transnational Criminal Organizations in pig butchering:

Pig butchering “is controlled by organized crime groups operating from Southeast Asia.“
And “criminal networks place fake job advertisements to attract young people from China and other countries. These individuals are then held, against their will, in secure compounds where they are forced (under threat of violence) to commit cyber enable fraud.“

Scammers Collect & Move Funds Offshore

Pig Butchering and cryptocurrency are often mentioned in the same breath but the affidavit notes “while the scammers prefer cryptocurrency deposits, they will also accept bank wires if the victim cannot transfer cryptocurrency.”

Here’s how the scam allegedly worked per the affidavit:

“The scammers promoted spoofed domains and websites purporting to look like legitimate cryptocurrency trading platforms to U.S. victims. Scammers then fooled victims into ‘investing’ in cryptocurrency through the fraudulent investment platforms, which instead allowed scammers to steal their money.”
The scammers opened dozens of bank accounts in the names of shell companies and instructed victims to wire funds (often in large, round numbers) to those bank accounts to invest in crypto. The affidavit lists accounts at Bank of America, JP Morgan Chase, Wells Fargo and others.
The “74 different shell companies received wire fraud proceeds and transferred those proceeds to and through the SUBJECT ACCOUNT [Deltec account at MUFJ], to ultimate beneficiaries overseas”.
Finally, the affidavit states “it appears that Deltec Bank and Trust has misrepresented the purpose and use of the SUBJECT ACCOUNT to Mitsubishi UFJ Trust.“

Identifying Victims & Other Related Crimes

Law Enforcement scoured IC3 and “other government databases” (probably SARs) to identify victims, bank accounts, and other shell companies. This is one an example of IC3 being used in data mining for LE purposes.
Law Enforcement also identified victims of tech scams and fake order scams linked to the bank accounts. TCOs are diversified businesses, and it should not be surprising that the group was allegedly running multiple schemes.