The Outlier Lab

FinCEN scam center alert and what it asks of fraud teams

A close read of FinCEN's scam center alert FIN-2026-Alert005, mapping its victim-payment and laundering red flags to the decision points fraud teams control.

What happened

On September 3, 2026, FinCEN issued an alert on money laundering tied to digital asset investment scam centers. Its press release says 33,904 BSA reports filed between September 8, 2023 and December 31, 2025 describe roughly $12.7 billion in activity linked to suspected scams of this type, with victims in all 50 states. The alert cites FBI IC3 data showing reported US losses to digital asset investment scams rising from $907 million in 2021 to $7.2 billion in 2025.

The alert follows the money in three stages: victim payments, on-chain movement, and integration through mules, stablecoin transfers to offshore exchanges and underground banking networks. Filers are asked to put the key term FIN-2026-SCAMCENTERS in SAR field 2 and the narrative, and to check "Fraud-Other" with the description "Scam Centers."

Why it matters for transaction fraud teams

The alert reads as an AML document, but four of its points reach fraud teams first.

The victim payment is often fiat. FinCEN lists wires, ACH, gold and gift cards alongside digital assets, and says most digital asset payments start at money services businesses, kiosks included. A chart built from Rapid Response Program cases (October 2024 to June 2026) shows about $386 million in ACH transfers whose first receiving account sat in Asia-Pacific, with Europe at about $146 million and the Americas about $113 million. FinCEN cautions that the first hop is often not the final destination. For a US bank or neobank, a first-ever international transfer from a long-tenured retail account deserves the same scam scoring as a payment to a crypto exchange.

Victims get hit twice. The alert describes repeat targeting through recovery scams, where someone posing as an agency or law firm offers to retrieve earlier losses for a fee. A customer who has already reported a scam belongs on a watchlist for outbound payments to new payees.

Brokerages are in the path. One flag describes a customer liquidating retirement or investment holdings to buy gold for a courier to collect. That runs through the sale and withdrawal steps a brokerage controls, and it fits the delay in proposed FINRA Rule 2166.

The receiving side is partly domestic. Scam networks have opened US bank accounts through money mules and shell companies, and some have registered sham MSBs. One red flag is an MSB claiming to be "approved by FinCEN," which FinCEN does not do.

Red flag (paraphrased)Where it shows upDecision point in the library
Customer says a government or police official told them to pay by crypto, wire, gold or gift cardContact center, branch, payment-purpose promptScam Victim Indicators
Fee payment to a "recovery" firm with no proof it is realOutbound wire or ACH to a new payeePayee and Counterparty Risk
Liquidating retirement or brokerage assets to buy gold for courier pickupSale orders followed by withdrawalWithdrawal and Payout Controls
Funds in from wallets pooling scam proceeds, then out through DeFi; many offsetting trades resembling an informal exchangerExchange and fintech accountsMoney Mules
MSB claiming FinCEN approval, or an exchange advertising no KYCBusiness onboarding, counterparty reviewPayee and Counterparty Risk

The alert also describes guarantee marketplaces, escrow hubs where vendors sell account creation, phishing and laundering services to scam operators. They are the Fraud-as-a-Service Ecosystem at its most organized, and one was the target of the Strike Force action six days later.

What to do now

  • Add the FIN-2026-SCAMCENTERS key term to SAR templates and brief investigators on when to use it.
  • Add "a government official told me to pay" and "fee to recover earlier losses" as reason options in payment-purpose prompts and scam intervention Members scripts.
  • Score first-time international ACH and wires from established retail accounts as scam candidates, and size the alert volume in shadow mode before routing to a queue.
  • Put prior scam victims on a defined watch period for outbound payments to new payees.
  • Brokerages: add precious-metals dealers as a payee category and review liquidation-then-withdrawal sequences from older or first-time sellers.
  • Review inbound patterns that fit mule or shell accounts, such as many unrelated senders followed by transfers to exchanges.
  • Confirm your team knows how to request a recall through law enforcement and the Rapid Response Program, and whether you participate in 314(b) sharing.

What to watch

  • Enforcement that uses the alert's typologies, starting with the Strike Force and OFAC actions of September 9.
  • Stablecoin freezes. FinCEN flags stablecoins whose issuers say they can't freeze funds or won't work with law enforcement, so issuer cooperation will shape recovery odds.
  • Whether FinCEN refreshes its earlier kiosk notices, which this alert points readers back to.

Sources

Updates

  • 2026-10-26: Published.