The guide, Preventing misuse and criminal communication through payment text fields, aims to raise awareness of how criminals are using payment text to communicate with each other – or to harass, stalk or threaten victims – rather than for the purpose of transferring funds.

The growth of digital-first fintechs, alongside an increasing amount of data and number of payment platforms, has enabled larger character limits to be applied to payment text fields, and criminals are making use of this facility to carry out illegal activities. 

Common themes within payment text fields identified by AUSTRAC include:

• Technology-facilitated abuse
• Threats or extortion attempts
• Criminal communication
• Threats of suicide and self-harm

Additionally, communications involving child abuse, illicit drugs, firearms, ideologically-motivated extremism and outlaw motorcycle gang activity have been spotted. 

Westpac bank research shows that more than half (51%) of Australians have received some form of online abuse, including via email, mobile and social media channels. One in four (26%) admit to having used some form of inappropriate language in payment transactions.

The guide, created in collaboration with public-private partnership the Fintel Alliance, provides financial service providers with insight and examples to help them target, detect and disrupt this practice.

“Financial service providers should use indicators in this report and their own business knowledge to conduct further monitoring and identify if a suspicious matter report (SMR) needs to be submitted to AUSTRAC,” the guide states.

Guidance on identifying the misuse of payment text fields includes how to determine if text is a threat or a joke, the use of abbreviations and slang to hide meanings, references to self-harm and suicide, how emojis can be used to convey threatening or abusive messages, and how criminals can refer to a shipment of illicit goods or planned event in their messaging. 

Potential red flags to look out for include payments below $10, high frequency payments and relationship patterns, along with incorrect spellings and the use of slang. 

A real-world example describes how a 23-year-old man was identified by a financial services provider after sending 10 payments of less than $5 to a female victim. Messages within the payment text field asked the victim to contact him and threats to take his own life. After a report to AUSTRAC, police arrested and charged the man for breaching a Protection Order.

Key Takeaways

This guide highlights the importance of agility in transaction monitoring, which can be challenging for firms – what counts as suspicious activity for one customer may be normal business for another. 

With constantly changing typologies and global regulatory expectations, false positives can be common and the risk of missing illegal behavior increases. For example, slang words and emojis are not fields a firm would traditionally expect to have to screen for, and context can be a challenge. Managing high volumes of false positives and unfamiliar alerts can also impact a firm’s wider operational efficiency.

It also underlines some of the changing demands on transaction monitoring systems. Firms need to  weigh up whether building a transaction monitoring solution in-house is right for them, or whether buying a solution that will push through updates automatically to cover emerging anti-money laundering (AML) risks would be more cost effective and efficient in the long-run.

At 13-pages, the guide provides a quick and easily digestible format for compliance teams and is well worth a read. It should be assessed in the context of the firm’s own business/industry, as part of a wider risk-based approach.

The post AUSTRAC guidance tackles misuse of payment text fields appeared first on ComplyAdvantage.

While prepaid cards and wallets are popular with consumers and service providers because of their convenience and availability, those benefits also present opportunities for criminals seeking to exploit the anonymity associated with their use. Gift cards are easily transferable and hard to track, and it is difficult to recover funds once spent. 

Banks and financial institutions must be aware of the risks of fraud and money laundering using prepaid cards and how to address that risk in their AML/CFT compliance solution to protect financial systems and ensure legislative compliance. 

What are prepaid cards?

Prepaid cards don’t require a bank account and can be used to pay for goods and services.  Issued by banks and other financial services firms, prepaid cards are pre-loaded and reloaded with funds and can be purchased on behalf of others.

Unlike credit and debit cards, prepaid cards do not require an evaluation of the cardholder’s creditworthiness or the existence of a payment account. Some prepaid cards can be used to withdraw money from ATMs.

Fraud and money laundering using prepaid cards can be carried out using one of two types of cards: 

• Closed: Also known as non-reloadable or closed-loop, closed prepaid cards are typically issued as gift cards. This category of prepaid card restricts purchases to a single merchant or a small network of merchants and may not be used to access ATM networks 
• Open: Also known as reloadable or open-loop, open prepaid cards are issued as real, payment network-branded cards and linked to an account containing preloaded funds. Open prepaid cards can be used for transactions with any merchant or provider linked to their payment network

How are prepaid cards used in money laundering schemes?

The accessibility and availability of prepaid cards mean criminals can purchase them from numerous outlets and use them to move and transform illegal funds. Money laundering using prepaid cards can happen at any of the 3 stages of money laundering – placement, layering, or integration: 

Placement: Criminals may, for example, use their illegal funds to purchase large numbers of prepaid cards and then introduce their stored value into the legitimate financial system or transport the cards overseas to avoid the scrutiny of authorities. The criminals may even hire money mules to purchase and transport the cards.

Layering: Funds stored on prepaid cards can be spent on or redeemed for merchandise (such as computers or other high-value electronics) resold or transported abroad. Criminals may also use prepaid cards as currency, reselling them to beneficiaries meaning that anti-money laundering layering needs to be considered.

Integration: Money laundering using prepaid cards can be carried out when criminals use them as a form of payment for legitimate goods and services, such as component chemicals for drug manufacturing, real estate deals, or life insurance products.

Why Do Money Launderers Use Prepaid Cards?

The specific financial abuses and risks of money laundering using prepaid cards, and what makes them such a popular tool for money launderers, include:

• Anonymity: Prepaid cards can be purchased without the same customer due diligence (CDD) identification and verification measures associated with other payment cards 
• Global reach: Many open prepaid cards can be used on global payment networks and so enable money laundering using prepaid cards across borders, by facilitating funding in one country and cash withdrawals in another
• Portability and transport: Prepaid cards physically resemble normal credit cards and can be transported discreetly in many environments, as an alternative to large volumes of cash 
• Funding methods: The origin of funds loaded onto prepaid cards, and their transaction history, can be obscured. Funds may be loaded onto open cards via a variety of services, including phone and online mediums 
• Service complexity: The large number of service providers involved in the prepaid card industry makes AML transaction monitoring administratively challenging. Typically, the provision of a prepaid card involves a program manager, issuer, acquirer, payment network, distributor, and vendor

Prepaid Cards as a Tool for Fraud 

Prepaid card fraud happens when stolen prepaid card information is used to make a purchase or when a fraudster buys a prepaid card with stolen payment information.

Because prepaid cards are often not tied to specific identities, they can also be purchased with stolen funds and are often used to make untraceable purchases.

Fraudulent use of prepaid cards might include:

• Gift card fraud
• Account takeover 
• Stolen account data
• Phony balance checks
• Loyalty points and rewards
• Tax fraud
• Cloned or swapped cards

In 2022, the US Justice Department highlighted a case in which two men tricked hundreds of people across the US into giving them Walmart gift cards. The fraudsters used an app to obtain gift card numbers from sources in China gained from victims across the US. New gift cards were then bought and sent back to China.

Victims of the scam were tricked out of the gift cards in various ways, including threats of arrest, finance schemes, and romance scams. According to the Federal Trade Commission, older people are more susceptible to different types of fraud loss.

AML/CFT Responses to Prepaid Card Fraud and Money Laundering

In the US, while chargeback rules apply to most payment cards under the Fair Credit Billing Act, this does not include prepaid cards. Branded prepaid cards from card networks such as Visa and Mastercard offer less risk, with the brands providing fraud protection and customer dispute options.

The Financial Actions Task Force (FATF) has issued guidance regarding fraud and money laundering using prepaid cards. Red flags to look out for include:

• Discrepancies between the information submitted by the customer and information detected by monitoring systems
• Individuals who hold an unusual volume of prepaid card accounts with the same provider
• A large and diverse source of funds used to fund the same prepaid cards
• Multiple reference bank accounts in various cities used to support the same cards
• Loading or funding of accounts always done by third parties
• Numerous cash loading, just under the reporting threshold of $10,000, of the same prepaid card(s), conducted by the same individual(s) on several occasions
• Multiple third-party funding, followed by the immediate transfer of funds to an unrelated bank account(s)
• Clients attempting to obstruct CDD processes or asking suspicious questions about their prepaid cards 
• Funds are transferred out of prepaid card accounts immediately after loading 
• Withdrawal of funds at different ATMs, often in other countries 
• Unusual purchasing patterns: for example, a customer paying for a high-value item (such as a laptop) with several prepaid cards 
• Prepaid cards being sent to recipients through the mail or being discovered on travelers who have an inconsistent connection to stated business activities 
• Prepaid card accounts used only for cash withdrawals rather than purchases
• Credit balance accumulation resulting in refunds (CBRs) should be monitored as they can be used as part of a scheme to launder funds
• Unusual purchase of goods or services in countries with a heightened risk for money laundering
• Excessive payments on private label credit cards via gift card from the merchant
• Merchant credits without offsetting merchant transactions
• Excessive customer service calls
• Abnormal customer contact behavior (e.g., frequent changes of address)

The US Federal Trade Commission offers advice on gift card scams. It warns consumers that “no real business or government agency will ever insist you pay them with a gift card. Anyone who demands to be paid with a gift card is a scammer”.

It lists common gift card scams and schemes, including:

• Callers saying they are from the government — possibly the IRS or Social Security Administration – asking for payment of taxes or a fine
• Someone calling from tech support – maybe from Apple or Microsoft – saying payment is needed to fix computer problems 
• Someone on a dating website saying they need money and asking for help
• Someone pretending to be a friend or family member in an emergency, needing money sent to them right away
• The caller says a prize has been won, but first fees or other charges need to be paid with a gift card 
• A caller claiming to be from a power or utility company, threatening to cut off service unless payment is made immediately

Many jurisdictions are tightening their prepaid card AML/CFT regulations to combat the risks of money laundering using prepaid cards. In the EU, for example, the 5th Anti-Money Laundering Directive lowered the transaction limit on prepaid cards and prohibited using cards issued in high-risk countries. From a practical perspective, firms may consider a range of measures to manage and control risks of fraud and money laundering using prepaid cards, including:

• Limits on funding, purchasing, and reloading
• Spending limits
• Stricter controls on cash access
• Geographical constraints 

Given the risks, firms should review their customer due diligence and transaction monitoring solutions to ensure they comply with relevant AML regulations and can detect and report money laundering using prepaid cards accurately and efficiently. 

Firms should also consider real-time transaction fraud detection solutions to help increase protection against fraud and money laundering using prepaid cards.

The post Prepaid Cards: Fraud and Money Laundering Risks appeared first on ComplyAdvantage.

Many uncertainties and misunderstandings surround politically exposed persons, or PEPs. Classifying a client as a PEP is not an aim in itself; rather, it forms part of the process that enables financial institutions and DNFBPs (Designated Non-Financial Businesses and Professions) to assess the higher risks related to PEPs. Of course, being a PEP does not in itself equate to being a criminal or suggest a link to abuse of the financial system. However, PEPs are higher-risk customers, because they have more opportunities than ordinary citizens to acquire assets through unlawful means like embezzlement and bribe-taking. Therefore financial institutions and DNFBPs must be familiar with thePEP red flags and indicators that can be used to detect such abuse. After determining that a customer is a PEP, financial institutions and DNFBPs are responsible for conducting ongoing customer due diligence specifically tailored to the client’s PEP status.

What Are PEP Red Flags?

The FATF has developed a list of PEP red flags / indicators that can assist in the detection of misuse of the financial system by PEPs during a customer relationship. This list of indicators is useful in detecting those PEPs that abuse the financial system and does not intend to stigmatise all PEPs. How to interpret these indicators depends heavily on context. Often, matching one or two of these indicators simply indicates a statistically-raised risk of doing business with a particular customer, and several indicators may need to be met before serious suspicion is warranted. However, in some cases—again, depending on specific circumstances—matching just one or more of these indicators could lead directly to suspicion of illegal activity, such as money laundering.

PEPs Attempting to Shield Their Identity

PEPs are aware that their status as a PEP may facilitate the detection of any illicit behaviour. This means that PEPs may attempt to shield their identity to prevent detection. Examples of ways in which this is done are:

• Use of corporate vehicles (legal entities and legal arrangements) to obscure the beneficial owner
• Use of corporate vehicles without valid business reason
• Use of intermediaries when this does not match with normal business practices or when this seems to be used to shield identity of a PEP
• Use of PEP relatives and close associates as legal owner

Behaviors that are PEP Red Flags:

Some PEP red flags include specific behaviors and characteristics that may raise risk levels or cause suspicion:

• Use of corporate vehicles (legal entities and legal arrangements) to obscure (i) ownership, (ii) involved industries, or (iii) countries
• The PEP makes inquiries about the institution’s AML policy or PEP policy
• The PEP seems generally uncomfortable to provide information about source of wealth or source of funds
• The information that is provided by the PEP is inconsistent with other (publicly available) information, such as asset declarations and published official salaries
• The PEP is unable or reluctant to explain the reason for doing business in the country of the financial institution or DNFBP (Designated Non-Financial Businesses and Professions).
• The PEP provides inaccurate or incomplete information
• The PEP seeks to make use of the services of a financial institution or DNFBP that would normally not cater to foreign or high value clients
• Funds are repeatedly moved to and from countries to which the PEP does not seem to have ties with.
• The PEP is or has been denied entry to the country (visa denial)
• The PEP is from a country that prohibits or restricts its/certain citizens to hold accounts or own certain property in a foreign country

The PEP’s Position or Involvement in Business

The position that a PEP holds and the manner in which the PEP presents his or her position are important factors to be taken into account.

Possible PEP red flags are:

• The PEP has substantial authority over or access to state assets and funds, policies and operations
• The PEP has control over regulatory approvals, including awarding licences and concessions
• The PEP has the formal or informal ability to control mechanisms established to prevent and detect ML/TF
• The PEP (actively) downplays importance of his/her public function, or the public function s/he is associated with
• The PEP does not reveal all positions (including those that are ex officio)
• The PEP has access to or control or influence over government or corporate accounts
• The PEP (partially) owns or controls financial institutions or DNFBPs, either privately or ex officio
• The PEP (partially) owns or controls the financial institution or DNFBP (either privately or ex officio) that is a counterpart or a correspondent in a transaction
• The PEP is a director or beneficial owner of a legal entity that is a client of a financial institution or a DNFBP

Industries & Sectors that are PEP Red Flags:

A connection with a high risk industry may raise the risk of doing business with a PEP. Under the FATF’s Recommendation 1, competent authorities, financial institutions and DNFBPs are required for determining which types of clients may be higher risk. For this, financial institutions and DNFBPs will also be guided by national guidance or risk assessments. Which industries are considered at risk depends on the risk assessments and other industry safeguards that are in place and varies from country to country.

Examples of higher risk industries that are PEP red flags include:

• Arms trade and defence industry
• Banking and finance
• Businesses active in government procurement (i.e., those whose business is selling to government or state agencies)
• Construction and (large) infrastructure
• Development and other types of assistance
• Human health activities
• Mining and extraction
• Privatisation
• Provision of public goods and utilities

Product, Service, Transaction or Delivery Channels

FATF recommendations also contain examples of product, industry, service, and transaction or delivery channel factors that suggest higher risk, irrespective of the type of customer.

These examples are:

• Private banking
• Anonymous transactions (including cash)
• Non-face-to-face business relationships or transactions
• Payments received from unknown or unassociated third parties

If these industries, products, services, or transaction or delivery channels are used by PEPs, then this adds an additional risk factor (depending on the nature of the PEP). In addition to the examples already listed in the FATF recommendations, there are other products, industries, services, and transaction or delivery channels that can become particularly vulnerable when used by PEPs.

Examples of these PEP red flags are:

• Businesses that cater mainly to (high value) foreign clients
• Trust and company service providers
• Wire transfers to and from a PEP account that cannot be economically explained or that lack relevant originator or beneficiary information
• Correspondent and concentration accounts
• Dealers in precious metals, precious stones, and other luxurious goods.
• Dealers in luxurious transport vehicles (such as cars, sports cars, ships, helicopters, and planes).
• High end real estate dealers

Country Specific PEP Red Flags and Indicators

The FATF recommendations contain examples of higher risk countries and other geographic risk factors that are irrespective of the type of customer. Additionally, the following red flags and indicators relating to countries can be taken into account when doing business with a PEP:

• The foreign or domestic PEP is from a higher risk country
• Additional risks occur if a foreign or domestic PEP from a higher risk country would in his/her position have control or influence over decisions that would effectively address identified shortcomings in the AML/CFT system
• Foreign or domestic PEPs from countries identified by credible sources as having a high risk of corruption
• Foreign or domestic PEPs from countries that have not signed or ratified relevant anti-corruption conventions (or otherwise have not or have only insufficiently implemented these conventions), such as the UNCAC and the OECD Anti-Bribery Convention.
• Foreign or domestic PEPs from countries with mono-economies (economic dependency on one or a few export products), especially if export control or licensing measures have been put in place

Source: FATF Guidance on Politically Exposed Persons (2013)

The post Detecting PEP Red Flags in the Financial System appeared first on ComplyAdvantage.