The Financial Crimes Enforcement Network (FinCEN), the financial intelligence unit of the U.S. Treasury, issued an alert referenced FIN-2026-Alert005 on 3 September 2026, together with an analysis of digital asset investment scams. The analysis covers 33,904 suspicious activity reports filed between 8 September 2023 and 31 December 2025 by roughly 1,300 institutions, tied to $12.7bn. It reconstructs a funding sequence that plays out inside the bank.
What the 33,904 reports cover
A suspicious activity report, or SAR, is a filing submitted by an institution subject to the Bank Secrecy Act. It records a suspicion and carries no criminal finding. FinCEN selected the reports that carry the key term from its 2023 alert on pig butchering, sorted by filing date rather than by the date of the underlying activity.
The funding sequence, from the checking account to the home equity line
The analysis lists the resources victims draw on, and the same list recurs from one case to the next. Victims start with the money they can reach at once, then turn to other resources as further payments are demanded.
- Personal checking and savings accounts, drawn on first.
- Withdrawals from retirement and investment accounts, and sales of securities.
- Borrowing: home equity lines of credit, credit card advances, personal loans.
- A smaller share of victims solicited funds from third parties, received by wire, peer-to-peer transfer or cash.
Two cases cited by FinCEN show the scale. A money services business reported an older victim who moved close to $640,000 out of a retirement fund. A depository institution described a customer who withdrew close to $150,000 from a retirement account, opened a home equity line of credit, took a personal loan and refinanced a mortgage.
Who files, and who sees the money
| Institution type | Reports | Share | Amounts |
|---|---|---|---|
| Money services businesses (MSBs) | 18,568 | 54.8% | $5.5bn |
| Depository institutions | 13,810 | 40.7% | $6.4bn |
| Securities and futures firms | 1,504 | 4.4% | $784.5M |
| Other | 22 | 0.1% | $8.4M |
| Total | 33,904 | 100% | $12.7bn |
The first two groups do not see the same thing. Money services businesses, mostly those in the digital asset sector, report victims sending tokens to scammer-affiliated addresses. Depository institutions report loan applications, second mortgages and transfers tied to an investment. FinCEN notes that each filer supplies only a snapshot of the cycle.
After the bank, conversion into stablecoin
The reports name at least 22 digital assets. Ethereum, Tether (USDT) and USD Coin (USDC) come up most often, and many bank filings do not specify the asset involved. Using blockchain analytics tools, FinCEN finds that scammers almost always convert the proceeds into stablecoins, almost exclusively USDT. Decentralized protocols then move those tokens from Ethereum to Tron before they reach exchanges based outside the United States.
What the alert asks institutions to do
The alert asks institutions reporting activity linked to these centers to include the key term FIN-2026-SCAMCENTERS in field 2 of the form and in the narrative, then to select “Fraud-Other” in field 34(z) with the description “Scam Centers”. It lists sixteen indicators, among them the use of a stablecoin whose issuer advertises that it does not cooperate with authorities. FinCEN also encourages the voluntary sharing provided for under section 314(b) of the USA Patriot Act, which shields eligible institutions that exchange information on suspected money laundering or fraud.