The Financial Crimes Enforcement Network (FinCEN), the US Treasury’s financial intelligence unit, on September 3, 2026, tied about $12.7 billion in financial activity to suspected digital asset investment scams. The figure comes from 33,904 suspicious activity reports filed by roughly 1,300 institutions between September 8, 2023, and December 31, 2025. FinCEN published the analysis alongside a new alert to financial institutions, FIN-2026-Alert005.
For banks, the analysis matters because it traces a funding sequence that runs through their own accounts. Victims empty their checking and savings first, then tap retirement money and borrow against their homes. Scammers then convert the proceeds into stablecoins and move them to exchanges outside the US.
“Digital asset investment scams pose one of the most significant fraud threats facing Americans today,” said Gene Lange, who is performing the duties of Treasury’s Under Secretary for Terrorism and Financial Intelligence.
The data set is built on a 2023 key term
A suspicious activity report, or SAR, is filed by an institution subject to the Bank Secrecy Act. It records a suspicion, not a criminal finding. FinCEN pulled every report that carried the key term from its September 2023 alert on pig butchering, and counted them by filing date rather than by the date of the underlying activity.
Victims spend their savings first, then borrow
The analysis catalogs where victims find the money, and the pattern repeats from case to case. Victims typically start with readily available funds, then turn to other sources as the scammers ask for more.
- Personal checking and savings accounts come first.
- Next come withdrawals from retirement and investment accounts, and sales of securities.
- Then debt: home equity lines of credit, credit card advances, and personal loans.
- A smaller share of victims solicit money from others, received as wire transfers, peer-to-peer transfers, or cash.
Two cases in the report show the scale. A money services business reported an older victim who moved nearly $640,000 out of her retirement fund. A depository institution described a customer who withdrew nearly $150,000 from his retirement account, opened a home equity line of credit, took out a personal loan, and refinanced his mortgage.
MSBs file most reports, but banks report more dollars
| Filer type | Reports | Share | Amount |
|---|---|---|---|
| Money services businesses (MSBs) | 18,568 | 54.8% | $5.5B |
| Depository institutions | 13,810 | 40.7% | $6.4B |
| Securities and futures firms | 1,504 | 4.4% | $784.5M |
| Other | 22 | 0.1% | $8.4M |
| Total | 33,904 | 100% | $12.7B |
The two largest groups see different parts of the scheme. MSBs, mostly crypto businesses, report victims sending tokens to addresses tied to scammers. Banks and other depository institutions report loan applications, second mortgages, and transfers described as investments. FinCEN notes that each filer captures only a snapshot of the scam’s lifecycle.
The proceeds end up in USDT, then move to Tron
The reports name at least 22 digital assets. Ethereum, Tether (USDT), and USD Coin (USDC) appear most often, and many bank filings don’t specify the asset at all. Using blockchain analytics tools, which trace transfers between public addresses, FinCEN found that scammers nearly always convert the proceeds into stablecoins, almost exclusively USDT. Decentralized finance protocols then move the tokens from Ethereum to Tron before they are sent to exchanges outside the US.
The alert sets a new SAR key term and lists 16 red flags
Institutions filing SARs on activity tied to scam centers should enter the key term FIN-2026-SCAMCENTERS in field 2 of the form and in the narrative, and select “Fraud-Other” in field 34(z) with the description “Scam Centers.” The alert lists 16 red flags, including substantial transactions in a stablecoin whose issuer advertises that it does not cooperate with law enforcement.
FinCEN also urges institutions to use voluntary information sharing under Section 314(b) of the USA PATRIOT Act. The provision gives eligible institutions a safe harbor from liability when they share information on possible money laundering or terrorist activity, including fraud.