“Pao Fen” Payment Laundering

Understanding “Pao Fen” Payment Laundering and What It Means for Scam Recovery

Scam victims, families, and advocates often focus on the front end of the crime, which includes the approach, the grooming, and the loss. The losses feel personal because they are. Yet every transfer also flows into an industrial back end where organized groups launder, split, and move money at speed. A recent study by Fangzhou Wang examined the back end through a crime script analysis of “Pao Fen” operations, a Chinese term used for payment laundering networks that break up and route funds through layers of accounts to hide their origin. The study highlights how criminals build a repeatable process, how each role fits into that process, and where prevention can reduce harm. It also reinforces a difficult truth that helps with recovery. The crime was intimate on the surface, but it ran inside an impersonal system designed to separate people from their money and hide the trail. That knowledge supports steadier expectations, more realistic recovery plans, and calmer advocacy for victims and families.

What “Pao Fen” Means in Practice

“Pao Fen” describes payment laundering that pushes illicit funds through coordinated merchant accounts, personal accounts, and digital wallets. The goal is to make the money look legitimate by fragmenting transfers, using trusted channels, and passing through many hands. Romance fraud, investment fraud, tech support fraud, and extortion may start the flow, but “Pao Fen” converts those inflows into clean-looking outflows that are hard to claw back. The analysis by Wang applies a crime script approach, which maps a crime as a sequence of tasks and choices from preparation to cash out. That approach emerged in environmental criminology and rational choice theory, where researchers such as Ronald V. Clarke and Derek B. Cornish framed offending as a chain of decisions, each shaped by opportunities and controls. The method helps institutions pick points where disruption has the most impact. For victims and advocates, it explains why a fast bank call sometimes works, why it often does not, and why daily safeguards matter more than any single warning.

How Payment Laundering Connects to Personal Loss

Every dollar sent to a fake investment app, a romance scammer, or a sham recovery agent travels into a network. These networks recruit people to open or rent accounts, enroll shell merchants, and maintain pools of wallets and bank relationships. The flow often looks like this.

1. Intake. A victim pays by wire, bank transfer, gift card, or cryptocurrency. The receiving account sits in the network but may appear independent.
2. Splitting. Funds move into several accounts in small amounts. Transfers shift across banks, wallets, or merchants to avoid automated rules.
3. Layering. More moves follow. Each move adds distance between the original payment and the next destination. Records show routine commerce rather than fraud.
4. Cash out. The network cashes out through withdrawals, high-risk merchants, gambling sites, mules, luxury goods, or additional crypto paths.
5. Recycling. A portion funds the new lures, technology, bribery, or other costs. The rest pays for coordinators, recruiters, and runners who maintain the system.

Why This Structure Matters to Victims

A person may report a loss within hours and still hear that recovery is limited. The reason often sits inside the flow above. Many transfers become irretrievable after they pass a short window. Money mule networks and payment laundering exploit that window by moving funds across borders, across payment types, and across ownership layers in minutes or hours, and certainly within days. That speed reduces the chance of reversal and complicates jurisdiction. These constraints do not minimize the harm. They explain why fast action helps, why documentation still matters even if funds do not return, and why prevention and institutional controls carry so much weight.

Mechanics Of The “Pao Fen” Payment Laundering System

The “Pao Fen” model operates as an organized payment pipeline that turns many small deposits into clean, spendable funds. It functions through coordinated roles, tight timing, and rapid movement across accounts, apps, and borders. Understanding the inner workings helps families, advocates, and institutions recognize pressure points where disruption or recovery may still succeed.

Core Roles And Functions

• • Controllers coordinate the flow. A controller assigns tasks, sets daily targets, and tracks balances across dozens or hundreds of receiving points. Communication typically occurs through encrypted messaging, shared spreadsheets, and screenshots of balances.
  • Intake holders receive the first transfers. These may be personal bank accounts, rental accounts, business accounts, or stored value wallets. Some belong to recruited money mules. Others are bought or rented from account brokers.
  • Splitters divide the funds. A splitter breaks larger deposits into many smaller transfers that fall under automated alert thresholds. Splitting also mixes payments from different victims to reduce traceability.
  • Packers layer transactions. A packer stacks transfers between wallets, prepaid instruments, and bank rails to create a path with extra steps. Additional steps increase the difficulty of tracing funds back to the source.
  • Cash out specialists extract value. Cash-out teams move funds into cash, goods, or cryptocurrency. Routes include ATM withdrawals, point of sale purchases, gift card arbitrage, peer-to-peer swaps, and off-exchange crypto brokers.
  • Bookkeepers reconcile flows. A bookkeeper logs sender tags, amounts, timestamps, and fees. Many groups maintain a live ledger that shows which transfers have been cleared, which remain pending, and which require a new route due to holds or flags.

Transaction Flow And Timing Windows

• • Stage 1, intake. A first transfer lands in a target account or wallet. Notes in the memo field may use neutral terms, such as invoice or family support, to reduce scrutiny. When the deposit method supports instant availability but delayed final settlement, immediate onward movement occurs.
  • Stage 2, splitting. Within minutes to a few hours, funds move out in slices. Typical patterns include multiple outgoing payments under common trigger amounts, movement to different banks or wallets, and alternating rails, such as bank to wallet, wallet to bank, or wallet to wallet.
  • Stage 3, layering. The same money travels through two to five additional hops. Layering blends deposits from different sources and creates time gaps between movements. The goal is to outrun recalls and to confuse simple straight line tracing.
  • Stage 4, conversion. Teams convert balances into cash or hard-to-reverse instruments. Examples include ATM dribble withdrawals, merchant refunds to third-party wallets, commodity purchases, couriered cash pickups, and transfers to crypto that moves off the platform.
  • Stage 5, recycling. A portion of the proceeds returns to pay runners, account renters, and brokers. The rest finances new acquisition, including fresh accounts, identity documents, devices, and data.

Accounts, Apps, And Tools

• • Receiving points include personal current accounts, small business accounts, high velocity wallets, and prepaid cards. Many are mule-controlled. Some are stolen or rented. A single controller may operate dozens at once to avoid velocity limits.
  • Messaging hubs coordinate tasks. Encrypted chat channels provide shift schedules, playbooks, and backup routes. Bots assign tickets, confirm amounts, and log timestamps.
  • Verification props mask patterns. Screenshots of balances, edited PDF statements, and synthetic invoices make transfers appear routine. Some groups coach mules to answer bank calls with simple narratives, such as contractor payment or family support.
  • Device and network tactics reduce linkage. Operators rotate SIM cards, use new device identifiers, and switch networks to avoid repeat fingerprint flags. Public Wi Fi and mobile hotspots often appear in the early chain.

Recruitment And Compensation Of Money Mules

• • Recruiters target people who need funds quickly, value remote work, or already trust the criminal through a prior contact. Romance victims, students, recent migrants, and people in debt appear often. Offers use phrases such as payment processing, commission sales, or account assistant.
  • Compensation follows a tiered fee. A first-time mule may earn a small percentage per cleared transfer. Reliable mules move to higher tiers with bigger daily quotas and access to faster routes. Missed quotas can trigger penalties, which keeps pressure high.

Fee Structure And Incentives

Every hop has a price. Account rental fees, wallet fees, card cash-out spreads, and crypto broker spreads all reduce the principal. Controllers balance speed, risk, and cost. When a bank holds funds, routes shift to more expensive channels to maintain cash flow.

Evasion Patterns That Defeat Simple Checks

• • Amount slicing avoids common alert thresholds. Many outgoing transfers land just under limits that trigger enhanced checks.
  • Descriptor control shapes memos and notes. Neutral language reduces attention from automated systems and from support staff who review transactions.
  • Geo and rail rotation changes the path. Alternating banks, wallets, cities, and rails reduces the chance that a single institution can see the whole route in time.
  • Name similarity confuses beneficiaries. Beneficiary names may match common business terms or resemble legitimate vendors. Slight variations make tracing harder for hurried staff.

Weak Points And Intervention Windows

• • The first twenty-four hours often matter most. Many deposits remain reversible during this period, depending on rail and jurisdiction. Early bank contact, precise timestamps, and beneficiary details increase the chance of a hold or recall.
  • Concentrators create choke points. Even with many hops, funds often converge at one or two cash out nodes. Patterns include repeated ATM clusters, specific wallet IDs, and recurring merchant refund locations. Recognition at these nodes can trigger blocks.
  • High-risk narratives reveal themselves under questions. Simple, consistent questions about invoice numbers, contract references, or public contact numbers often expose a story that does not align with records.
  • Device and IP reuse produce links. Repeated sign-ins from the same device or network across different accounts can identify a controller. Banks and platforms sometimes act on this pattern faster than on transaction content alone.

Indicators, Banks, and Platforms Often Flag

• • Velocity spikes that do not match the account history. A quiet account suddenly processes multiple in and out movements on the same day or week.
  • Round number patterns and repetitive amounts. Repeated transfers at neat numbers, such as exact hundreds or thousands, suggest scripted movement.
  • Name and note inconsistencies. The sender, beneficiary, and memo terms do not align with known relationships or prior activity.
  • Geographic mismatch. Device location, IP address, or merchant location conflicts with the customer’s stated location.
  • Rapid refund or reroute requests. A request to return funds quickly to a different payee or account often indicates a counterfeit deposit upstream.

Why Recalls Often Fail After A Short Delay

• • Settlement outpaces detection. Some rails make funds available quickly, then settle irreversibly later the same day or next day. By the time the original bank detects fraud, the money has moved two or three hops away.
  • Mixing obscures origin. After splitting and layering, any single balance includes amounts from several sources. Receiving institutions may block accounts but cannot easily unwind individual components.
  • Conversion exits the banking system. Cash withdrawals, gift card purchases, and peer to peer crypto leave few practical recovery paths. Even when identified, those paths lack a built in recall mechanism.

Institutional Controls That Disrupt “Pao Fen”

• • Holds should be tied to history, not only amounts. Dynamic holds that consider account age, prior activity, and recent device changes slow abnormal flows without blocking ordinary use.
  • Callback verification to published numbers. Any change in payee, refund direction, or bank details triggers a callback to a number found on a public directory or signed document.
  • Maker checker controls for high-value movements. Two independent approvals reduce one person’s exposure to social engineering and pressure.
  • Concentrator monitoring. Repeated cash outs at the same ATM cluster, merchant refund location, or wallet pair generate reviews and, when warranted, closures.
  • Clear language for customers and staff. Short, steady scripts explain why holds exist, what verification steps will occur, and how to confirm identity and purpose. Consistent language reduces conflict and speeds resolution.

Key Insights from Crime Script Analysis

The study’s focus on step-by-step crime construction translates into insights that support prevention and recovery planning.

• Preparation matters most to offenders, not only to victims. Offenders scout banks and platforms, test new account types, and learn which anti-fraud rules trigger holds. They pre-stage accounts and people so money can move without delay. That planning is the source of their speed.
• Roles are specialized. Coordinators set up the system. Technicians manage devices, SIM cards, and remote access. Recruiters find account holders and merchant fronts. Cashers move money into goods, chips, or withdrawals. Each role can be disrupted by different controls, which means no single policy solves the whole problem.
• Routine disguises risk. Transactions are shaped to look normal. Descriptions match small purchases. Amounts stay under limits. Time of day appears ordinary. The network learns and adapts when rules change, then shifts to new channels.
• The path to cash matters more than the story. The relationship or investment tale brings money in, but the network’s survival depends on reliable paths out. Institutions that close the cash paths force networks to spend more time and money, which lowers harm across many cases.

What Families and Advocates Can Take from This Structure

Understanding the back end helps everyone set better goals. It also shapes care plans that match real conditions.

• Early reporting can still help. Banks and payment firms maintain recall and return processes for wires and transfers. The chance of success falls fast, yet early calls still create occasional returns, holds, or account flags that protect others. Advocates can help collect transaction identifiers, dates, amounts, channels, and counterparties. That information supports recall attempts, fraud claims, and law enforcement referrals.
• Documentation supports future remedies. Even when funds do not return, detailed records may matter for tax treatment, civil remedies, or future criminal cases. Notes also reduce the cognitive load on a person under stress. A simple log with dates, actions, and reference numbers creates order and helps with sleep.
• Recovery includes health, not only money. Stress, shame, and sleep disruption affect judgment. Trauma-informed support may improve concentration and reduce panic, which helps with follow-through on financial steps. Health care guidance for stress management and anxiety can support that process.

The System that Launders Money Also Recruits People

Payment laundering depends on people who rent or open accounts, sometimes without understanding the risk. In many jurisdictions, these people are called money mules. Some are complicit. Many are misled by fake jobs, romance, or investment pitches. Awareness campaigns and joint actions show how common this is and how often victims become targets for mule recruitment after the first loss. Europol’s annual operations and national initiatives report thousands of recruited account holders and thousands of blocked transactions each cycle. That scale underscores why prevention and reporting help more than one case at a time.

How Institutions Use Taxonomies and Crime Scripts to Reduce Harm

Standard terms help banks, police, and support organizations compare patterns across borders. When institutions align on what to call each step of laundering, they can place controls at the same points in the chain. Examples include holds on first-use accounts, limits on new merchants, alerts for changes to beneficiary accounts, and independent callbacks before high-risk disbursements. Crime script analysis helps design those controls because it shows where offenders must act, not only where they want to act. It also points to the human element, which includes training for staff who see unusual customer activity, such as repeated large transfers, off-platform payment requests, or urgent requests for refunds to third parties.

Learn more about the importance Of Taxonomies In Understanding Scams Fraud & Cybercrimes

What This Means for Victim Advocacy

Advocacy that reflects both the personal front end and the industrial back end sets realistic expectations and keeps people safer.

• Language that removes blame. Many victims apologize for not knowing what a bank knows or what a platform knows. Care plans work better when the language emphasizes that professional offenders study these systems for a living and build entire operations to defeat ordinary safeguards. The crime depends on preparation and speed, not on the victim’s character.
• A short list of high-value steps. The most effective steps are simple, repeatable, and tailored to real constraints. These may include an immediate bank call with transaction details, a written record of what happened, a police report for documentation, and a pause on all contact with the offender. Where funds left by crypto, a quick report to the exchange and a request for a hold can help, even when the chance feels low. These practices align with government and law enforcement guidance that emphasizes prompt reporting, transaction details, and safe communications.
• Boundaries that prevent repeat victimization. Many networks attempt follow-on contact in the form of recovery fraud. Families and advocates can help set simple rules, such as no fees to recover funds, no new investments to “unlock” withdrawals, and no payment method changes by email alone. These rules mirror public guidance on payment safety that flags wires, gift cards, and cryptocurrency as high-risk methods often abused by criminals.

Practical Patterns that Reduce Exposure

Because “Pao Fen” thrives on speed, volume, and believable routine, small changes in daily practice can reduce risk for many people. The tone stays compassionate when the changes are framed as care, not as judgment.

• Payment hygiene. Treat any instruction that involves wires, crypto, or third-party refunds as a high-risk event that merits a second channel for verification. The second channel may be a phone call to a published number or an in-person visit. This aligns with the way banks separate “available” funds from “collected” funds and with public advice that highlights irreversible methods as safer only with true verification.
• Two-step identity checks. Identity on a screen often looks convincing. A layered check that pairs a live interaction with an independent source lowers risk. That approach matches institutional identity guidance that prefers independent records over on-screen claims.
• Pause on refunds. Many laundering flows include a sudden request to keep a fee and refund the rest after a check or transfer arrives. A standing rule that refunds occur only after final collection and only to the original source closes a common exit path for offenders. Regulatory cases and bank guidance point to refund patterns as a known abuse vector in fraud-induced transfers.
• Support for those at higher risk. People facing isolation, grief, financial stress, illness, or cognitive change experience more pressure during a scam. Care that includes rest, food, and calm conversation may reduce haste and improve decision quality. Health guidance for the public echoes the value of routine and stress-reduction strategies in difficult periods.

What Families Can Do Without Taking Control Away

Families want to help, yet control from others can feel like a second injury. Crime script insights help balance care and autonomy.

• Agree on a time box. A person may prefer to take steps in short windows. A 30-minute block to call the bank, file a report, or move notes into a log can feel possible and protective.
• Use a shared facts sheet. A one-page sheet with dates, amounts, banks, wallet addresses, and contact names reduces repetition and misremembered details. That sheet travels to the bank, the police, and the counselor.
• Keep language neutral. Phrases such as “a crime occurred,” “funds moved by [method],” and “the network uses refunds and redirections” stay accurate without shame. This language mirrors institutional terminology and helps keep conversations calm.
• Expect limits. Banks, payment firms, and police operate inside laws and rules that define their authority. Some requests will not succeed. The person did not fail. The system has constraints. Institutional updates and action plans aim to reduce those constraints over time, including efforts to block mule recruitment, improve holds, and speed cross-border cooperation.

How Advocates and Support Programs Can Use These Findings

Programs that assist victims, run support groups, or educate the public can integrate these insights into materials and intakes.

• Intake questions that match the flow. Asking how money left, where it went first, and how quickly a refund was requested points to likely laundering stages. Those details shape what to ask from a bank, a wallet provider, or a merchant.
• Handouts that teach pathways, not labels. People remember what to do when the next risky moment arrives. A one-page handout that explains a pause, a second channel, and a refund rule reaches more people than a long list of scam names. Public agencies also emphasize behaviors over labels when warning about fraud-induced transfers.
• Training that covers mule recruitment. Many victims receive new pitches within days that seek their accounts for “work from home” or ask for help moving money. Clear examples and sample responses prepare people for that next wave, which helps protect their credit, their accounts, and their legal exposure. Joint operations and public bulletins confirm how active these recruitment efforts remain.
• Policy suggestions that target the back end. Advocates who advise institutions can use crime script points to suggest holds on first-use accounts, dual authorization for refunds above set amounts, and required call-backs from published numbers before any change in payment destination. These align with good-practice alerts and resource allocation plans in public strategies.

Why the Term “Crime Script Analysis” Helps

The phrase may sound technical, yet it offers a practical lens. It shows how offenders depend on routine, timing, and roles. It also shows how small changes break the sequence. In everyday life, that lens becomes a reminder to change one step. A single pause can prevent a transfer. A simple callback can expose a fake “broker.” A delay on refunds can block the cash-out. The method does not place blame on a person who was harmed. It moves attention to where the network is weak and where communities can act together.

Setting Expectations for Recovery

Many families want a clean win. Sometimes a recall lands in time. Often it does not. When expectations match how payment laundering works, the next choices come into focus.

Recovery may include money, yet it also includes calm sleep, safer routines, and fewer triggers. It includes protection against repeat attempts, documentation that supports any future claim, and community education that keeps others from harm. The study of “Pao Fen” operations contributes to that broader recovery because it translates the hidden part of the crime into understandable steps that can be addressed.

Practical Takeaways

For victims and families, three patterns often make the largest difference.

1. A pause before any transfer or refund. Pressure is part of the crime. A short pause lowers risk across almost every scam type. Public guidance that highlights irreversible methods reinforces this habit.
2. A second channel for anything that moves money. Verify with a phone call to a published number, a message to an official portal, or an in-person visit.
3. A log that captures facts and actions. Notes reduce stress, improve reports, and support sleep. The log becomes a private record of progress even when outcomes take time.

Looking Ahead

Payment laundering adapts to new tools, yet its needs stay visible. It needs accounts, time, and believable routine. Because those needs remain, coordinated efforts can keep closing gaps. Law enforcement and regulators continue to act against mules and enablers. Banks refine holds and alerts. Researchers refine taxonomies and decision points to focus controls where they work. Victim support grows more trauma-informed and more practical. The combined effect limits the reach of networks that depend on speed and confusion.

In the middle of loss, complexity can feel overwhelming. The back-end view offers a steadying frame. The crime felt personal because a person carried the story into a phone or a screen. The money moved because a network stood ready to catch it. That network can be frustrated by short, repeatable habits and by institutional changes that remove its oxygen. Families, advocates, and survivors can work inside that frame with clarity and care. The goal is safety that lasts, not perfection in the moment.

Glossary

• Account rental — A criminal rents access to a personal or business account for incoming or outgoing transfers. The real account holder may be misled by a fake job or quick-earn offer. This practice lets offenders move funds without exposing their own identities.
• Account warm-up — A newly opened or dormant account runs small, ordinary transactions to look legitimate. Normal-looking activity lowers scrutiny before larger flows begin. Offenders time the switch from warm-up to high volume to avoid early blocks.
• Anti-money-laundering hold (AML hold) — A temporary bank or wallet hold placed when activity does not match the account’s history or risk rules. Holds buy time for review and can stop onward movement if raised quickly. Clear dates, amounts, and counterparty details help staff act during the hold.
• Callback verification — A safety step that confirms payment changes by calling a published phone number. The source comes from an official website or a signed document, not an email link or text. This step blocks many refund redirections and false “new bank details.”
• Cash-out node — The place where digital balances turn into cash, goods, or hard-to-reverse value. Examples include ATM withdrawals, gift cards, gambling sites, and off-exchange crypto brokers. Stopping a cash-out node often protects many victims at once.
• Chargeback noise — A pattern where a collusive merchant invites or accepts disputes to explain abnormal activity. The noise hides the real purpose of the account. Refunds and disputes then look like normal retail problems.
• Concentrator wallet — A wallet or account that gathers many small transfers from feeder accounts. Money reconverges here before cash-out or conversion. Identifying a concentrator creates a useful choke point for blocks and holds.
• Controller — The coordinator who assigns tasks, tracks balances, and routes funds across many endpoints. Controllers use encrypted chat, spreadsheets, and screenshots to manage daily movement. One controller can direct dozens of accounts at once.
• Crime script analysis — A method that maps a crime as a sequence from setup to cash-out. The map shows who does what, when, and where small changes can break the sequence. Understanding the script helps families and advocates spot pressure points that still allow action.
• Cross-border settlement — Movement of value across countries through banks, wallets, vouchers, or cryptocurrency. The aim is to outrun recalls and complicate jurisdiction. Fast cross-border moves reduce recovery chances after short windows close.
• Descriptor control — The choice of memo lines, invoice numbers, and payment notes that make transfers look routine. Neutral terms such as “services” or “reimbursement” lower attention in manual review. Simple wording should never replace independent verification.
• Device fingerprint — A mix of signals such as phone model, SIM, IP address, and cookies that link accounts together. Laundering groups rotate devices and SIMs to break these links. Reused devices across many accounts can still expose a controller.
• Geo-rotation — Intentional shifts in device locations, IP addresses, or merchant points of sale. Rotation makes activity appear widespread and unrelated. Consistent geolocation mismatches remain a strong red flag.
• Instant payment scheme — A rail where funds become available immediately and may settle finally within hours. Fast availability encourages immediate onward moves. Rapid reporting gives the best chance to freeze transfers on these rails.
• Intake account — The first account or wallet that receives a victim’s money. Intake may be a personal account, a rented business account, or a wallet handle. Clear intake details help banks identify linked flows and possible recalls.
• Layering — A series of quick hops across accounts, rails, and instruments to add distance from the source. Layering blends money from many victims and obscures origin. Extra steps make simple straight-line tracing unreliable.
• Merchant refund abuse — A collusive merchant takes a card or wallet payment, then issues refunds to different destinations. The tactic creates the appearance of normal customer adjustments. Refunds to new payees merit immediate verification.
• Micro-transaction slicing — A large amount is split into many small transfers sent within minutes or hours. Slicing stays under common alert thresholds. Round-number patterns or repeated amounts still reveal risk.
• Money mule — A person who lets criminals use their accounts to move funds, sometimes knowingly and sometimes misled. Recruitment often targets romance victims, students, migrants, or people under financial strain. Mule involvement can create serious legal and financial harm.
• Off-exchange crypto broker — An individual or informal desk that buys or sells cryptocurrency outside regulated exchanges. Deals often settle by bank transfer, cash, or wallet-to-wallet swaps. These paths leave fewer formal records and speed cross-border moves.
• Off-platform verification — A check done through a source not controlled by the requester, such as a public phone number or an in-person visit. Off-platform steps uncover false identities and pressure tactics. This practice aligns with common payment safety guidance.
• Onward movement — The rapid transfer of received funds to new destinations after intake. Movement begins within minutes on many rails. Early action by the sending bank or wallet matters most before this step completes.
• Packer — The operator who adds extra hops across wallets, prepaid cards, and bank rails. Packing increases the work needed to trace funds. More hops also reduce the chance of a successful recall.
• “Pao Fen” — A term used for a distributed payment-laundering model that splits, routes, and blends illicit funds through many small transactions. The network relies on rented accounts, collusive merchants, and fast conversions. The purpose is to make stolen money look like everyday payments.
• Peer-to-peer transfer (P2P) — A wallet or banking feature that moves funds between individuals. Labels such as “rent” or “family” can mask fraud proceeds. P2P hops often fan out and then reconverge, forming a recognizable pattern.
• Recovery fraud — A follow-on scam that targets a prior victim with promises to retrieve lost funds for a fee. Criminals use past details to appear credible. Refusing fees, upfront payments, or “unlock” deposits helps block this tactic.
• Refund loop — A cycle where payments are taken and then refunded to different cards, accounts, or wallets. Loops add noise and create false trails. Legitimate refunds return to the original source after final collection.
• Runner — The person who executes transfers, operates devices, visits ATMs, or buys goods for resale. Runners work on quotas and shift schedules. Their activity shows clusters in time and place.
• Second-channel check — A verification step that uses a separate, published contact path to confirm money movement. The check may be a phone call to a listed number or a visit to an office. Consistent use reduces many fraud-induced transfers.
• Settlement finality — The point when a transfer can no longer be reversed on a payment rail. Availability may arrive before finality, which confuses expectations. Understanding the gap explains why speed matters.
• Splitter — The operator who divides one deposit into many small outgoing payments. Splitters aim to avoid thresholds and link analysis. Slicing patterns across several banks or wallets still leave signals for review.
• Stablecoin off-ramp — A path that converts stablecoins into local currency through exchanges, brokers, or peer markets. Off-ramps speed cross-border settlement and reduce bank visibility. Records still exist and can support law enforcement requests.
• Staging wallet — An intermediate wallet that collects small transfers before the next hop or conversion. Staging helps manage limits and timing. Repeated reconvergence at the same handle signals a laundering node.
• Straw account — A bank or wallet account opened by a real person but controlled by someone else. Some holders sell access; others are deceived. Liability and account closures often follow detection.
• Taxonomy — A standard set of terms that classifies scam and laundering steps in the same way across agencies and firms. Shared language improves reporting, controls, and education. Clear terms also help victims describe events without blame.
• Transaction memo — The note field attached to a transfer that describes the purpose. Criminals use neutral wording to reduce scrutiny. Memo inconsistencies with prior activity remain a warning sign.
• Velocity spike — A sudden jump in the number and speed of transactions through an account or wallet. Spikes that do not match history trigger reviews and holds. Calm, consistent records help staff separate victims from offenders.
• Verification playbook — A simple, repeatable set of checks used when money moves. Steps include a pause, a second-channel call, and a refund-to-source rule. A short playbook works better under stress than long lists of scam names.
• Wallet hopping — Rapid movement between multiple digital wallets to obscure funds. Hops often use small denominations labeled as everyday expenses. Fan-out and reconvergence reveal the pattern over time.
• Wire recall — A formal bank request to reverse a wire after fraud or error is reported. Success depends on timing, rail rules, and the funds’ current location. Exact timestamps, beneficiary names, and amounts increase the chance of a stop.
• Working window — The brief period after a transfer when holds, blocks, or recalls are still possible. Networks move funds quickly to close this window. Immediate reporting preserves options even when outcomes vary.