Spot the red flag
Ten scenarios drawn from real enforcement patterns. Pick an answer to see the explanation, and the technique page behind it.
-
A customer withdraws $50,000 in cash. The bank asks routine questions. The following month, the same customer makes six withdrawals of $9,500 over two weeks.
What should the bank do?
Shrinking withdrawals to just under the threshold right after being asked about a large one is the classic structuring pattern. It is the exact sequence that led to Dennis Hastert's conviction. SARs have no need for a threshold when the conduct itself is suspicious.
-
A small-town car wash reports revenue triple that of comparable businesses, stays flat through winter, and buys almost no soap or supplies relative to its claimed volume.
What's the red flag pattern?
Revenue out of line with peers, no seasonality, and supplier purchases too small for claimed sales are the signature of a cash-intensive front: the register records money that no customer ever spent.
-
A casino patron buys $80,000 of chips with bundled $20 bills delivered to the parking lot by a third party, plays a few hands of baccarat, and cashes out.
Why does this pattern matter?
Large cash buy-ins with little play, third-party cash drops, and bills bundled street-style were exactly what BC's Cullen Commission documented. The casino's cheque or chips give the cash a respectable origin story.
-
A student's checking account starts receiving e-transfers from a dozen strangers across the country, each forwarded within hours to an overseas account, keeping a small percentage.
What is the account holder acting as?
Inflows from many unrelated sources with rapid onward transfers, inconsistent with the holder's profile, is the mule pattern. Many mules are recruited through job ads or romance scams and keep a cut per transfer.
-
A company with no website, no staff, and a registered address shared with 4,000 other firms receives $8 million in 'consulting fees' and forwards it to a similar company in another jurisdiction within days.
What structure is this?
No operations, a mass registered-agent address, vague service labels, and pass-through flows are shell-company layering; each hop adds a jurisdiction an investigator must subpoena.
-
An exporter invoices 10,000 phone cases at $90 each to a related buyer abroad; identical cases sell wholesale for $9. The goods ship; the payment clears through trade finance.
What just happened?
Invoicing at ten times market price moves $810,000 of value under cover of commerce: over-invoicing, the core trade-based laundering move. Banks process the documents; almost no one reconciles price to market.
-
A US electronics wholesaler is paid for a Colombian client's order by three cashier's cheques from unrelated US individuals and a cash deposit made directly into its account by a stranger.
What system is the wholesaler brushing against?
Third-party payments from unrelated people on behalf of a Latin American importer is the BMPE signature: a peso broker is paying the exporter with a cartel's US cash while the importer pays pesos at home.
-
Two import businesses in different countries wire each other round sums monthly labelled 'settlement,' with no goods moving. Each also hands out local cash to walk-in customers referred by phone.
What are these businesses likely operating as?
Cash paid out on instruction with periodic netting wires between apparently unrelated firms is how hawala-style networks settle. The individual transfers never touch a wire; only the aggregate does.
Read the full explainer: Hawala and informal value transfer →
-
Minutes after a $40 million exchange hack, the stolen crypto splits across hundreds of addresses, converts to ether, crosses two bridges to other blockchains, and lands in a no-KYC swap service.
What is the goal of all that movement?
Rapid post-hack splitting, chain-hopping, and no-KYC swaps are about fragmenting the ledger trail across systems no single tool watches end to end. It is the pattern Lazarus Group runs at billion-dollar scale.
Read the full explainer: Chain-hopping and cross-chain bridges →
-
A wallet with no business history receives millions in dollar-pegged stablecoins from hundreds of small wallets, then moves the balance to an over-the-counter broker advertising 'cash settlement, no questions.'
What stage of laundering is this wallet performing?
Aggregating victim-sized inflows into USDT and cashing out through a no-KYC OTC broker is the standard scam-economy pipeline, the pattern behind the Huione Guarantee marketplace that FinCEN cut off from the US system.