The FBI says crypto investment fraud cost Americans $7.3 billion in 2025. The criminal networks are now using AI to run the scams at scale. OpenAI last week wrote a report about the operations of a group in Cambodia that it shut down back in February.

The court documents are currently sealed, so we can’t see the full machinery yet. But a recent case in Queens lets us look under the hood…

In early 2023, Tiffany Yang befriended other users on Facebook Messenger using a fake profile under the name “Lily Lyst.” Eventually, Lyst would talk them into putting their savings into an investment platform that didn’t really exist.

In October, Queens District Attorney Melinda Katz charged Yang with stealing at least $2 million from 17 victims. By then, Yang had distributed over $5 million through 97 bank accounts that were tied to multiple shell companies all registered to her Flushing apartment.

Pig butchering runs on a script—a jingliao—that leads the victim to a fraudulent website to invest in virtual currency. The scammer coaches the victim and uses the fraudulent website to show fake profits and get the victim to invest more. The fattening of the pig.

Over the course of a year, Yang got one of her victims to put up to $1.1 million into what he believed to be his account on SpreadEx Ltd., a real gambling and investing service. She led him to a fake version of the site he used for months but once he tried to withdraw funds, the site disappeared—butchering the pig.

Investigators traced one victim’s $45,000 deposit into the supposed SpreadEx account and found Yang on the other end. The money had landed in the account of Jian Ma Foot Spa 2 Inc., one of at least 97 shell companies that bank records tied to Yang’s Flushing apartment.

Cloning business identities

The complaint named only six of the companies that Yang controlled. Running those names on Middesk’s entity graph didn’t immediately yield connections but it revealed a pattern in how they had been created.

The fraud network registered the companies in daily batches of three or more. They hijacked the identity of legitimate businesses, some with active licenses. Following that pattern, we found more than 20 real New York businesses whose identities were stolen around the same time that Yang’s companies were being registered.

Share The Middesk Brief

The fraudsters added a surname at the beginning of the new registered company name, such as Chen New Funny Nails Inc. or Chen Graceful Nails Inc., and registered them at the address of the real New Funny Nails Inc. The strategy got them past identity verification screenings at multiple major banks.

Those business bank accounts were ultimately where the stolen funds landed once the victims deposited what they thought were investments.

In October, law enforcement searched the apartment and found Yang in the living room. She had $80,000 in cash and checkbooks in the name of various companies from multiple banks.

The Largest Cryptocurrency Seizure In History

Schemes like Yang’s are usually run overseas. Days after Yang’s arraignment, U.S. authorities indicted Chen Zhi, chairman of the Cambodian conglomerate Prince Holding Group. They said Zhi allegedly ran a vast fraud and money-laundering operation and they were seizing about 127,271 bitcoin, worth roughly $15 billion.

The government says the bitcoin it wants to seize is the proceeds of “pig butchering” investment scams run at mass scale out of forced-labor compounds in Cambodia and laundered through Prince Group’s businesses.

Prosecutors alleged that Prince Group is part of a booming Southeast Asian scam economy built on trafficked labor. They pointed to an estimate of 350,000 people working in compounds across Cambodia, Laos and Myanmar that pull in up to $75 billion a year.

The compounds “housed vast dormitories surrounded by high walls and barbed wire, and functioned as violent forced labor camps,” prosecutors said. Workers are trained to build relationships with victims and to spin up social media accounts in bulk. Two facilities alone ran 1,250 phones controlling 76,000 social media accounts, according to court filings.

OpenAI said last week that a network of users in Cambodia used its models to “create and support the operation of fake online personas, generate and translate messages sent to scam targets, create promotional content for their fraudulent schemes, and assist with day-to-day operations.” The company shut the network down back in February. It did not say the network was connected to Prince Group.

Just like in Yang’s case, victims wired funds to shell companies registered in Brooklyn and Queens. They watched the fake balances climb and deposited more. If they asked to cash out, the scammers would go quiet.

Prosecutors say the stolen funds were then routed to the compound’s accounts and laundered back to Prince Group and its executives.

The New York Connection

Last month’s indictment talked about two members of a larger network in China and it said that the people were connected to a third man: Cheng Wei Huang.

A quick search on federal court records turns up two other cases involving Huang: a 2024 money laundering one and a 2023 kidnapping. Huang had posed as an FBI agent and abducted a couple in Queens, allegedly on orders of a local Chinese organized-crime figure. The couple had supposedly stolen from a crime syndicate they worked for.

Prosecutors linked Huang’s 2024 money laundering case to last month’s arrest in the pig butchering network. Neither Huang nor the recent arrests are tied to the Prince Group case.

Huang waived indictment and pleaded guilty in both of his cases but his sentencing has been repeatedly adjourned, a pattern that some might read as a cooperation deal. For now, his sentencing is scheduled for December but we might hear of other developments before that happens.

Leave a comment

Recently, The Miami Herald and Argentinian newspapers confirmed that the FBI was investigating the matter.

Apparently, as Argentina struggled to beat the magnificent and tiny Cape Verde, U.S. authorities were on a video call with Guillermo Tofoni, AFA’s longtime international match promoter until the parties had a falling out in 2021.

They were likely asking him about the man who took over after.

Argentina’s football team has been beating every single one of its opponents for over a month now and and today they might reach the World Cup final for the seventh time in the country’s history.

At the same time, U.S. authorities have been examining an alleged money laundering scheme involving the Argentinian Football Association (AFA), its president, Claudio “Chiqui” Tapia, and the association’s foreign agent.

Last December, Argentinian police raided AFA’s headquarters as part of a money laundering investigation initiated by the local tax agency. Authorities claim that the association’s biggest sponsors, Sur Finanzas, evaded billions of pesos in taxes. Local media says Tapia paved the way for Sur Finanzas to become the primary sponsor of AFA tournaments.

Weeks later, U.S. bank records obtained by sports promoter Guillermo Tofoni for a separate contract lawsuit against AFA revealed another strand. It showed AFA-related revenue handled by its commercial agent, TourProdEnter, whose Florida filings name Faroni’s wife, Erica Gillette, as manager and whose later bank records reportedly identify Faroni as an owner and signatory.

TourProdEnter transferred almost $57 million to about ten Miami companies described as having no verifiable operations, according to reports. The companies were registered under different managers but several shared addresses, agents or administrative infrastructure. Some listed managers denied knowing about the transfer to local media.

Reporters also identified roughly $8 million invoiced to AFA by five now-inactive Miami firms, with at least part of that route reportedly passing through TourProdEnter.

Now, FBI agents and federal prosecutors in Miami and Washington are reportedly examining TourProdEnter’s transactions.

There are a lot of entities, people and money involved. So, we decided to take a look and break it all down for you:

THE TIMELINE

THE FLOW

THE NETWORK

My name is Inti Pacheco and I’ll be your guide (most times). I’m a data journalist who worked for about a decade at The Wall Street Journal, writing about those topics.

We’re also here to collaborate and hear from our industry peers, customers, experts… and from you. Tell us what you think we should dig into 👀.

Subscribe now

… back to FinCEN

For a usually slow-moving agency, FinCEN has been on a tear during the first half of 2026.

Two years ago, FinCEN was mostly executing a Congressional to-do list, rolling out beneficial ownership reporting and extending anti-money laundering (AML) rules to new sectors. Now it has reversed course, delaying the investment adviser AML rule, gutting beneficial ownership reporting, and swapping process-driven compliance for an outcomes-based model.

Financial institutions and other organizations aren’t complaining. Or at least not a ton.

In June, FinCEN said fraud information can now be shared under the 314(b) safe harbor, which protects financial institutions from liability when they share information about suspicious activity. That includes transaction data, IP addresses, and device identifiers, among others.

The update dropped after the agency received 112 comments on its April rule proposal to reform programs fighting illicit finance. The agency said in its proposal that programs would be judged on effectiveness over process.

Overall, folks supported the direction of the rule but said it lacked clarity. Some basically said it was kind of pointless because of how vague some terms were.

“A bank can satisfy every element of the proposed definition and still run a program that fails to produce useful results.“ — iKinetiq Innovation Solutions president Stuart Brock.

We parsed the 112 comments about the proposal submitted on Regulations.gov by financial institutions of all sizes (and their big associations).

Here’s what they talked about:

Sharing more on fraud

Financial institutions have been enabled to share more information now that fraud offenses qualify as specified unlawful activities, the legal threshold to trigger the safe harbor.

Will it solve fraud? No. Are financial institutions satisfied? Not fully. But compliance experts and organizations who have been calling on this for years said it’s a step in the right direction.

The guidance for the Section 314(b) safe harbor requirements hadn’t been updated since 2020. Industry groups had long pushed FinCEN to explicitly cover fraud in the safe harbor, and Congress had broadly called for AML modernization.

It will make things easier for participants to fight fraud. It’ll definitely help the big fraud information-sharing networks owned by Nasdaq and a consortium that includes JPMorgan Chase. Banks and other financial institutions will have an easier time protecting themselves and each other.

Leave a comment

The Bank Policy Institute said the update was a “critical step in helping banks to disrupt fraud and scams in real-time.” BPI also said it encouraged Congress and other agencies to remove legal uncertainty and establish clear safe harbor for banks.

As of late 2020, there were over 7,000 organizations participating in FinCEN’s 314(b) program. There’s likely many more now but the agency stopped updating the number.

How was information shared before?

The big banks have had their own thing for a while.

JPMorgan Chase, Wells Fargo, and others, own a data consortium called Early Warning Services. It counts 5,000 banks, credit unions, payment companies, merchants and government agencies as members. It said it screened $11 trillion in payments and stopped $3.7 billion in potential fraud.

Some 2,800 organizations use Nasdaq’s FRAMLxchange, which lets them share data on suspicious activities under the 314(b) safe harbor.

Both Nasdaq and BPI/Clearing House, the trade group representing EWS’s bank owners, said in their comments that FinCEN’s rule proposal didn’t address the sharing mechanics to handle cross-institutional collaboration. A lot of what the new guidance says about information sharing was in the proposal comments.

Here’s how many of the comments submitted by trade associations, fintech companies and other financial institutions addressed topics that ended up in the 314(b) guidance:

How will things change?

Fraud teams hesitated to use 314(b) when fraud did not map cleanly to money laundering. The guidance will let them move fast and cross-institutionally, just like the fraudsters do.

A suspicion of fraud alone is now sufficient to trigger information sharing. Banks do not need to identify specific proceeds of fraud being laundered. Bank A can alert Bank B about the invoice scam the moment they suspect it, without needing to prove a money laundering connection first.

Neither EWS nor Nasdaq said much about the guidance but the update will work as a tailwind for both. Criminals often spread activities across institutions and these networks alert investigators about risky entities. These systems let investigators share notes and data to collaborate privately.

Assuming they share more information, businesses can benefit from faster resolution if their accounts get wrongly flagged. The catch is that fraud detection already generates false positives and faster signal sharing could make the problem spread across institutions.

This move means FinCEN is now trying to get the broader market to do what the big banks already set up for themselves outside the program.

The Middesk Brief decodes complexity for business owners and the institutions that serve them.

Tell us what we should look at in the comments:

Leave a comment