Prepaid and Other Stored-Value Payment Instruments

• Criminals instruct mules to fund prepaid or stored-value accounts (e.g., reloadable gift cards, digital wallets) with illicit money.
• The mule then transfers or withdraws these balances, fragmenting the transaction trail and reducing direct linkage to the originating criminal organization.

• Criminals fabricate or modify top-up records, forging merchant information and transaction timestamps to legitimize suspect inflows.
• Weak oversight in stored-value platforms allows for the removal or alteration of questionable entries without immediate detection.
• Aligned with falsified supporting documents, these manipulated records present a convincing façade of normal usage and loading patterns.

Unlicensed MSBs load criminal proceeds onto prepaid cards or e-wallets without verifiable identification. These stored-value instruments are then spent domestically or withdrawn abroad, circumventing regulated wire transfers and making transactions exceedingly difficult to trace.

• Criminals top up and manage prepaid cards or digital wallets from behind a VPN, making their IP location appear to come from a legitimate or low-risk country instead of their true jurisdiction.
• Repeatedly shifting VPN endpoints across multiple sessions obscures consistent usage patterns and prevents financial institutions from flagging suspicious cross-border or high-risk activity tied to a specific location.

• Offenders use proxies when registering or reloading prepaid cards and e-wallets, hiding the true location of account creation and top-up.
• This obfuscation bypasses region-based restrictions and hinders IP-based analyses, enabling seamless movement of illicit proceeds across multiple jurisdictions.

• Offenders exploit open WiFi to register and fund prepaid accounts under different aliases or minimal KYC thresholds, evading consistent device fingerprinting.
• Rapid transfers among multiple prepaid balances created via shared hotspots impede banks' ability to detect linked patterns or correlate suspicious activity to a single user.

• Criminals use multi-hop VPNs to register or top up accounts from multiple or conflicting IP locations, evading region-based KYC or AML checks.
• The VPN layering hinders the detection of suspicious usage patterns or repeated device fingerprints, facilitating additional layering of illicit funds through stored-value balances.

• Criminals load multiple prepaid or stored-value cards with small sums, each remaining under identity verification thresholds.
• Subsequent withdrawals or point-of-sale transactions are similarly fragmented, concealing the funds' illicit origin by preventing any single card from exceeding reporting limits.

• Criminals load prepaid cards or e-wallets with small sums multiple times, ensuring each load avoids reporting or verification thresholds.
• These instruments often allow rapid, repeated reloads and transfers, making it easy to disguise the total volume of illicit proceeds.
• Multiple cards or wallets can be used in parallel, further dispersing suspicious activity across various providers.

• Criminals repeatedly load small amounts onto prepaid cards or similar stored-value services, evading transaction monitoring tied to larger sums.
• The ability to manage multiple prepaid instruments or e-wallets simultaneously allows smurfs to further divide and conceal the total illicit value being laundered.

• Criminals load illicit proceeds onto prepaid cards or vouchers and deposit them into gambling accounts in structured, low-value increments that resemble regular player transactions.
• Because these cards can be registered with limited or false personal data, they mask the true beneficiary, facilitating repeated loading and subsequent cash-outs without drawing significant scrutiny.
• The resultant ‘winnings’ withdrawals appear legitimate, making it difficult for authorities to trace the original illicit source.

• Criminals use fabricated or stolen ID documents to open or reload prepaid cards, e-wallets, or similar stored-value accounts.
• Remote onboarding procedures, often reliant on digital scans or automated databases, are susceptible to manipulated documentation.
• These instruments are then utilized to transfer or withdraw funds across various locations, further obscuring the illicit source.

• Criminals use forged or stolen personal details to pass KYC requirements for high-value or reloadable prepaid cards and mobile money accounts.
• By successfully posing as legitimate account holders, they load illicit funds, effectively layering transactions across multiple stored-value instruments.
• The fake documentation masks their real identity, complicating authorities' efforts to trace and freeze illegal assets.

Light-KYC prepaid cards accept self-declared names; loading high amounts onto cards registered to aliases allows spend or ATM withdrawal without triggering the original name’s risk profile.

Multiple e-wallets, mobile-money IDs, or reloadable prepaid cards are linked to the script; value is drip-fed in small increments and cashed-out elsewhere, turning a lattice of micro-balances into an opaque layering mesh.

• Criminals purchase prepaid cards or load e-wallets with illicit funds and then simulate legitimate purchases on their own storefronts.
• The resulting transactions appear as bona fide retail activity, while the stored-value instruments’ potentially weaker KYC channels and easy reload features help layer and obscure the original dirty funds.

• Criminals load or transfer small balances across prepaid cards or e-wallets to determine the level at which a provider enforces KYC or alerts.
• They then use the identified limit to conduct larger transactions that remain below detection parameters.

• Criminals load prepaid cards or e-wallets with illicit proceeds, labeling the transfers as personal or philanthropic remittances.
• Supporting documents, such as gift letters, provide a veneer of authenticity, mirroring typical remittance behavior and reducing suspicion.
• Minimal KYC requirements and the ability to rapidly convert or withdraw funds in multiple jurisdictions make these instruments easy to exploit while concealing true sources.

• Criminals convert illicit proceeds into prepaid cards, e-wallets, or vouchers and then use them for political contributions.
• This method allows them to circumvent conventional donor verification steps, especially when donation platforms accept these cards with limited background checks.
• Multiple stored-value instruments under different identities can collectively exceed donation caps without triggering alarms.

• Traffickers frequently purchase and reload prepaid debit cards with proceeds from forced prostitution.
• Funds are transferred or spent in fragmented patterns, making it difficult for institutions to detect large-scale laundering.
• Indicator #5999 highlights multiple purchases or reloads of these cards used to pay or receive funds from adult entertainment providers, directly aligning with this technique.

• Child exploitation offenders exploit prepaid cards or digital wallets with minimal KYC, enabling rapid loading and withdrawal of funds.
• Repeated small transactions or reloads on multiple cards obscure payment trails, making it more difficult for financial institutions to detect suspicious activities linked to child exploitation.

• Criminals load or withdraw value on prepaid cards in jurisdictions with lax KYC checks, limiting paper trails.
• Redeeming these cards across borders obscures the link to illicit proceeds, as minimal information is collected in secrecy-oriented regions.
• This method exploits regulatory gaps, bypassing standard transaction monitoring and impeding cross-border cooperation.

• Criminals acquire offshore-issued prepaid cards and e-wallets where weak or minimal KYC controls allow them to register under forged or unverified identities.
• They repeatedly load small amounts of illicit funds onto these instruments, staying under reporting thresholds to avoid triggering AML suspicion.
• Once loaded, these prepaid or e-wallet accounts can be used for cross-border transactions or cash withdrawals with limited oversight, effectively layering and dispersing illicit proceeds.

• Criminals exploit e-wallets and prepaid cards under offshore gambling operators with minimal identity requirements, depositing and withdrawing illicit funds disguised as legitimate gambling transactions.
• Their portability and limited transparency enable quick cross-border transfers, obscuring the true origin and flow of proceeds during layering.

• Criminals can load multiple prepaid cards in smaller increments to remain under reporting thresholds, then physically carry them across borders.
• Cards and e-wallet devices appear innocuous, reducing the likelihood of close scrutiny by customs authorities.
• Once in another jurisdiction, funds can be withdrawn or transferred, concealing their illicit origin and bypassing banking oversight.

• Criminals exchange in-game currency or items for gift cards and similar stored-value products, effectively cashing out without resorting to direct bank transfers.
• These instruments can then be redeemed online or in retail stores, obscuring the connection between the game-based origin and the final purchase or cash-out point.
• Repeated conversions minimize transactional footprints, complicating efforts to trace funds back to criminal sources.

• Criminals direct multiple collaborators to load small amounts of illicit funds onto prepaid cards or e-wallets, sidestepping more rigorous bank account KYC.
• This pooling of value under assorted third-party names creates a fragmented deposit record, obscuring the ultimate ownership of funds.
• The stored-value instruments can then be used to settle bills, repay loans, or move balances to the criminal’s preferred accounts without revealing the criminal’s identity.

Many issuers allow fully remote sign-up for prepaid cards and e-wallets, relying on automated identity checks. Criminals submit doctored or synthetic personal details multiple times from the same device, passing system checks and obtaining several instruments under different names. These stored-value accounts then facilitate rapid layering of illicit proceeds with minimal due diligence, as there is no face-to-face scrutiny to verify the true account holder.

• Criminals accessing compromised stored-value or e-money accounts, which were legitimately opened by victims, can deposit or receive illicit proceeds.
• Since the compromised account already has a transaction history, sudden large inflows or outflows attract less scrutiny.
• Quick transfers to external accounts or rapid balance withdrawals enable repeated layering.

• Criminals use complicit MSBs to load illicit funds onto prepaid cards or digital wallets, circumventing robust KYC/AML checks.
• The prepaid balances can later be spent or withdrawn in different locations, effectively concealing the criminal origins and volumes of cash.

• Criminals load stored-value accounts (e.g., prepaid cards) far beyond normal spending patterns, effectively depositing illicit funds.
• They later request partial refunds or systematically withdraw smaller amounts to emulate ordinary usage.
• Because refunds or withdrawals are processed by legitimate issuers, the payouts appear routine and obscure the original illicit inflow.

• Criminals load illicit proceeds onto prepaid cards or e-wallets, then perform multiple small withdrawals at ATMs or retail outlets.
• This incremental approach remains below reporting thresholds, converting digital balances into physical cash with minimal oversight.
• The reduced KYC requirements and ease of retail cash-outs make these instruments alluring for rapid, untracked cash conversion.

• Criminals load illicit funds onto prepaid cards or e-wallets, then place structured bets at the shop, staying below suspicious thresholds.
• Splitting the total funds among multiple stored-value instruments reduces the visibility of larger criminal proceeds.
• When winnings are withdrawn, they appear as routine gambling returns, obscuring the original illegal inflows.

• Launderers use prepaid cards or e-wallets to rapidly move funds into gambling platforms.
• By losing chips to a co-conspirator and cashing out, they obscure the initially loaded amounts.
• Minimal KYC requirements and quick transfers between multiple stored-value instruments further complicate tracing the illicit funds.

• Sub-agents load multiple small deposits onto prepaid cards, mobile money, or e-wallets on behalf of customers, circumventing direct KYC checks.
• These instruments allow easy layering by splitting funds across various stored-value accounts, making transaction tracing more difficult.
• The principal institution often views only the aggregated activity, failing to see the sub-agents’ individual transactions or the ultimate source of funds.

• Sub-agents load or reload prepaid instruments with criminal funds, exploiting lax or inconsistent KYC monitoring.
• Once funded, these instruments can be used or transferred elsewhere, fragmenting transaction records.
• The aggregator’s licensed name provides a veneer of legitimacy, while minimal documentation at the sub-agent level obscures the illicit source of funds.

• Offenders can load illicit funds onto prepaid cards or digital wallets in one currency and then exchange these balances for other currencies at selected exchange offices.
• The reduced KYC requirements of some providers allow repeated cross-currency transfers, fragmenting the audit trail across multiple jurisdictions and platforms.

• Cross-border agents exploit prepaid cards or mobile money accounts with limited KYC measures, enabling them to load illicit proceeds and transfer value internationally without drawing immediate attention.
• Multiple sub-agents can coordinate frequent small-value transfers across various stored-value platforms, further fragmenting transaction records and making suspicious patterns harder to detect.

• Criminals can acquire prepaid cards or digital wallets that require minimal identity verification, allowing them to deposit illicit proceeds with little scrutiny.
• These balances can be reloaded or spread across multiple accounts to obscure the transaction trail, enabling quick layering across jurisdictions.
• Because many providers lack robust KYC/AML oversight, funds flow outside traditional banking channels, masking beneficial ownership and origin.

• Criminals can acquire prepaid cards or e-wallet balances with false or minimal documentation.
• They then perform successive P2P transfers among multiple stored-value accounts, adding complexity to transaction tracing.
• Limited verification requirements accelerate layering, allowing criminals to quickly move funds beyond regulatory controls.

• Criminals register mobile payment accounts functioning as stored-value wallets under false or stolen identities, bypassing stricter KYC controls.
• These wallets allow the rapid loading and transferring of illicit funds in small increments across jurisdictions, making it harder for authorities to trace the money’s origin.
• By executing numerous transactions below reporting thresholds, launderers exploit fragmented transaction trails and inconsistent AML requirements among non-bank mobile payment operators.
• The ease of remote, app-based onboarding facilitates layering by quickly moving funds between multiple accounts and jurisdictions without triggering traditional banking scrutiny.

Criminals direct mules to acquire prepaid cards or load e-wallets in the mule’s name. The illicit funds are placed onto these instruments and rapidly transferred to other accounts or converted to cash. Limited KYC requirements for certain prepaid instruments make it easier to recruit individuals, who can then unknowingly or knowingly layer funds on behalf of criminals.

• Social media recruits set up or use stored-value accounts (e.g., e-wallets, mobile money apps) to receive smaller deposits, purportedly as compensation for simple tasks.
• Funds are quickly transferred or withdrawn to various recipients, exploiting streamlined onboarding procedures and low-value transaction thresholds.
• This rapid layering method leverages the convenience and cross-border functionality of stored-value platforms, hampering AML detection efforts.

• Romance scammers direct victims to set up or use e-wallets and other stored-value accounts that often require minimal identity checks.
• Funds, misrepresented as romantic gifts or support, flow through these accounts with reduced scrutiny, creating the appearance of innocent personal transactions.
• The emotional context discourages victims from questioning frequent or cross-border transfers, aiding the layering of illicit proceeds through smaller, disguised payments.

• Traffickers load illegal cash proceeds onto prepaid cards or digital wallets, distributing funds among multiple cards or accounts to avoid detection.
• These instruments often support cross-border usage and can be cashed out or spent without direct links to the original source of funds.
• Lower transaction scrutiny on reloadable prepaid instruments in certain jurisdictions helps criminals layer and integrate proceeds more inconspicuously.

• Criminals load illicit funds onto prepaid cards or digital wallets using false or incomplete identities, evading certain conventional bank checks.
• They then initiate multiple small cross-border payments to chemical suppliers, avoiding single large transfers that might draw regulatory attention.
• This layered approach reduces transparency, making it harder for financial institutions to identify the ultimate purpose of these stored-value transactions: buying drug precursors.

• Criminals use prepaid cards or e-wallets to collect and hold proceeds from pharmaceutical sales, benefiting from limited customer verification.
• Multiple instruments can be loaded with smaller amounts to avoid triggering reporting thresholds, then aggregated or transferred elsewhere to layer and obscure the source of funds.

• Fraudsters ask victims to load prepaid cards or digital wallets with so-called 'advance fees.'
• These balances are then redeemed or transferred by the criminals, often split across multiple accounts, impeding efforts to trace or recover the stolen funds.

• Government relief funds, such as unemployment benefits, are often loaded onto prepaid or stored-value cards, which typically require minimal documentation.
• Fraudsters submit counterfeit applications under stolen or synthetic identities to acquire multiple cards, then quickly withdraw or spend the funds in small increments.
• This fragmentation of illicit proceeds across numerous cards makes it difficult for authorities to trace and detect the overall fraudulent scheme.

• Government agencies frequently load unemployment benefits onto prepaid cards, which require minimal personal verification.
• Criminals exploit this ease of access by acquiring multiple cards under fabricated identities or through money mule networks.
• These cards allow near-instant cash withdrawals or transfers, effectively scattering the funds and hampering traditional financial tracking methods.

Lottery scammers often direct victims to send 'lottery taxes' via e-wallets or reloadable prepaid cards. These instruments feature rapid onboarding and minimal KYC checks, enabling fraudsters to collect numerous small victim payments. The funds are then transferred or cashed out with little oversight, complicating efforts to trace back to the original scam transactions.

• Criminals load or reload prepaid cards and digital wallets with relatively small amounts of illicit cash, typically below transaction reporting limits.
• Distributing smaller sums across multiple stored-value instruments makes it harder for authorities to piece together the overall funds flow.
• These platforms often have less stringent documentation requirements compared to traditional bank accounts, facilitating anonymity and reducing the likelihood of triggering AML alerts.