OSINT & External Source Verification

OSINT & External Source Verification is a procedural and investigative measure enabling financial institutions to use publicly accessible information—such as government registers, news outlets, external databases, and social media—to validate the identities, business activities, and beneficial ownership of customers. By systematically cross-referencing internal records with external sources throughout onboarding and ongoing monitoring, institutions can detect discrepancies, hidden ownership tiers, adverse media, and suspicious patterns more rapidly. This enhances due diligence, improves the accuracy of risk assessments, and bolsters investigations, ultimately reducing the possibility of criminal entities exploiting financial services for money laundering or terrorist financing.

[
Code
M0021
]
[
Name
OSINT & External Source Verification
]
[
Version
1.0
]
[
Application Level
Tactical
]
[
Functional Category
Onboarding & Customer‐Related Due Diligence
]
[
Client Lifecycle Stages
Ongoing Relationship, Post Alert, Pre-Onboarding Engagement, Onboarding
]
[
Created
2025-01-23
]
[
Modified
2025-04-02
]

Client Lifecycle Stages

CL0004
|
Ongoing Relationship
|

Regular checks for adverse media or changes in beneficial ownership.

CL0005
|
Post Alert
|

Additional external intel gathering to investigate suspicious scenarios.

CL0002
|
Pre-Onboarding Engagement
|

Could be used to vet prospective clients or check new intel at account opening.

CL0003
|
Onboarding
|

Could be used to vet prospective clients or check new intel at account opening.

Mitigated Techniques

Use open-source data, registries, and negative media checks to confirm an entity’s physical operations and validate the legitimacy of officers or directors. Detect frequent changes in business addresses, directors, or abrupt dissolutions indicating ephemeral structures. This external verification layer reinforces the detection of shell entities established solely to launder funds briefly before dissolution.

Leverage open-source intelligence (OSINT), corporate registries, and external databases in each relevant jurisdiction to validate declared ownership and identify contradictory filings. By comparing internally gathered information with verified external sources, institutions can detect undisclosed ultimate beneficiaries and nominee directorships that facilitate multi-jurisdiction layering.

Cross-reference public databases, professional license registries, and media reports to validate an intermediary’s claimed role and uncover hidden connections or repeated mentions in high-risk transactions. This helps detect fraudulent straw men and nominee arrangements.

T0003.001
|
|

Leverage open-source intelligence and external data (e.g., blockchain explorer flags, industry advisories) to identify mixers that openly advertise minimal or no compliance. Cross-check deposit and withdrawal addresses discovered via OSINT to reveal undisclosed relationships with custodial mixers, exposing additional layering attempts.

Continuously collect intelligence on emerging decentralized mixers by obtaining wallet addresses flagged by law enforcement or reputable blockchain analytics providers. Cross-check customer or transaction data against these external sources to identify undisclosed connections to high-risk mixers, ensuring that suspicious activities are flagged or investigated promptly.

Utilize open-source intelligence channels to identify newly reported or suspicious burn addresses, minimal-KYC bridging platforms, and stablecoin-wrapping services involved in burn-and-mint activities. Cross-reference public data, social media forums, or blacklists to uncover potential illicit activity tied to these channels. This enables targeted monitoring or account restrictions for customers interacting with known high-risk addresses.

Leverage open-source intelligence tools and external databases to check whether certain bridging protocols or addresses have been associated with exploits, high-profile hacks, or laundering operations. Block or scrutinize bridging transactions with negative hits or suspicious media coverage, especially if they contradict the customer’s stated purpose.

Cross-check provenance claims and item authenticity using external databases, public records, and reputable art registries. Validate valuations and ownership histories against independent sources that track stolen artifacts or conflict commodities. By verifying or disproving client narratives with open-source intelligence, institutions can prevent criminals from disguising illicit capital through falsified artifact histories.

Leverage open-source intelligence tools and external databases (e.g., stolen artifact registries, cultural heritage authority records) to verify the authenticity of antiquities, check for reports of looted artifacts, and confirm the legitimacy of transaction parties. This step helps uncover potential red flags, such as artifacts listed as stolen or clients previously implicated in illicit deals.

Cross-check invoice and shipping details against publicly available import/export records, vessel tracking data, and commodity price databases. Verify that documented shipments match real-world events and pricing benchmarks to spot invoice tampering or fictitious consignments.

Cross-reference invoice details—such as shipping references, vessel identification, or logistics providers—with external registries and publicly available data. Detect patterns of repeated document usage, shipping routes, or cargo descriptions across multiple invoices. This verification approach exposes duplicative or overlapping references that support multiple invoicing schemes.

Use publicly available trade databases, price indices, and external data to confirm that billed amounts align with normal market rates. Cross-verify invoice claims against shipping documents, customs data, and international trade statistics to reveal hidden overpricing or self-dealing arrangements.

Leverage publicly accessible and specialized trade data (e.g., commodity exchange listings, shipping databases, trade registries) to validate invoice prices, quantities, and shipping routes. Any unexplained deviation from typical market values, volumes, or established logistics patterns should trigger further scrutiny for possible misinvoicing.

Use publicly available records, corporate databases, and investigative tools to verify registrations, nominee directorships, and any offshore addresses. Identify concealed or contradictory ownership details across external databases. By exposing discrepancies between claimed and official entity records, institutions can pierce layers of secrecy and detect asset cloaking structures.

Leverage public property registries, real estate listings, business directories, and media sources to validate claimed beneficial owners, track prior ownership changes, and verify market-consistent pricing. Cross-reference official documents with external platforms to identify potential under- or overpricing, repeated flipping among related parties, or newly formed corporate entities without transparent operations. This approach uncovers concealed ownership chains and artificial price manipulations often seen in real estate laundering.

Cross-verify declared ownership and reported income of revenue-generating properties using public records, property tax data, and market benchmarks. Identify hidden beneficial owners or inflated rent claims by comparing official documents, external asset listings, and property valuations to the customer’s disclosed information.

Leverage public property records, real estate databases, and relevant media—including foreign language sources—to verify the existence, ownership, and value of overseas properties. Cross-check corporate registries to detect overlapping control persons across multiple shell companies used for real estate acquisitions. These checks expose inconsistencies and concealed beneficial owners in cross-border property deals.

Validate claimed rent amounts, property ownership, and occupancy through public real estate records, online listings, or third-party databases. Confirm real market rental values and legitimate tenant activity to expose shell structures or contrived property arrangements that obscure the true origin of funds.

Cross-check buyers, sellers, and involved intermediaries in all-cash real estate transactions against public records, corporate registries, and adverse media. Validate the buyer’s declared wealth or income activities using external sources to confirm consistency with high-value property acquisitions financed with liquid currency.

Use publicly available property records, real estate databases, and valuation tools to validate the claimed purchase and resale prices. Identify large discrepancies between initial and subsequent sale amounts. Confirm short holding periods or unusual buyer-seller relationships that suggest intentional flipping for illicit fund layering.

Cross-check customer information (e.g., addresses, phone numbers, identity documents) against public records, social media profiles, and external databases to detect fabrications or inconsistencies. Specifically, flag the repeated use of overlapping personal details across multiple newly opened accounts. By exposing fraudulent IDs or contradictory data, institutions can prevent the formation of mule account networks.

Cross-check details in customer-provided paperwork with independent public registries, authoritative databases, and open-source intelligence to validate authenticity. Look for inconsistencies in corporate registration data, licensing details, or professional credentials that could indicate forged or altered documents.

Leverage shipping registries, online trade databases, and other publicly accessible datasets to validate alleged suppliers, shipping routes, and trade values listed in cross-border settlement documents. Check for mismatches between claimed shipment details and independently verifiable records to uncover fabricated or inflated invoices. This measure counters the use of fictitious data by criminals seeking to legitimize illicit flows.

Cross-verify declared transaction details, balances, or invoices with reliable external data sources, such as official registries, counterparties' records, or supplier statements, to reveal discrepancies. This external corroboration uncovers hidden alterations or fabricated supporting documents that deviate from genuine records.

Cross-reference specialized sector permits or compliance certificates with official government or industry licensing databases to verify issuance details and validity. Where possible, confirm authenticity by contacting the named licensing authority or relying on authenticated public registries. This measure detects falsified documents that criminals present as genuine compliance certificates.

T0013.001
|
|

Cross-check customer-provided MSB information against public registries, regulatory agency databases, and open-source intelligence to confirm valid operating licenses. Look for inconsistencies in claimed business addresses, phone numbers, or service offerings that may indicate a covert or unregistered MSB.

Leverage open-source intelligence to identify and verify the legitimacy of informal brokers, currency exchangers, and courier networks. Cross-reference licensing data and illicit activities to reveal NEP associations driven by off-the-record operations and unverified intermediaries.

T0013.004
|
|

Cross-check customers' public records, local directories, social media, and any reported affiliations with known hawaladar networks. Verify claims of family-based remittance services through external commercial registries or reputable sources. This helps uncover unlicensed hawala operators who rely on false or non-existent documentation.

T0013.006
|
|

Review public advertisements on social media platforms (e.g., WeChat, Weibo, Instagram, Xiaohongshu) that claim to offer bulk or recurrent shopping services. Compare these findings with the customer's actual transaction and shipping data to uncover large-scale Daigou operations disguised as personal, small-volume purchases.

Use public registries, mapping tools and social-media traces to confirm physical premises, identify vacant or virtual addresses, and surface adverse media on owners—steps that quickly invalidate fictitious operations.

Use public registries, local land records, industry reports, and agricultural market data to confirm the plausibility of declared prices for business acquisitions and farmland. Cross-check philanthropic or NGO claims for agribusiness ventures with verifiable indicators of actual operations. Detect mismatches between declared purchase values and known market norms to reveal manipulations commonly employed to launder illicit funds through a legitimate business facade.

Leverage external data sources, news articles, and social media to confirm whether a declared call center is legitimately operating, has actual staff, and is not flagged for scam or robocall activity. Investigate negative consumer reports, especially those involving the elderly, that suggest coercive or deceptive practices.

Cross-check the purported consulting entity’s online presence (e.g., professional listings, social media, public websites), licenses, and client testimonials to validate authenticity. Use external databases and media reports to pinpoint inconsistencies, such as nonexistent offices or staff, to uncover fake advisory operations designed to disguise illicit transactions.

Cross-reference official land registries and zoning data to detect unexplained farmland reclassifications or inflated property valuations. Investigate any affiliated foundations or NGOs to confirm legitimate philanthropic or operational activities, preventing the use of shell nonprofits to obscure beneficial ownership or launder criminal proceeds in the agricultural sector.

Leverage publicly available databases, industry registries, hallmark verification sites, and external trade data to confirm the origin, authenticity, and valuation of declared jewelry transactions. Correlate shipping or import details with customs records, local business listings, and gemological reports, ensuring any claims of special or locally crafted pieces match external evidence and recognized market data.

Cross-check entertainment budgets, sponsorships, and audience data against publicly available industry records, event listings, and external registries to detect fabricated or non-existent revenue streams. Verify cross-jurisdictional contractual arrangements, ensuring that all claimed distribution markets and beneficial owners are legitimate.

Leverage open-source intelligence, such as public company registries, media coverage, or local tax authority data, to verify declared revenues, real business activities, and beneficial ownership. Identify tax advisors or intermediaries previously implicated in tax evasion schemes. Investigate significant discrepancies between public information on company operations and the income or deductions claimed in tax filings.

T0016.005
|
|

Use open-source intelligence to verify any repeatedly used addresses, phone numbers, or email domains associated with sub-threshold deposits. This process uncovers smurfing rings that delinquently reuse contact information or utilize mailbox services, helping determine if apparent customers are actually coordinated depositors.

Leverage public records, adverse media checks, and social media analytics to scrutinize frequent or high-value gambling account holders. Verify the authenticity of stated addresses or identities and identify contradictory information, such as claims of local residence contradicted by foreign IP usage.

Regularly monitor open-source channels, dark web marketplaces, and public forums to identify listings of stolen or compromised in-game items. Cross-reference this intelligence with customer transaction data to detect involvement in illicit item trades. Escalate any matches for further investigation, focusing on customers who are swiftly liquidating large volumes of flagged game assets.

Cross-verify the legitimacy of charitable organizations and their leadership using publicly available data, registries, and media sources. Identify potential infiltration by extremist or criminal groups, detect inconsistencies in stated missions, and corroborate the organization’s philanthropic activities to ensure donated funds are used as intended.

Use public registries, academic accreditation listings, and other open data to verify the legitimacy of educational institutions, their leadership, and donor backgrounds. Investigate unexpected donor or ownership changes, and cross-check any suspicious cross-border affiliations or philanthropic claims with external records to expose potential layering or infiltration by illicit actors.

Regularly cross-check the legitimacy of declared mining farms or remote hosting providers through public resources, trade forums, and energy usage databases. Investigate claims of large-scale mining capacity to confirm authenticity, ensuring customers are not merely layering illicit funds behind fictitious or non-compliant operators.

T0020.001
|
|

Investigate remote or cloud-based mining operators using open-source intelligence, such as public corporate registries, media reports, and industry publications, to confirm the existence and capacity of claimed mining facilities. Identify any negative information that indicates substandard or nonexistent AML/KYC programs, which may reveal providers likely used for layering and sanctions evasion.

Cross-check vendor identities, addresses, tax registration numbers, and corporate details through official registries, third-party databases, and open-source intelligence. Validate claims of business operations, confirm the existence of employees, and detect anomalies indicating a fictitious or misleading vendor profile.

Cross-check customer-provided identity data with public records, social media, and external databases to validate credentials and detect mismatches or fabricated details indicative of synthetic or stolen identities. By verifying claimed residency, employment, or identity document issuance status in real time, institutions can proactively identify and prevent identity manipulation.

Corroborate submitted addresses, phone numbers, email accounts, and personal data against publicly available records (e.g., property databases, social media, business registries) to identify discrepancies. Investigate repeated usage of identical contact details or selfies across multiple applications, which often signifies the deployment of dark web 'KYC kits' or mass-produced forgeries.

T0023.002
|
|

Investigators run open-web queries for every historic alias and spelling variant, verifying whether the claimed “new” name appears elsewhere online in contexts that contradict the customer’s narrative.

Leverage open-source intelligence and external databases to verify the applicant’s history, identify negative reporting about specific CBI/RBI programs, and detect discrepancies in personal details. Investigate publicly reported allegations of corruption or fraudulent identity acquisition connected to these programs before onboarding or extending services.

Verify the legitimacy of potential investors, sponsors, and related parties by examining publicly accessible data sources, adverse media, and sports industry reports. Detect undisclosed politically exposed persons (PEPs) or individuals with criminal backgrounds attempting to mask their involvement in club financing.

Check the merchant’s online presence, domain age, reviews, and advertised product information against independent sources to confirm the legitimacy of e-commerce storefronts and product offerings.

Implement open-source intelligence checks to validate employers involved in payroll deduction loans, confirming active business operations, registrations, and legitimate addresses. This measure exposes front or shell employers used to obscure illicit repayment flows under the guise of standard wage deductions.

Use maritime databases, port registries, and other external resources to confirm actual shipping routes, cargo details, and counterparties. Cross-reference vessel tracking data with declared shipping manifests to detect inconsistencies, such as unexpected transshipment points or falsified documents. This tactic counters trade diversion by revealing deviations from declared shipping itineraries that conceal the true origin or recipient of the goods.

Use publicly available data sources (e.g., business registries, online marketplaces, social media) to validate the legitimacy of purported sellers, auction events, and actual product availability. Cross-check corporate addresses, business histories, and references to reveal sham auctions or fictitious merchandise, highlighting inconsistencies that standard documentation alone may not uncover.

Cross-check wallet addresses and transaction patterns linked to instant exchange platforms against public watchlists, illicit actor databases, and open-source intelligence to detect known suspicious entities or blacklisted domains utilizing rapid swaps.

Leverage external data, dark web intelligence, and blockchain tracing services to identify if self-hosted wallet addresses are tied to known criminal groups or illicit marketplaces. Compare declared usage or sources of funds with external evidence to detect misrepresentations and hidden associations.

Cross-reference business and owner information against external data, such as corporate registries and adverse media, to confirm legitimacy. Scrutinize any links to unregulated investment managers or dormant entities that could signal layered capital injections.

Cross-verify trade partners and shipping details through public registries, business records, or maritime/shipping databases to confirm the actual movement of goods. Investigate repeated changes in corporate addresses or beneficial owners that coincide with cyclical flows. Use external data and media checks to detect signs of phantom or fictitious trade activity intended to conceal the origin of funds.

Validate the declared transaction purpose by consulting publicly available data and reliable external databases. For instance, confirm that a purported charity is officially registered, or a claimed supplier has actual operational status. By comparing declared fund purposes with verified external sources, institutions can detect fictitious entities and sham transaction narratives.

Leverage publicly accessible data (e.g., verifying registered charities, confirming recipient identities on social media or official websites) to validate the legitimacy of declared family connections or philanthropic causes. Investigate inconsistencies in gift letters or claims of charitable involvement by cross-referencing external sources. Discrepancies indicating fake relationships or unregistered charities prompt further investigation and potential service restrictions.

Leverage public registries, shipping logs, corporate records, and other external data to validate the legitimacy of free zone businesses and confirm the ownership or existence of high-value assets stored in freeports. Such verification uncovers nominee structures, undeclared beneficial owners, and contrived trade flows intended to obscure illicit proceeds.

Compare stated asset values with data from reputable auction houses, public price databases, real estate registries, or recognized industry publications. By cross-referencing ownership or sale records with open-source evidence, institutions can pinpoint irregularities in appraised values and uncover efforts to pass off inflated or deflated prices as legitimate.

Consult public gemological databases, stolen jewelry registries, and industry watchlists to verify the authenticity and typical price ranges for jewelry pieces. Validate the identity and reputation of appraisers or dealers through external sources, ensuring that excessively inflated or undervalued prices are challenged and escalated for further review.

Validate high-value collectible valuations against recognized auction databases and price guides. Cross-check shipping routes or costs with open-source data. By confirming authenticity and realistic shipping expenses, institutions can expose artificially inflated or deflated prices used for layering in collectible trades.

Leverage open-source intelligence, art registries, appraisal databases, and news media to verify the authenticity and provenance of artworks, confirm the identity of intermediaries, and ensure declared owners match official records. Swiftly investigate any conflicting or incomplete corporate filings for shell companies used in art deals.

Cross-check arbitration claims and awards using publicly available legal databases, official registries, and media outlets to validate the parties' existence, operational history, and the dispute's authenticity. Confirm whether the arbitral tribunal is legitimate and whether the claimed dispute aligns with publicly documented events. Identify contradictions, newly formed entities with no prior track record, or inflated damages that suggest a fabricated or collusive proceeding. This measure exposes sham arbitrations designed to facilitate illicit fund transfers.

Verify reported judgments, lawsuits, and court records through publicly accessible court databases, media coverage, and other open-source intelligence. Cross-check the identities of judges, lawyers, and litigants against corruption allegations or unusual relationships. This addresses the risk of fabricated or coerced legal outcomes being used to launder funds.

Utilize external data sources (e.g., customs data, shipping registries, market indices) to verify trade documentation details, declared origins, and the authenticity of commodity valuations. Correlate declared volumes and values with official import/export statistics to uncover mismatches indicating concealed commodities or mislabeling. Investigate any indications of front operations or collusive trade partners.

Cross-check shipping routes and valuations against publicly available trade data, databases of licensed diamond traders, and Kimberley Process records. Closely examine any discrepancies in certification authenticity or declared origins to detect signs of smuggling or misrepresentation.

Leverage publicly available trade data, media reports, and government registers to verify declared shipment volumes, shipping routes, and suppliers. Cross-check alleged tobacco import activity against external sources to spot inconsistencies in product quantity, duty payment, or final destinations characteristic of cigarette smuggling networks.

T0049
|
|

Consult publicly available media reports, local jurisdiction records, and community advisories to cross-check customers reportedly implicated in intimidation or racketeering schemes. Correlate suspicious surges in deposits or revenue with documented extortion incidents to uncover coerced payment flows.

Leverage open-source intelligence and specialized cybercrime feeds to track ransomware-related wallet addresses or mixing services. Cross-check suspicious cryptocurrency flows against external data sources to confirm links to ransomware operations. This approach enables timely intervention when extorted funds appear within the institution’s channels.

Use open-source intelligence, such as local news, social media, and community alerts, to identify businesses or individuals subject to consistent extortion threats. Cross-reference suspicious transaction patterns with reported racketeering or paramilitary financing activities. When findings suggest protection payments, merge external intelligence with account data to bolster evidence for deeper investigation.

Verify counterparties, invoices, and claimed business activities against reputable external data sources (e.g., registries, third-party databases, media). Confirm that recorded transactions match bona fide trade volumes and timelines to expose fictitious revenues or fraudulent expense entries used to launder money.

Cross-reference declared accrual-based revenues and liabilities with publicly available data, corporate registries, and external financial sources to confirm that reported amounts align with legitimate business transactions. Identify inflated receivables or fictitious counterparties used to justify fraudulent accrual entries that mask illicit capital inflows.

Use public record searches, media reports, and official government documents to verify a public official’s declared financial standing and identify potential corruption charges or assets that exceed lawful income. For instance, cross-check official salary data with known high-value property acquisitions or frequent high-volume transfers. By contrasting customer-provided information against external sources, financial institutions can detect red flags indicative of misappropriation.

Review publicly available job postings or local advertisements indicating "cash-in-hand" or "off-the-books" wage offers. Cross-reference third-party sources, such as social media or labor forums, to validate whether the client promotes unrecorded wage policies. Flag evidence of active under-the-table recruitment for further scrutiny.

Cross-reference public databases, labor authority reports, and on-site observations to confirm the actual workforce presence. Identify mismatches with claimed payroll figures to reveal undocumented wage payments.

Leverage public databases, industry registries, and specialized resources (e.g., stolen or conflict mineral lists, gemological data) to validate the legitimacy of transaction parties and provenance claims. Cross-check reported suppliers or intermediaries against external watchlists and news sources for undisclosed risks.

T0055.001
|
|

Leverage open-source intelligence and official databases to validate gold dealers’ profiles, confirm refining or export details, and cross-check any claimed purity against external assay records. Any mismatches can reveal efforts to obscure beneficial ownership, reclassify bullion, or conceal real transaction values.

Leverage external industry references, recognized diamond price indices, and reputable trade databases to validate declared valuations and shipping routes. Cross-verify import/export documentation with public registers or third-party sources that track diamond trade flows. Confirm membership records in official diamond bourses or associations to identify unregistered, high-risk operators forging or tampering with shipping data.

Cross-reference declared lobbying or campaign spending with official government registers, public political finance filings, and open-source media. Verify the authenticity of philanthropic or nonprofit claims by examining event sponsorships, official meeting logs, and public disclosures of donor activities. Identify any indicators of fraudulent or non-genuine political contributions or lobbying efforts.

Leverage public records, industry databases, and NGO reports to verify environmental licenses, shipping logs, and declared beneficial owners. Cross-referencing these external sources can uncover forged documents or undisclosed owners behind front companies that are commingling illicit environmental proceeds.

Use public records, media reports, and external databases to verify the legitimacy of businesses and labor agencies suspected of masking human trafficking operations. Confirm operating permits, actual employee counts, and real corporate addresses or phone numbers. Identify mismatches in local records versus claimed operations to uncover shell entities exploiting forced labor or sexual exploitation networks.

T0058.001
|
|

Use public data (e.g., labor rights reports, business registries) to validate an employer’s workforce representation, wage levels, and labor-law compliance. Investigate media mentions or adverse findings that point to forced labor, ensuring any hidden coerced labor operations are uncovered despite deceptive or incomplete customer disclosures.

Integrate adverse media checks, social media scans, and law enforcement bulletins into onboarding and ongoing reviews for entities related to adult services. Confirm legitimacy by cross-referencing public records on business licensing, past convictions, or negative news items indicating forced prostitution or exploitation of minors.

Cross-reference social media and gaming platform handles provided in payment memos, checking open-source intelligence for indicators of underage exploitation or known grooming networks. Leverage external databases and public records to verify whether purported children's charities or payment beneficiaries have legitimate operations and no historical ties to child exploitation. Investigate discrepancies or adverse information swiftly, updating risk profiles and alerting compliance teams of red flags.

Use public records and independent third-party data to verify references to "travel services" or "visa processing" in client profiles and transaction narratives. Confirm the legitimate operations, licensing, and staffing of companies claiming to offer immigration or transport services, and identify any front businesses funneling smuggling proceeds.

Continuously monitor adverse media reports, public registries, and industry databases to identify professional intermediaries previously linked to suspicious or criminal activities. Cross-check their claimed services, corporate involvement, and beneficial ownership associations. Alert AML teams when evidence suggests repeated enabling of concealed transactions or other red flags related to gatekeeper abuse.

Cross-check declared ownership and investment details against public databases, corporate filings, credible media, and negative news sources to uncover undisclosed owners or suspicious relationships. Apply enhanced scrutiny when funds are domiciled in multiple high-risk or secrecy jurisdictions, identifying any shell entities or undisclosed controlling parties. This proactive approach exposes potential layering or nominee structures employed within complex investment funds.

Use open-source intelligence and external databases (e.g., company registries, media reports) to verify the legitimacy of the foreign investor’s ownership, track record, and claimed funding capacity. Identify shell or phantom entities by confirming actual business operations or uncovering negative media that indicates money laundering or fraudulent conduct.

Conduct external source checks on CBI/RBI investment claims, including market comparisons of real estate prices, verification of business structures, and review of media or other public records. Identify discrepancies in quoted valuations or beneficial ownership data to detect inflated investments or concealed ownership typically exploited under CBI/RBI programs.

Leverage official company registries, regulatory filings, media reports, and other open-source data to confirm the background of private fund operators, identify past regulatory sanctions, and uncover undisclosed nominee or shell affiliates. Verify investor claims and check for negative media or court records indicating fraud or asset parking. This measure targets the technique's reliance on secrecy and limited transparency to hide the illicit origins of capital.

T0061.004
|
|

Check publicly available data (e.g., commercial registries, news reports) related to bond purchasers or the corporate entities they use. Investigate discrepancies between claimed backgrounds or sources of wealth and actual findings, paying particular attention to the repeated use of relatives or proxies where formal business justification is absent.

Cross-check the purported identity and background of customers presenting foreign government IDs or non-traditional documents with open-source data, such as public records, governmental websites, or news outlets. Confirm the legitimacy of offshore addresses and personal details to detect fabricated or opportunistically provided false information.

Cross-check offshore licensing claims against official regulators and public databases to ascertain the legitimacy of gambling operations. Investigate domain registrations, social media presence, and corporate data to uncover mere shell setups or hidden owners posing as authorized operators.

Examine publicly accessible databases, corporate records, and open-source intelligence to confirm the legitimacy of offshore entities receiving or sending funds. Identify the repetitive use of shell corporations, undisclosed beneficial owners, and negative media or regulatory actions that signal potential layering or hidden ownership structures.

Examine public NFT marketplace data, creator profiles, and social media channels to verify the authenticity of NFTs and detect coordinated or fraudulent sales. Cross-check suspicious buyer and seller addresses against known wash trading indicators to expose self-dealing or fabricated ownership claims that underpin NFT-based value obfuscation.

Check wallet addresses and bridging platforms against open-source data, adverse media, and public advisories. Investigate entities tied to known mixers or sanctioned sites, ensuring suspicious cross-chain bridges are flagged or escalated for further review. This augments due diligence by exposing illicit connections often hidden in decentralized environments.

Leverage public blockchain explorers, decentralized governance forums, and external data sources to confirm legitimate governance participation if claimed. Investigate addresses linked to token hacks or flagged for suspicious behavior, exposing transactions inconsistent with normal governance token usage and revealing hidden laundering chains.

Cross-reference public blockchain explorers, aggregator data feeds, and known high-risk wallet lists to identify suspicious or blacklisted DeFi addresses. Investigate wallets documented in external intelligence sources for illicit activity or yield manipulation. Escalate findings for enhanced reviews or service restrictions when red flags arise.

T0067.005
|
|

Leverage public block explorers, watchlists, and specialized negative media checks to uncover suspicious wallet addresses, known layering patterns, or illicit projects harnessing utility tokens. Verify claims of legitimate token usage by consulting external data sources and identifying unregistered or fraudulent platforms used to disguise illicit flows.

Cross-reference declared employees and contractors with public records, social media, or external databases to verify their existence. Investigate if alleged staff lack any legitimate digital footprint or if "mini umbrella" entities share identical ownership attributes, which may indicate possible payroll fraud.

Cross-check declared cargo and shipping details against publicly available shipping schedules, vessel or flight tracking data, and customs records. Confirm the existence, routes, and timing of shipments to detect fabricated or 'ghost' cargo. Validate whether the listed shipping companies and freight forwarders legitimately operate in the claimed trade routes and handle the stated goods. This independent validation uncovers discrepancies indicating falsified shipping documentation.

Use publicly available trade databases, vessel tracking systems, and port authority reports to validate invoice details and shipping documentation. By cross-checking purported shipment dates, routes, and cargo details against external sources, institutions can identify phantom shipments, inflated valuations, or forged bills of lading central to fictitious cross-border trading schemes.

T0069.002
|
|

Cross-check container numbers, port entry records, and shipping addresses using public databases, freight registries, and port authority schedules. Investigate mismatches or unverifiable routes that suggest no actual cargo movement. Document all findings and escalate any sudden or unusual changes in shipping details.

Cross-check claimed business activities and shipping routes against external databases, trade registries, and publicly available data. By verifying company addresses, phone numbers, and shipping references, institutions can uncover non-existent operations or fabricated shipping details used in circular L/C structures.

Use public records, media sources, and external databases to verify the identity and legitimacy of the buyer, as well as the exporter’s operational capacity. Cross-check business registrations, physical addresses, and industry references to detect anomalies or non-existent entities in contracts used to secure pre-shipment finance.

Check publicly available records, business registries, and media sources to validate the identities of outside payers. If discrepancies or negative information surface, escalate for a deeper review to determine whether third-party depositors are complicit shell entities or linked to known criminal networks.

Verify shipping routes, vessel data, commodity pricing, and cargo movements through external databases, trade publications, or satellite tracking to spot inflated invoices or phantom shipments. Matching real-world shipping information against claimed commercial activity helps uncover inconsistencies in advanced payment clauses or non-existent goods.

Investigate the validity of trade counterparties and shipping details using open sources, external databases, and shipping-line confirmations. Confirm the physical existence of goods, check counterparties' operational histories, and identify anomalies such as shell or front entities. This helps uncover phantom shipments or inflated transaction values typically used in Bill of Exchange Fraud.

Leverage external data sources, such as vessel tracking platforms, trade registries, or import/export databases, to confirm the legitimacy of shipping routes, counterparty information, and cargo details. This helps uncover forged documentation or inflated claims in red/green clause transactions.

Cross-check customer-provided identity details against publicly available records, social media footprints, and third-party databases. Mismatches or the absence of corroborating information can reveal fabricated or stolen identities. This mitigation directly addresses impersonation by confirming the legitimacy of shared personal data.

Cross-check remote applicants' personal data and identity documents against open-source intelligence and official databases to validate authenticity. Confirm that the claimed individual exists and detect anomalies, such as repeated use of the same stolen identity or inconsistent details across multiple accounts.

Use external maritime databases, vessel registries, and publicly available data to validate shipping details (e.g., vessel names, routes) and cross-check any suspicious or incomplete bills of lading. Identify mismatches in declared goods, shipping dates, or port calls, which can signify fictitious or altered shipment documents.

Corroborate participants’ trade claims, shipment details, and declared beneficial ownership structures against publicly accessible data sources such as global shipping logs, customs data, and official corporate registries. This independent review uncovers forged documents, undisclosed relationships, and misrepresented trade activity used to justify inflated loan amounts.

Leverage public data sources and external records to validate the legitimacy of counterparties, confirm stated commodity values, and cross-check shipping or import/export documentation associated with countertrade. By identifying discrepancies or repeated transactions with no business rationale, institutions can detect hidden beneficial owners, inflated valuations, or the use of high-risk jurisdictions typical of countertrade laundering methods.

Cross-check the beneficial ownership and directorship details of bidding entities through public registries, media, and other open sources to identify overlapping ownership or repeated use of contact information. This helps uncover nominally competing firms colluding in tender processes.

Cross-check shipping data, third-party trade databases, and commodity price indexes to validate that declared invoice values and currency exchange rates align with actual market conditions. Confirm counterparty legitimacy by verifying operational presence, corporate registries, and any indicators of shell or front companies operating across multiple jurisdictions.

Cross-verify official credentials and affiliations with publicly available sources, such as government registries, accredited embassy listings, and reputable news outlets. This ensures that claims of diplomatic status or state ownership are valid and highlights potential corruption or reputational red flags hidden behind privileged categories.

Validate the legitimacy of insured assets, including maritime vessels or other high-value items, by consulting open-source intelligence, maritime databases, and asset registries. Confirm beneficiary details against external records to detect phantom or inflated assets behind offshore insurance claims. By requiring proof of actual insurable interests, institutions can mitigate fabricated claims and undisclosed beneficial owners.

T0086.001
|
|

Leverage publicly available data, media reports, and external databases to validate the legitimacy and backgrounds of policyholders, beneficiaries, and premium payers, particularly those from high-risk or secrecy jurisdictions. This helps uncover undisclosed relationships or adverse information often used to conceal beneficial ownership in early surrender strategies.

Leverage public records and databases to verify beneficial owners, policyholders, and beneficiaries. Cross-check the credibility of stated sources of wealth or connections, particularly where annuity participants are based in secrecy-friendly regions or appear under multiple corporate layers. Escalate findings for Enhanced Due Diligence (EDD) if discrepancies are found.

Leverage public records, corporate registries, and external databases to confirm the validity of newly added or substituted beneficial owners. This includes checking credible media sources and cross-border filings for discrepancies, ensuring that self-reported ownership changes are accurate and not designed to hide the true owner. When feasible, compare changes to official documentation from the relevant jurisdiction.

Cross-check newly introduced signatories or beneficial owners using publicly available data, corporate registries, and other external intelligence sources. This process can unmask undisclosed ties among accounts, fabricated identity documents, or repeated use of nominee data to obscure genuine controllers.

Cross-reference trust documentation, trustee backgrounds, and beneficiary details with public registries, media reports, and court records to uncover undisclosed ownership links or contradictory information. This is particularly vital for trusts formed in secrecy-friendly jurisdictions where formal ownership disclosure is minimal or inconsistent.

Cross-check newly added or substituted beneficiaries and policyholders against external data sources (e.g., corporate registries, open media) to validate their legitimacy and determine whether they are linked to shell entities or lack verifiable ties to the original policy. This measure uncovers disguised ownership networks and disrupts attempts to launder funds through repeated beneficiary substitutions.

Leverage external insurance databases, corporate registries, and open-source intelligence to confirm the legitimacy, licensing, and operating history of insurers and reinsurers. Validate the plausibility of stated premium levels and claim activities by cross-checking with public records, industry benchmarks, and negative news sources. This ensures that shell or unlicensed insurance entities are quickly identified and mitigated.

Cross-check captive insurers, reinsurance partners, and parent companies with public registries, media sources, and industry databases to confirm their operations and legitimacy. Investigate the backgrounds of beneficial owners and verify claim events to uncover shell operations or fabricated coverage used to launder illicit proceeds.

Cross-verify key financial data—such as invoice values, commodity prices, shipping channels, or contract terms—against independent sources, including public databases, external trade registries, or counterparties’ official documents. Discrepancies between internal data and external confirmations may indicate deliberate record tampering to mask illicit transactions or misrepresent trade details.

Continuously monitor social media channels, message boards, and other open sources for false or misleading statements intended to drive asset prices. Cross-reference external hype campaigns with suspicious market indicators (e.g., sudden price surges, spikes in trading volume) to identify pump-and-dump schemes. Investigate sources of promotional content coinciding with manipulative trades to expose collusion or orchestrated price manipulation.

Leverage public regulatory filings, negative media, and other open data to identify stocks or entities previously implicated in pump-and-dump, spoofing, or other manipulation schemes. Cross-reference flagged names with internal trading records to proactively detect attempts at orchestrated market manipulation, allowing timely compliance intervention.

Leverage publicly available databases, local property filings, news reports, social media, or other open sources to identify undisclosed transfers, control changes, or suspicious asset ownership claims. Cross-check declared details against official records to detect off-the-record or informal deals that do not match documented registrations.

Cross-check reported fund performance, investor profiles, and beneficial ownership data using public records, regulatory filings, and reliable industry sources. This helps uncover inconsistencies in valuation methods, unregistered fund activities, and implausible returns, enabling financial institutions to recognize manipulated investment schemes masquerading as legitimate fund operations.

Leverage publicly available data, such as corporate registries, local media, and social media platforms, to confirm that declared collateral is genuine and that borrower or lender entities have real business activity. This helps detect shell companies purporting to issue loans, fabricated business operations, or inflated asset values. By validating external information, institutions limit reliance on potentially falsified records.

Use public records, business registries, media reports, and social media to confirm the existence, industry experience, and reputation of consultancy or service firms receiving large contract payments. Look for verifiable operational history, credible client references, and consistent corporate information to validate that intangible services are not purely nominal.

Leverage public records, business registries, and open-source intelligence to verify the consulting firm’s declared operations, official registrations, client portfolio, and physical presence. Confirm legitimate business activities, staff credentials, and contract deliverables to detect bogus or exaggerated consulting engagements that may be used to commingle illicit funds.

Use publicly available and subscription-based data on known Darknet addresses, illicit wallet clusters, or flagged mixing services to validate customer-claimed wallet addresses and transaction histories. Correlate this intelligence with internal data to uncover hidden ties to underground marketplaces and layering schemes.

Cross-check purported creditors using publicly available data: confirm registered operating addresses, phone numbers, and any regulatory listings. Investigate discrepancies such as nonexistent business premises or vendor details overlapping with company insiders. This validation process helps expose false or non-operational creditors.

T0107.001
|
|

Use open-source data and official lottery bulletins to validate large or suspicious lottery claims. Confirm that the customer’s name, date, and place of the winning ticket match public or issuer records, and investigate evidence of third-party ticket purchases or transfers. Discrepancies in reported ownership or timing can reveal instances of criminals buying legitimate winning tickets to mask illicit funds.

Verify changes in corporate ownership or beneficial control of betting shops through open-source records, local business filings, and adverse media checks. This helps detect covert acquisitions by criminal networks seeking to mask illicit activity with legitimate gambling operations.

T0107.005
|
|

Continuously monitor open-source intelligence, sports integrity databases, and media reports to identify known or suspected instances of match manipulation. Correlate suspicious transaction activity with publicly reported match-fixing events or indicted sports participants, ensuring that flagged accounts or bets receive immediate scrutiny. By leveraging external intelligence, institutions can rapidly confirm ties to rigged matches and take swift action to thwart illicit fund flows.

Use publicly available data and external databases to confirm the legitimacy and licensing status of declared gambling venues. Investigate references to underground gambling networks and cross-check customer claims of substantial winnings against official records, escalating cases where purported operators cannot be validated.

Cross-check declared auction item valuations, including real estate prices, with credible external resources such as public records, appraisal databases, or reputable online platforms. This step reveals discrepancies between stated and actual market values and identifies overlapping beneficial owners, thwarting artificially inflated bids and repetitive ownership loops.

Cross-check declared buyer or corporate information against public records, databases, and media sources to validate business legitimacy and identify undisclosed connections. Investigate negative media or known affiliations that might reveal shell companies or straw buyers exploiting auction anonymity.

Systematically verify the authenticity of medical and hardship documentation by cross-checking healthcare provider credentials in official directories, comparing signature samples, and confirming facility addresses through open-source intelligence. This prevents fraudulent claims by uncovering forged or non-existent medical services used to justify early superannuation withdrawals.

Cross-check declared shipping routes, vessel timetables, and cargo details using openly available maritime trackers, shipping databases, and port authority records. Compare these external findings with customer-supplied trade documentation to uncover potential discrepancies in shipment quantity, destination, or commodity type. This measure addresses the vulnerability of forged shipping records and non-existent cargo by verifying actual cargo movement and port stops.

Validate product certifications and documentation related to warehoused goods against recognized industry databases, public registries, and reputable third-party sources. Conduct spot-checks for forged or expired certificates (e.g., precious stones or commodities) and identify flags in adverse media that indicate warehouse-based smuggling or laundering schemes.

Cross-check sub-agent addresses, declared beneficial owners, and operating licenses with public records and reputable external databases. Investigate anomalies such as sub-agents operating from undisclosed or duplicate locations, or multiple sub-agents sharing identical beneficial owners without a legitimate business rationale to detect potential shell or fraudulent operations.

Use publicly available business registries, watchlists, and other external intelligence sources to confirm that currency exchange operators are properly licensed and regulated. Investigate counterparties for signs of repeated cross-border layering, collusion with complicit exchangers, or patterns of exploiting weak AML regimes. Conduct these checks at onboarding and periodically thereafter, especially for high-volume accounts.

Cross-check customer claims and wallet addresses against publicly available data and external intelligence to identify involvement with blacklisted platforms or addresses known for privacy coin laundering. Validate that the stated usage of privacy coins matches verifiable business or personal details, such as public profiles and online commerce activities.

Leverage public carbon credit registries and external data sources to confirm the legitimacy of carbon credit projects and associated brokers. Investigate any reported fraud, tax violations, or negative media regarding the intermediaries, and verify stated beneficial ownership structures to expose shell entities posing as legitimate carbon credit companies.

Use external databases, business registries, and media checks to validate the legitimacy of customers and counterparties in cross-border payment chains. When payment messages are missing LEIs or beneficial ownership details, verify the entity’s existence and business rationale to prevent reliance on anonymized or fictitious overseas relationships.

Check local intermediaries' profiles against publicly available data, negative media, and social platforms to uncover any ties to smuggling or illegal facilitation. Validate each sub-agent's claimed business functions and cross-reference findings with internal records. This approach reveals repeatedly used 'fixers' or shared links to known criminal networks across jurisdictions.

Leverage open-source data and border control information to validate the authenticity and frequency of declared cross-border currency entries. Investigate any repeated use of identical customs forms or irregular travel patterns that suggest declarations are being fabricated or inflated.

Leverage open-source intelligence and external registries to verify the legitimacy of corporate or shell entities funding asset management accounts. Scrutinize adverse media and identify hidden ownership connections that point to undisclosed beneficial owners, collusive intermediaries, or other red flags related to illicit cross-border deposits.

Leverage public registries, building authority records, and external data to validate contractor legitimacy, compare claimed improvement expenses against typical local rates, and confirm that requisite renovation permits were obtained.

Leverage external data (e.g., port authority records, customs data, shipping databases, market indexes) to validate declared shipping paths, commodity volumes, and transaction counterparties. Identify discrepancies or unusual patterns, such as unexplained route detours or conflicting vessel data, to uncover hidden ownership or fabricated documentation within commodity trades.

Leverage open-source intelligence and independent databases to confirm the legitimacy of financial instruments and associated references, such as shipping routes and commodity valuations. Compare key document data, including reference numbers, payee details, or pricing, against official records to uncover potential forgeries or alterations. This independent verification layer increases the likelihood of detecting fraudulent or tampered instruments.

Use open-source intelligence to verify whether the virtual company’s online profiles, domain hosting history, and business registration details align with its claimed activities. Investigate inconsistencies, such as multiple shell websites, copied content, or nonexistent social media engagement, that indicate fraudulent or fictitious setups.

Leverage open-source information and external data to validate sports sponsorship claims, confirm the legitimacy of advertised deliverables (e.g., stadium naming rights, player endorsements), and uncover undisclosed beneficial owners. Cross-reference media reports, official sports directories, and public registries to identify fake or inflated sponsorship deals intended to mask money laundering.

Leverage open-source intelligence and external records to confirm genuine promotional campaigns, media coverage, or other public evidence supporting the legitimacy and scale of athlete image rights agreements. Compare contracted fees against established market benchmarks for the athlete’s public profile and performance history. This helps identify artificially inflated valuations or nonexistent commercial exploitation commonly used to launder illicit proceeds through image rights.

Cross-check corporate registration data, addresses, and management details using public registries and external tools to detect companies sharing addresses or beneficial owners lacking legitimate economic rationale. Verify fair value assessments with independent third-party documentation or market data. This process reveals disguised affiliations and layered ownership across multiple jurisdictions.

Cross-check M&A participants, corporate records, and beneficial owners against external databases, media reports, official corporate registries, and reliable valuation references. Investigate unexplained inconsistencies or unrealistic valuations, and validate the credentials of purported auditing firms and intermediaries to detect forged or rapidly altered documentation indicative of fictitious M&A deals.

Corroborate asset ownership claims and valuations by referencing external sources, including public databases, stolen property registries, reputable auction house records, and art market intelligence. Investigate beneficial ownership structures for ties to high-risk jurisdictions or shell entities. This measure reveals hidden links and helps detect illicitly acquired items parked in freeports under minimal disclosure requirements.

Cross-check real estate brokers' credentials with publicly available data, licensing authority sources, and industry databases. Investigate discrepancies, such as brokers not appearing in official directories or using expired license details, and escalate suspicious cases for further review or Enhanced Due Diligence (EDD) procedures.

Regularly monitor social media, online ads, and other public forums to identify unlicensed or lightly regulated P2P service advertisers. Cross-reference their claimed credentials and licensing status to flag or terminate relationships with entities operating outside required regulatory compliance.

Use external databases and open-source intelligence to validate mobile payment customer details, such as verifying contact numbers or addresses that appear in public records or social media. Investigate discrepancies or incomplete information that may mask stolen identities or layering setups.

Cross-check remote ID details against publicly available data, such as social media, online directories, and official records. Identify mismatches in personally identifiable information, photos, or biometric references that suggest document tampering or identity spoofing.

Use publicly available data, corporate registries, and other external sources to verify beneficial ownership and identify undisclosed ties or conflicts of interest. This helps uncover shell entities or layered accounts receiving proceeds from suspiciously timed trades, particularly in jurisdictions lacking centralized registers.

Search publicly available records, business registries, licensing databases, social media, and news sources to validate the existence and legitimacy of declared businesses. Identify signs of underreporting or informal operations by comparing publicly visible revenue indicators to customer statements or tax filings.

Cross-verify declared pricing and transaction details with public trade data, industry reports, and external registries to identify inconsistencies. Investigate any unjustified variances in the valuation of inter-company goods or services that suggest deliberate mispricing or fictitious transactions.

Periodically examine public or social media sources related to new high-risk customers for job-offer postings or mentions of commission-based fund transfers. If discovered, cross-check these findings with account activities to verify if the customer is being recruited or used as a money mule.

Cross-check information on purported social media recruiters or advertised job opportunities using open-source intelligence. Investigate repeated references in transaction narratives or payment details to the same social media post, page, or handle to uncover patterns linking multiple mule accounts to a single organized recruiter.

Use open-source intelligence to validate new employers and domains referenced by customers. Check for newly registered or fake websites, scam warnings, or domain mismatches. Investigate inconsistent findings to uncover phishing tactics behind fraudulent recruitment schemes.

Perform internet and public registry checks to confirm the legitimacy of claimed employers. If corporate records or online information suggest the company is non-existent, flagged, or unregistered, escalate for enhanced checks or impose account restrictions.

Continuously cross-check information such as corporate registrations, shipping documents, and beneficial ownership records with reliable public databases and open-source intelligence. This helps detect forged paperwork, undisclosed ties to sanctioned entities, or hidden front companies seeking to obscure sanctions violations, enabling more accurate targeting of high-risk relationships.

T0142
|
|

Cross-verify stated business activities, such as chemical distribution or pharmaceutical logistics, against official registries, licensing authorities, and adverse media. Identify any unlicensed operations, front companies lacking true staff or facilities, or suspicious precursors that could indicate drug manufacturing channels.

Research unfamiliar or recently formed chemical brokerage firms through public records, media reports, and external filings. Cross-check physical addresses, regulatory registrations, and declared beneficial owners to confirm authenticity and uncover any potential adverse information linking the entity to illicit precursor trafficking or hidden ownership structures.

Conduct ongoing checks of open-source databases, government registries, and credible media outlets to validate declared commodities, shipping routes, and company ownership. By verifying real-world shipping logs and cross-referencing media reports of illicit trade, financial institutions can detect front companies or false documentation tied to commodity trafficking.

Leverage publicly available data and industry blacklists to check whether customers, suppliers, or trade partners have documented histories of IP infringement or counterfeit product lawsuits. Validate supplier and manufacturer claims by comparing social media, trade registries, and official brand records to uncover discrepancies that may indicate involvement in counterfeit distribution.

T0143.002
|
|

Use public records, specialized databases, and media checks to identify adverse information linking customers or counterparties to arms trafficking. Investigate negative press referencing illicit weapons deals, conflict-zone service routes, or official embargo violations to confirm or refute questionable customer claims.

Cross-check client-provided pharmaceutical credentials and claimed regulatory approvals with publicly available data, such as medicine registries and health authority advisories, as well as third-party reviews. This process helps identify unapproved suppliers, falsified product authorizations, or blacklisted entities involved in counterfeit medicine distribution.

T0144
|
|

Use open-source data, official registries, and external databases to validate the authenticity of invoices, shipping manifests, or business identities involved in transactions. For example, confirm declared delivery routes against public customs records or verify corporate registration details through government portals. This external cross-checking uncovers false representations used to fabricate or inflate receipts, thus exposing fraudulent proceeds at their origin.

Use external data sources, public records, and media reporting to identify known advance fee fraud rings, flagged contact information, or suspicious domains. Cross-check inbound or outbound transactions referencing these details to confirm authenticity and disrupt potential scam networks.

T0144.003
|
|

Investigate the project's online presence, developer identities, domain registration details, and any media coverage to confirm that claims align with observable evidence. Discrepancies, such as unverifiable founders or newly created social media accounts, may indicate a high-risk project prone to rug pulling.

Compare relief-related claims, such as farmland acreage, payroll records, or business operations, against publicly available government registries, official agricultural data, or credible news sources. Verify legitimate ownership or employment status and detect duplicated or fictitious claims, such as farmland listed in multiple subsidy applications or exaggerated payroll numbers not reflected in independent data sets.

Check business ownership and stated operational downturns against publicly accessible government registers, social media, and industry databases. Detect mismatches in reported workforce numbers or operational status by triangulating applicant claims with external evidence, identifying forged or exaggerated claims for relief funds.

Regularly cross-check suspicious or seldom-used vendors and receipts against publicly available data, online reviews, and official registries to confirm the legitimacy of claimed expenses. For instance, verify that service providers or merchants actually exist at the listed addresses and offer the goods or services shown on submitted expense documentation.

T0144.007
|
|

Leverage public data sources, including official trade registries and shipping logs, to verify actual business activity and confirm the movement of physical or service-based products. Identify and investigate repetitive shipments or intangible service claims among associated companies that may signal orchestrated carousel loops.

Validate claimants' asserted unemployment status by comparing reported employer data with external public records, business registries, or online platforms. This helps confirm whether individuals truly left their jobs or if purported employers actually exist, thereby uncovering fictitious employer-employee relationships that fuel fraudulent claims.

T0144.009
|
|

Conduct open-source research on crypto platforms and investment opportunities that arise from romantic or friendly introductions. Scrutinize online forums, negative news articles, or regulatory warnings implicating them in Pig Butchering. Use independent data to confirm licensing status and track record. By verifying the legitimacy of purported investment avenues, institutions can warn customers before funds are transferred.

Leverage publicly available data, such as social media channels, verified charity databases, and news archives, to confirm the legitimacy of the promoted cause. Detect contradictions like nonexistent beneficiaries, newly created social media profiles with no real charitable history, and repeated changes to campaign details that may signal fraudulent fundraising.

Cross-reference farmland ownership claims, livestock registrations, and subsidy eligibility data using official property records, public agricultural databases, and local government statistics. Investigate contradictory or non-existent documentation to expose fraudulent farmland registrations, ghost livestock, or concurrent subsidy applications for the same land.

Conduct thorough verification of token sale documentation (e.g., whitepaper), project websites, and team credentials using public data, social media checks, and domain registration information. Identify plagiarized text, fake executive profiles, or nonexistent offices, which are common indicators of fraudulent token raises.

T0144.014
|
|

Leverage real estate licensing registries, consumer complaint databases, and other publicly available records to verify the legitimacy of timeshare service providers. Confirm the existence of genuine professional affiliations or successful transaction histories, and check for scam alerts or negative media referencing fraudulent timeshare activities.

T0144.015
|
|

Cross-check purported lottery organizations and promoters against public records, regulatory licenses, and open-source intelligence to confirm the existence and credibility of their operations. Investigate domain registrations, online business reviews, and official announcements to spot discrepancies typical of fraudulent lottery schemes.

Cross-check newly formed or suspicious employer entities and their purported employees using publicly available records, such as government registers, social media, or directory listings. Investigate repeated addresses or contact details across multiple claimed employees, as well as the absence of any logical digital footprint for purported businesses. This measure helps uncover phantom businesses and fake employees used to exploit unemployment or wage benefit programs.

T0144.017
|
|

Cross-check proposed investment products using public registries, regulatory databases, media reports, and social media channels. Investigate whether promoters or firms appear on investor alert lists or exhibit inconsistent claims in marketing materials. Discovering these red flags frequently uncovers unauthorized or fraudulent operations.

T0144.019
|
|

Leverage public records, media reports, regulatory warnings, and independent data sources to confirm or refute claims of consistently high returns and identify potential fraud alerts or lawsuits related to the scheme promoter. Look for discrepancies between advertised performance and reputable external data to expose Ponzi-like structures.

Use open-source data, such as NGO watchlists, environmental enforcement actions, and local media, to confirm the authenticity of purported resource-extraction activities. Investigate known corruption or past environmental infractions connected to company principals, verifying that reported supply chain details match external evidence and official registries. This helps unearth undisclosed ownership or adverse information tied to environmental crime.

T0145.001
|
|

Use publicly available data (e.g., environmental agency websites, local media) to validate the authenticity of logging licenses and identify prior violations or corruption allegations. Investigate mentions of suspicious forestry operations, cross-border smuggling, or sanctions targeting timber exporters from specific regions.

Routinely cross-check customer and transaction details with external sources, such as news outlets, government registries, and NGO watchlists, to identify red flags related to wildlife trafficking. Validate permits against publicly available databases and investigate negative media or adverse reports that may indicate illegal wildlife trade.

Use publicly available mining registries, government databases, and external records to confirm the validity of permits, verify declared operating capacity, and identify any known history of unlicensed or corrupt practices. Check for open-source reports of illegal extraction, unauthorized smelting, or problematic licensing officials during onboarding or periodic reviews to help detect forged licenses or misrepresented ownership structures.

Investigate publicly available records, community forums, and news reports for newly formed or suspicious businesses tied to individuals with local gang affiliations. Cross-check external data against internal deposit patterns to uncover attempts to mask petty crime proceeds by operating sub-threshold transactions through seemingly legitimate channels.

Apply publicly accessible records, media reports, and professional databases to validate customers’ stated revenue streams, tax status, and corporate holdings, particularly for clients operating in multiple jurisdictions. This cross-referencing helps detect undisclosed entities, adverse tax findings, or contradictions that signal deliberate tax underreporting.

Cross-verify reported payroll figures and workforce data with publicly available tax, social security, or labor records. Identify discrepancies in stated employee counts, wages, or ownership structures that suggest misrepresented payroll statements or the presence of shell entities.

T0147.002
|
|

Use publicly available databases and authoritative registries to validate claimed tax returns, corporate structures, and business activities. Identify red flags such as the recurring use of the same addresses or overseas directors across multiple refund claims.

Cross-reference declared goods and invoice values with external commodity pricing indexes and shipping registry data. Validate the operational status of foreign importers (e.g., by checking business registries and local directories) to uncover shell or minimal-activity entities that might collude in inflating export invoices.

T0148
|
|

Cross-check high-value ransom transactions by consulting maritime intelligence feeds, vessel-tracking databases, and verified news sources to confirm actual hijacking incidents. This step helps validate claims or detect front entities falsely purporting to collect ransom on behalf of victims, thereby preventing undisclosed laundering of piracy proceeds.

Integrate open-source intelligence and threat feeds into AML and cyber investigations to validate customer claims and rapidly spot wallet addresses, mining pools, or malware hashes linked to known cryptojacking incidents.