Illicit Acquisition

In the Illicit Acquisition stage, adversaries actively produce or secure illicit funds through profitable criminal activities. The essential aim at this stage is to create initial wealth from unlawful sources, providing capital for further laundering processes. While these criminal gains might sometimes be reinvested into new illicit activities, the primary significance of this stage is the initial generation of wealth that must later be introduced into legitimate or commercial channels. This foundational wealth is deliberately concealed at inception, making subsequent detection and tracing more difficult as the laundering scheme evolves. Financial institutions and investigators may rarely witness this stage directly, as it often occurs outside of formal financial systems. However, unexplained origins of capital, suspicious funding of entities with no legitimate income streams, or abrupt spikes in transactional volume might indirectly indicate the presence of criminally derived funds.

[
Matrix
Money Laundering
]
[
Name
Illicit Acquisition
]
[
Version
1.0
]
[
Created
2025-01-22
]
[
Modified
2025-05-21
]

Techniques Under This Tactic

Smuggling contraband commodities generates illicit proceeds by evading taxes, duties, and regulatory controls, such as unauthorized tobacco sales, directly creating criminal revenue streams.

Cigarette smuggling generates illicit proceeds by evading taxes and duties on contraband tobacco, providing a primary revenue stream that will subsequently require laundering.

T0049
|
|

Extortion explicitly involves the forced acquisition of money or assets through threats or intimidation. It forms the initial stage of laundering when criminals move coerced proceeds into financial channels.

Through ransomware extortion demands, criminals forcibly obtain illegal capital from victims' payments, which represents their core objective of generating illicit proceeds.

Through protection payments, criminals generate a steady stream of illicit proceeds via extortion. The primary objective is to regularly acquire illegal income from coerced fees, which must then be laundered to avoid detection.

T0051
|
|

Corruption is a predicate offense where officials or persons in authority illicitly acquire funds by abusing their position or influence. This forms the initial source of illegal proceeds that must then be laundered.

Corrupt officials generate illicit proceeds by siphoning public funds or diverting them for personal gain, necessitating laundering to make these funds appear legitimate. This is the primary motivation behind the misappropriation of public funds.

Human traffickers forcibly exploit victims for labor or sexual services to generate illicit proceeds, forming the raw capital that must subsequently be laundered.

T0058.001
|
|

Forced labor generates illicit proceeds that qualify as a predicate offense for money laundering.

Sexual exploitation generates illicit proceeds that qualify as a predicate offense for money laundering.

Activity that generates illicit proceeds qualifying as a predicate offense for money laundering.

Human smuggling directly generates illicit proceeds from unauthorized border crossings, with the core objective being the acquisition of illegal funds that subsequently require laundering.

Counterfeiting generates illicit funds by creating unauthorized currency, achieving the primary objective of obtaining criminal proceeds at the source for subsequent laundering.

Market manipulation is a method used to generate illicit funds through fraudulent activities such as price rigging and stock manipulation, both of which are forms of financial deception.

Criminals generate new illicit proceeds by forging or falsifying documentation, such as fake medical certificates or hardship claims, to withdraw superannuation funds prematurely. This effectively defrauds retirement schemes into releasing capital under false pretenses.

Insider trading is a predicate offense that generates illegal proceeds through the exploitation of market-moving, non-public information, forming the initial step in this laundering chain.

Sanctions evasion generates illicit proceeds that qualify as a predicate offense for money laundering.

T0142
|
|

Activity that generates illicit proceeds qualifying as a predicate offense for money laundering.

The technique involves generating or receiving illegal proceeds from drug sales, which are then used to finance the purchase of precursor chemicals and equipment. This directly supports the acquisition of illicit funds by creating a cycle of generating and reinvesting illicit earnings into further criminal operations.

Commodity trafficking generates illicit proceeds through the unauthorized trade of contraband or restricted goods. The primary objective is to obtain criminal profits from these illegal sales, which serve as the foundation for subsequent money laundering activities.

Primary gains come from selling counterfeit products, generating new criminal proceeds that require laundering.

T0143.002
|
|

Arms trafficking is an activity that generates illicit proceeds, qualifying as a predicate offense for money laundering.

The main goal is to produce criminal proceeds by selling counterfeit or falsified medicines, forming the illicit capital to be laundered later.

T0144
|
|

Fraud directly generates new illicit proceeds through deceptive means such as false invoices, sham claims, or forged documentation, making it a core predicate offense for money laundering. Criminals use these methods to obtain unlawful funds at the outset, positioning fraud as the initial source of launderable capital.

Deepfake impersonation is used as a direct scam mechanism to generate new criminal proceeds by deceiving victims or financial personnel into releasing funds under false pretenses.

Advance fee fraud scammers solicit victims under false pretenses of lucrative returns or prizes, requiring upfront payments that directly generate illicit proceeds from unsuspecting victims. This is the primary objective of the scheme.

T0144.003
|
|

Criminals launch or promote a new crypto token or project under fraudulent pretenses (e.g., a promising ICO) to illicitly obtain investor capital. This is the primary objective of a rug pull, where perpetrators quickly accumulate funds from unsuspecting participants before absconding.

The primary objective is to generate new illicit proceeds by fraudulently obtaining government relief disbursements under false pretenses, such as using forged eligibility data or stolen identities. Criminals focus on directly acquiring these funds as their initial illicit capital.

Criminals exploit economic relief programs under false pretenses, such as using forged documentation or inflated payroll data, to secure newly generated illicit proceeds. This directly aligns with their core objective of obtaining illicit funds through fraudulent claims.

Expense report fraud serves as a predicate offense to obtain illicit proceeds from an organization by submitting falsified or inflated expense claims, thereby siphoning company funds under the guise of legitimate reimbursements.

T0144.007
|
|

Criminals orchestrate repeated cross-border trades for the same goods or intangible services under different shell companies, submitting false or inflated VAT refund claims to government authorities. This systematically generates new illicit proceeds directly from the tax rebate system.

Criminals file fraudulent unemployment claims, often using stolen or fabricated identities, to generate newly disbursed government funds as illicit proceeds. This activity directly aligns with acquiring illicit capital through a predicate fraud offense.

T0144.009
|
|

Scammers create false romantic or friendly bonds to manipulate victims into fraudulent crypto investments. This tactic enables scammers to acquire illicit capital directly, as victims deposit substantial amounts into scam accounts or wallets.

T0144.010
|
|

Criminals commit check fraud to generate illicit proceeds from worthless or stolen checks, exploiting float periods or forging endorsements to illegally acquire funds that then move into subsequent laundering phases. This is the primary objective behind the technique.

Through deceptive appeals on social media, criminals generate illicit proceeds by tricking unsuspecting donors into directing funds toward fraudulent causes, thereby acquiring illegal capital.

Criminals fraudulently obtain undeserved agricultural subsidies, generating illicit proceeds under false pretenses. The primary objective is to acquire illicit funds from these fraudulent claims.

Fraudulent token sales enable criminals to generate new illicit proceeds from unsuspecting investors through exit scams or misleading offerings. This is the primary objective for leveraging tokenized fundraisings.

T0144.014
|
|

Timeshare scams generate illicit proceeds by promising owners fraudulent resale or exit deals, with the primary objective of extracting upfront fees under false pretenses.

T0144.015
|
|

Criminals fraudulently solicit upfront payments by claiming victims have won lotteries or sweepstakes, thereby generating illicit proceeds. The primary objective is to collect funds through deception and false promises of nonexistent prizes.

Criminals submit fictitious or collusive employer-employee claims for unemployment benefits, fraudulently obtaining government payouts as newly generated illicit proceeds. This tactic directly targets the creation of illicit capital from the outset.

T0144.017
|
|

Scammers collect capital under the false pretense of legitimate investments, thereby generating illicit proceeds directly from victims.

By deceiving businesses into transferring payments to fraudulent accounts, criminals directly generate illicit proceeds from the victim's finances.

T0144.019
|
|

The scheme continuously raises new capital from unsuspecting investors, forming the basis of illicit proceeds.

Environmental crime is an activity that generates illicit proceeds, qualifying as a predicate offense for money laundering.

T0145.001
|
|

Illegal logging generates substantial illicit proceeds through unauthorized timber harvesting and sales, serving as a predicate crime. Criminals then seek to launder these funds through formal financial systems or legitimate commerce.

Wildlife trafficking is an activity that generates illicit proceeds qualifying as a predicate offense for money laundering.

Criminals derive illicit proceeds by extracting and selling minerals without proper authorization, forming the predicate offense that generates capital for laundering.

Common offenses refer to activities that generate illicit proceeds and qualify as predicate offenses for money laundering.

Tax evasion refers to activities that generate illicit proceeds, qualifying as a predicate offense for money laundering.

Criminals generate unreported (illicit) proceeds by shortchanging required payroll obligations, such as taxes and insurance premiums. This is the primary objective that yields the initial illicit capital needing laundering.

T0147.002
|
|

Criminals obtain illicit proceeds by deceiving tax authorities into issuing fraudulent refunds or rebates to which they are not entitled.

Through dividend stripping schemes (including cum-ex), criminals artificially claim multiple dividend tax refunds by obscuring share ownership around dividend dates, thereby generating direct illicit proceeds from government funds. This tactic is central, as the scheme’s primary objective is to acquire wrongful tax refunds as criminal profit.

Through overvalued export invoices, fraudsters claim inflated tax rebates or export incentives, generating entirely new criminal proceeds. This makes the unjustified tax refunds or subsidy payments the primary source of illicit funds.

T0148
|
|

Piracy refers to activities that generate illicit proceeds, qualifying as a predicate offense for money laundering.

Through cryptojacking, criminals hijack victims' computing resources to generate newly minted cryptocurrency as direct illicit proceeds. This is the earliest stage of laundering, providing fresh criminal funds before any formal placement, layering, or integration steps.