Counterfeit Currency

Criminals manufacture and circulate fake banknotes or coins, effectively creating illicit funds at the source. They often blend counterfeit bills with legitimate cash transactions—using cash-intensive businesses, couriers, or smaller deposit channels—to evade immediate detection. Some financial institutions struggle with timely identification due to gaps in staff training, fear of losing customers, or inadequate currency-handling procedures. In certain jurisdictions, passing or possessing counterfeit notes is treated strictly as a criminal offense rather than a trigger for suspicious activity reports. These networks may also intersect with other predicate offenses, including narcotics or terrorist financing. While some fake notes eventually enter formal banking systems, the essential threat here lies in generating illicit capital by producing phony currency in the first place.

[
Code
T0092
]
[
Name
Counterfeit Currency
]
[
Version
1.0
]
[
Parent Technique
]
[
Risk
Product Risk, Jurisdictional Risk, Internal Risk
]
[
Created
2025-02-27
]
[
Modified
2025-04-02
]

Counterfeit Currency

Tactics

Counterfeiting generates illicit funds by creating unauthorized currency, achieving the primary objective of obtaining criminal proceeds at the source for subsequent laundering.

ML.TA0006
|
|

Once produced, counterfeit notes are blended with genuine cash transactions, often in smaller deposits or cash-intensive businesses, to minimize detection. This process introduces illicit funds into legitimate financial channels.

Risks

RS0002
|
Product Risk
|

Criminals exploit the inherent vulnerabilities of physical currency acceptance. By forging banknotes and relying on limited verification or detection measures, they introduce counterfeit funds into circulation and then deposit them into financial channels. This is the core operational weakness that underpins the technique.

RS0004
|
Jurisdictional Risk
|

In certain regions, passing or possessing counterfeit currency does not prompt AML reporting obligations but is handled solely as a criminal offense. Criminals exploit these legal and regulatory gaps to circulate forged notes without triggering suspicious activity alerts.

RS0005
|
Internal Risk
|

Financial institutions' operational weaknesses, such as inadequate staff training, reluctance to challenge suspicious cash, or poor currency-handling procedures, create an environment where forged notes can go undetected. These deficiencies enable counterfeit currency to enter the system more easily.

Indicators

IND02255
|

Frequent deposits of small-denomination banknotes commonly targeted for counterfeiting, with no legitimate business rationale.

IND02256
|

Transactions involving cash deposits or exchanges that are inconsistent with the customer's known business activities or profile.

IND02257
|

Use of multiple accounts to deposit cash in small amounts, which may collectively represent a significant sum.

IND02258
|

Frequent or large-scale requests to exchange small-denomination banknotes for larger denominations without a legitimate business reason.

IND02259
|

Customer is unable or unwilling to provide a clear explanation for the source of cash deposits when questioned.

IND02260
|

Presence of counterfeit detection devices or materials in a business or personal setting without a clear legitimate purpose.

IND02261
|

Unusual patterns of cash deposits or withdrawals that do not match the customer's typical transaction history.

IND02262
|

Customer or associated entities have a history of involvement in counterfeiting or related criminal activities.

IND02263
|

Reports or alerts from law enforcement or other financial institutions regarding counterfeit currency activity linked to the customer.

IND02264
|

Frequent deposits of cash in small denominations that are inconsistent with the customer's known business activities or income levels.

IND02265
|

Unexplained increase in cash transactions at a business that typically does not handle large volumes of cash.

IND02266
|

Pattern of cash deposits just below reporting thresholds across multiple accounts or branches.

IND02267
|

Frequent use of cash-intensive businesses, such as convenience stores or vending machines, for cash deposits.

IND02268
|

Presence of counterfeit currency detected in deposits made by a particular customer or business.

IND02269
|

Customer has known associations with individuals or entities previously involved in counterfeiting activities.

IND02270
|

Multiple banknotes with identical or repeated serial numbers identified within a single deposit or across multiple deposits by the same customer.

IND02271
|

Employee or automated currency-handling systems consistently flag printing or material anomalies in deposited banknotes from a single customer or business.

Data Sources

  • Aggregates negative media reports, legal actions, and court rulings.
  • Highlights customer involvement or potential links to known counterfeiting operations, aiding in risk assessment and investigation.
  • Aggregates publicly accessible information, including social media posts, online marketplaces, and specialized forums.
  • Can reveal possession or advertisement of counterfeiting equipment, suspicious behaviors, or associations not captured in traditional banking data.
  • Provides detailed records of financial transactions, including timestamps, amounts, denominations, and account details.
  • Enables identification of suspicious deposit patterns (e.g., repeated small-denomination deposits, sub-threshold structuring, or sudden spikes).
DS0033
|
|
  • Consolidates internal and shared industry intelligence regarding fraudulent activities.
  • Logs incidents of suspected or confirmed counterfeit currency, such as repeated serial numbers or device-flagged anomalies in deposited banknotes.
  • Contains verified customer identities, declared business activities, and ongoing risk assessments.
  • Allows detection of inconsistencies between legitimate business rationale and actual cash handling, as well as identifying prior criminal associations or negative history relevant to counterfeiting.

Mitigations

Configure automated rules and analytical models to detect unusual cash deposit patterns, such as frequent small-denomination deposits from multiple accounts or repeated deposits slightly below reporting thresholds. Prioritize alerts when these deposits deviate significantly from the customer’s established business or personal profile, indicating potential placement of counterfeit notes mixed with legitimate funds. Quick investigative follow-up ensures timely identification and disruption of counterfeit currency layering.

Institute clear currency-handling protocols that require staff to use counterfeit-detection tools on all cash deposits above a defined threshold or in cases of suspicious presentation. Mandate immediate segregation and documentation of suspected fake notes, along with a non-retaliation policy for employees who raise concerns. By standardizing these procedures, institutions address the risk of inconsistent counterfeit screening and overcome staff reluctance to confront customers who might present bogus cash.

Provide specialized, hands-on instruction for frontline employees on the physical security features of legitimate currency (e.g., watermarks, micro-printing, holograms) and the proper use of detection devices. Establish a formal escalation procedure for suspected counterfeit notes, ensuring staff are confident in flagging questionable bills without fear of customer attrition. This directly addresses the vulnerability of inadequate training, enabling timely identification of counterfeit currency before it enters circulation.

File SARs/STRs upon detecting multiple counterfeit notes from a specific customer or a sustained pattern of suspect cash deposits. Even if local law treats passing counterfeit currency purely as a criminal offense, financial institutions must still escalate it as suspicious from an AML perspective. Consistent reporting safeguards the banking system by alerting authorities to potential large-scale distribution operations that blend counterfeit with legitimate cash deposits.

Instruments

IN0001
|
|
  • Criminals purchase casino chips with counterfeit bills, converting forged currency into gaming tokens.
  • Winnings or cashouts from these chips appear legitimate, obscuring the counterfeit origin of funds.
  • Casinos with insufficient scrutiny of incoming banknotes facilitate this exchange, allowing large sums of fake money to enter the financial system as seemingly valid payouts.
  • Criminals deposit counterfeit currency into business or personal accounts, mixing it with legitimate cash to evade detection.
  • By structuring multiple small deposits below reporting thresholds, they limit scrutiny and bypass automated monitoring systems.
  • Gaps in teller training or inadequate counterfeit-detection technology can result in banks crediting these deposits as genuine funds.
  • Criminals feed counterfeit bills into cryptocurrency ATMs that lack robust banknote authentication.
  • They rapidly convert fake notes into digital currency, making it harder to trace original transactions once funds enter a blockchain environment.
  • Minimal KYC or AML checks at some crypto ATMs enable criminals to exploit this route for laundering forged money.
  • Criminals use counterfeit currency to purchase high-value items like gold or diamonds.
  • By swapping forged cash for tangible assets, they convert worthless bills into goods that can be resold or traded worldwide.
  • Limited verification practices in some dealerships enable acceptance of fake notes, obscuring the true source of the proceeds.
IN0034
|
|
  • Criminals insert counterfeit bills into slot machines to obtain TITO tickets (vouchers for slot machine credit).
  • These tickets are then redeemed for genuine cash at the casino cashier or kiosks.
  • If automated currency validators fail to detect forgeries, fraudulent notes enter the system undetected, converting fake bills into legitimate payouts.
IN0051
|
|
  • Criminals manufacture fake banknotes or coins and blend them with legitimate currency in routine transactions or deposits.
  • They exploit the anonymity and universal acceptance of physical cash, making it difficult for authorities and businesses to detect forged bills at the point of entry.
  • Inadequate banknote authentication at cash-intensive venues and financial institutions enables the widespread circulation of counterfeit currency.

Service & Products

  • Offenders physically present counterfeit currency at bank counters or other authorized outlets for deposit.
  • Fragmented deposits or smaller transactions can bypass immediate scrutiny and deposit thresholds.
PS0024
|
|
  • Criminals deposit counterfeit bills through ATMs, avoiding face-to-face scrutiny.
  • Some ATMs rely on basic scanning and may not thoroughly authenticate cash deposits, enabling swift entry of fake notes into the banking system.
  • Criminals feed counterfeit cash into machines that have limited or weak authentication of physical banknotes.
  • The fake currency is quickly converted into cryptocurrency, obscuring the transaction’s origin.
  • Criminals use counterfeit notes to purchase or redeem items of value from pawn shops.
  • Inadequate detection methods allow fake currency to be exchanged for legitimate goods or cash, disguising illicit origins.
  • Criminals use counterfeit funds to purchase chips or bets, then cash out legitimate winnings.
  • Poor currency screening at gambling venues allows phony bills to enter the payment cycle more discreetly.
  • Criminals can deposit counterfeit banknotes among genuine cash proceeds from a cash-intensive business.
  • The false bills blend in with legitimate daily receipts, reducing detection risk and masking the origin of the illicit funds.
  • Individuals deposit smaller amounts of counterfeit currency along with real bills to evade immediate suspicion.
  • Repeated small deposits can circumvent thresholds that would otherwise prompt closer inspection.
  • Large volumes of physical currency are processed, counted, and sorted, creating potential blind spots.
  • If staff and technology are not fully trained or equipped to detect forgeries, counterfeit notes can be mixed into legitimate cash streams.
  • Criminals bring in fake banknotes to exchange for different currencies, exploiting gaps in verification.
  • Once converted, the origin of the funds is more difficult to trace, helping launder the counterfeit proceeds.
  • Criminals can purchase gold items or bars with counterfeit currency.
  • Gold, being a high-value commodity, can then be resold or traded for legitimate funds, disguising the illicit origin.

Actors

Pawnshop operators may unknowingly accept counterfeit currency:

  • Criminals use fake notes to purchase or redeem items of value that can later be resold.
  • Inadequate detection measures enable these transactions to convert counterfeit bills into legitimate goods or funds.

MSBs providing currency exchange or check-cashing services can be infiltrated by counterfeit currency:

  • Criminals exchange forged notes for legitimate currency or alternative payment forms.
  • If verification protocols are weak, fake bills bypass detection and enter financial institutions downstream.

Criminal actors produce and circulate counterfeit currency to generate illicit proceeds:

  • They manufacture fake banknotes or coins and introduce them via cash transactions or deposits.
  • By mixing forged bills with legitimate funds, they make detection more challenging for financial institutions.
AT0064
|
|

Cash couriers physically transport counterfeit currency into the system:

  • They place forged notes at cash-intensive businesses or multiple deposit points.
  • Their distribution methods reduce immediate detection by banks and other financial institutions.

Gambling operators inadvertently convert counterfeit bills into legitimate winnings:

  • Criminals buy chips or place bets with forged currency.
  • Insufficient currency screening allows fake notes to enter circulation, eventually reaching financial institutions as genuine payouts.

Cash-intensive businesses are exploited by criminals to blend counterfeit bills with genuine daily receipts:

  • The large volume of physical cash helps conceal the presence of forged notes.
  • Financial institutions face increased difficulty distinguishing illicit funds when accepting bulk deposits.

Cryptocurrency ATM operators can be exploited when criminals feed counterfeit bills into machines:

  • Users quickly convert forged cash into digital assets, limiting traceability.
  • Weak or minimal banknote authentication at these terminals undermines financial institutions' abilities to detect and halt counterfeit flows.

Dealers, such as cash-for-gold services, accept counterfeit currency in exchange for valuable commodities:

  • Criminals purchase gold or other assets with forged bills and then resell them for clean funds.
  • Once high-value items are secured, financial institutions have reduced visibility into the original source of funds.

References

  1. APG (Asia/Pacific Group on Money Laundering). (2016). APG yearly typologies report 2016: Methods and trends of money laundering and terrorism financing. APG Secretariat. https://apgml.org/methods-and-trends/documents/default.aspx?pcPage=1

  2. Financial Action Task Force (FATF). (2013, June). Money laundering and terrorist financing related to counterfeiting of currency. FATF. https://www.fatf-gafi.org/en/publications/Methodsandtrends/Money-laundering-terrorist-financing-counterfeit-currency.html

  3. O'Brien, V., Hindes, M., McCarthy, E., Adams, N., Day, C. (2023). SARs in Action Issue 23. National Crime Agency (NCA). http://www.nca.gov.uk

  4. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2021). Foreign bank branches in Australia money laundering and terrorism financing risk assessment. AUSTRAC. https://www.austrac.gov.au/business/how-comply-guidance-and-resources/guidance-resources/foreign-bank-branches-australia-risk-assessment-2021