Lottery Scams

Lottery Scams are a subtype of advance fee fraud where criminals falsely inform victims of a lottery or sweepstakes win and demand upfront “fees” or “taxes” to release nonexistent prizes. They often instruct victims to maintain secrecy and may impersonate reputable lottery organizations or sweepstakes to appear credible. Once payments are collected from victims, perpetrators launder these illicit funds through structuring or layering, frequently using remittance services or money mules across multiple jurisdictions to obscure their operations. Criminal groups behind these scams commonly originate from West Africa, but they may also establish bases in countries like Spain or Canada to further evade detection. Victims are typically approached via emails, text messages, social media ads, or phone calls, and remain unaware that no genuine prize exists, resulting in continuous requests for additional fees under various pretexts until the scam is discovered.

[
Code
T0144.015
]
[
Name
Lottery Scams
]
[
Version
1.0
]
[
Parent Technique
]
[
Risk
Channel Risk, Jurisdictional Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Fraudulent Lottery Scams

Tactics

Criminals fraudulently solicit upfront payments by claiming victims have won lotteries or sweepstakes, thereby generating illicit proceeds. The primary objective is to collect funds through deception and false promises of nonexistent prizes.

Risks

RS0003
|
Channel Risk
|

Criminals exploit phone, email, and online platforms to reach victims while remaining largely unverified or anonymous. Victims are encouraged to keep the scam confidential, further relying on these unmonitored communication channels to facilitate fraudulent transfers and evade standard scrutiny. This is the primary vulnerability enabling the lottery scam scheme.

RS0004
|
Jurisdictional Risk
|

The scam operators operate across multiple jurisdictions, often originating from West Africa and establishing bases in countries like Spain or Canada. By leveraging diverse AML frameworks and cross-border remittance services, they complicate investigations and obscure the origins of illicit proceeds.

Indicators

IND00360
|

Customer claims to operate an international lottery but is unable to provide verified licensing or official documentation during KYC checks.

IND00361
|

Frequent usage of multiple money remittance services or money transfer operators across various jurisdictions referencing 'lottery fees' or 'sweepstakes' without documented business purpose.

IND00565
|

Multiple small incoming payments from unrelated individuals referencing 'lottery fees' or 'prize taxes' to an account with no legitimate lottery affiliation.

IND00566
|

Frequent onward transfers of funds labeled as 'lottery winnings' to external accounts without supporting documents or business justification.

IND00567
|

Entity purports to manage sweepstakes activities based in a jurisdiction known for lax or nonexistent regulation of lottery operations.

IND00568
|

Multiple victims identified who each made 'lottery release fee' payments into the same personal account, absent any legitimate relationship or business purpose among them.

Data Sources

Consolidates details on countries or regions with weak or lax lottery regulations. Investigators use this data to flag entities claiming to manage sweepstakes in high-risk jurisdictions and to identify unusual transaction flows to or from known hotspots for fraudulent lottery activities.

Captures timestamps, amounts, references, and counterparties for all financial movements, including deposits labeled as 'lottery fees' or 'prize taxes' and disbursements marked as 'winnings.' Investigators can track patterns of small incoming payments from unrelated parties and subsequent layering or structuring consistent with lottery scam operations.

DS0033
|
|

Provides information on known or suspected fraudulent activities and scam patterns, including reported lottery scam typologies, associated email addresses or phone numbers, and patterns of advance fee fraud. Investigators use these details to cross-reference repeat perpetrators, identify recurring victim complaints, and detect transactions matching known lottery scam behaviors.

Includes verified identities, beneficial ownership information, addresses, business registration documents, and risk assessments for individuals or entities claiming to operate lotteries or sweepstakes. Investigators use this data to confirm the legitimacy of licensing claims, detect misrepresentations of business purpose, and identify whether operators are authorized to conduct gaming or remittance activities.

Documents cross-border wires and transactions routed through multiple institutions or jurisdictions. Investigators can identify structuring or layering across remittance channels—a common tactic in lottery scams—by tracing the flow of funds associated with suspicious accounts or recurring scam references in payment details.

Mitigations

Identify and categorize jurisdictions known for prevalent lottery or advance fee fraud schemes, such as specific West African regions. Apply enhanced controls and closer scrutiny to accounts or transactions linked to those locations. Adjust risk ratings accordingly to safeguard against cross-border scam operations.

Apply deeper scrutiny to clients claiming to administer lotteries or sweepstakes by verifying legitimate licensing, tax records, and regulatory approvals. Conduct thorough background checks, cross-reference documentation with official registries, and validate customer information to uncover potential fraudulent lottery operations.

During onboarding, require proof of lottery-focused licensing, corporate registration, and business purpose for any organization claiming to operate a sweepstakes or lottery. Validate identities and ownership details to detect fictitious entities or individuals exploiting advanced fee fraud setups.

Implement specialized monitoring rules to detect recurring small incoming payments referencing 'lottery fees' or 'prize taxes' from multiple, unrelated senders, followed by quick layering or transfers to foreign accounts. These rule-based or analytics-driven alerts focus on patterns typical of lottery scam proceeds and enable the timely identification of advanced fee fraud activity.

Train frontline and compliance personnel to recognize hallmark lottery scam indicators, such as sudden spikes in smaller, cross-border transactions labeled as 'winning fees,' and to escalate suspicious patterns promptly for deeper investigation.

Deploy targeted awareness campaigns and tailored advisories explaining how fraudsters pose as legitimate lotteries to request upfront payments. Advise customers to:

  • Verify any 'prize notifications.'
  • Avoid secrecy or surrendering personal details.
  • Report suspicious demands for 'lottery fees.'

File SARs/STRs when accounts receive repeated "lottery fee" or "prize tax" deposits from unrelated individuals without legitimate context, or exhibit other indicators of advanced fee fraud. Explicitly document references suggesting fraudulent lotteries and escalate quickly to relevant authorities for investigation.

Cross-check purported lottery organizations and promoters against public records, regulatory licenses, and open-source intelligence to confirm the existence and credibility of their operations. Investigate domain registrations, online business reviews, and official announcements to spot discrepancies typical of fraudulent lottery schemes.

Restrict or suspend high-risk accounts receiving multiple 'lottery fee' payments from disparate sources lacking credible justification. Prevent further outgoing transfers or layering until the account holder provides satisfactory explanations or proof of legitimate lottery activity.

Regularly review transactional references, payor identities, and account activities to detect evolving advanced fee fraud patterns involving purported 'prize release' payments. Escalate newly identified anomalies for verification and, if unresolved, consider account restrictions or closure.

Terminate relationships with customers conclusively identified as orchestrating lottery scams or repeatedly failing to provide valid proof of legitimate lottery operations. Once fraudulent conduct is confirmed, cease all services to protect victim funds and the institution’s integrity.

Instruments

Criminals instruct victims to deposit purported 'lottery fees' or 'release taxes' into personal bank accounts under their own or money mules' names. Once the funds arrive, the scammers quickly transfer or withdraw them—often in multiple smaller transactions—to other accounts or jurisdictions, creating layers that obscure the original illicit source. Continual incoming deposits from unrelated individuals remain below suspicious transaction reporting thresholds, hindering detection by financial institutions.

IN0051
|
|

After victims remit purported fees, scammers or money mules often collect the proceeds in cash at various payout locations. This reduces electronic records tying the funds to the fraudulent lottery operation. The anonymity of physical currency, especially across multiple jurisdictions with lax ID measures, makes structuring and rapid movement of illicit proceeds significantly easier.

Lottery scammers often direct victims to send 'lottery taxes' via e-wallets or reloadable prepaid cards. These instruments feature rapid onboarding and minimal KYC checks, enabling fraudsters to collect numerous small victim payments. The funds are then transferred or cashed out with little oversight, complicating efforts to trace back to the original scam transactions.

Service & Products

  • Fraudsters request direct P2P payments from victims, bypassing traditional banking scrutiny.
  • These quick, low-barrier transfers allow scammers to receive multiple small payments labeled as 'lottery fees,' hampering detection.
  • Criminals instruct victims to send purported 'lottery fees' or 'taxes' via remittance operators, collecting payments in multiple locations to obscure their true identity.
  • They layer or structure these funds across various jurisdictions, making tracing and recovery of victims’ money more difficult.
  • Scammers or their money mules funnel small, repeated deposits labeled as 'prize taxes' or 'release fees' from unrelated victims into personal accounts.
  • They rapidly withdraw or transfer these amounts, making it challenging to link them to the original scam.
  • Perpetrators set up accounts on popular online payment systems to solicit 'release fees' under the façade of legitimate lottery organizations.
  • Rapid onboarding and global reach enable them to receive payments from multiple victims and move funds quickly.

Actors

These criminal groups perpetrate lottery scams by:

  • Impersonating legitimate sweepstakes to collect advance fees from victims.
  • Establishing operations across multiple jurisdictions (e.g., West Africa, Spain, Canada) to evade detection.
  • Laundering the proceeds through structuring and layering, often via remittance services.

Their cross-border approach and use of multiple payment channels complicate financial institutions’ efforts to accurately identify and trace illicit funds.

AT0076
|
|

Money mules, knowingly or unknowingly, assist lottery scammers by:

  • Receiving and forwarding victim payments labeled as 'lottery fees' or 'taxes' in personal accounts.
  • Quickly transferring or withdrawing funds across various jurisdictions, obscuring the money trail.

Their involvement dilutes transactional transparency for financial institutions, making it difficult to identify the fraudulent nature of incoming and outgoing funds.

References

  1. Caribbean Financial Action Task Force (CFATF). (2016). Illegal Lotteries Typology Project Report. CFATF. https://cfatf-gafic.org/index.php/documents/typologies/6949-illegal-lotteries-typology-project-report

  2. Financial Crimes Enforcement Network (FinCEN). (2024). Elder financial exploitation: Threat pattern & trend information, June 2022 to June 2023 (FIN-2022-A002). FinCEN.https://www.fincen.gov/sites/default/files/shared/FTA_Elder_Financial_Exploitation_508Final.pdf