Investment Fraud Prevention for Banks and Platforms Guide: Detection, Payment Friction and Crypto On-Ramp Controls

Investment fraud is now the largest reported cause of cybercrime losses, and most of the money leaves victims through ordinary bank transfers, card payments and crypto purchases that the victims authorise themselves. That makes banks, payment firms, crypto exchanges, kiosk operators and online platforms the points where the fraud can still be stopped. This guide sets out the institutional controls: how the schemes move money, the transaction and behavioural signals that identify victims, how to design payment friction and interventions that work, controls for crypto on-ramps, advert and impersonation takedown, reporting, and how to measure the programme. It is for fraud strategy, financial crime, payments, crypto compliance and trust and safety teams. Victim-facing advice is in the Romance and Investment Scam Awareness Guide; this page covers what institutions do.

Key takeaways

• The losses are concentrated and rising. The FBI's IC3 recorded $6.57 billion of investment fraud losses in 2024, of which about $5.82 billion was cryptocurrency investment fraud, up 47% on 2023.
• Victims rarely know they are victims. In the FBI's Operation Level Up, 76% of the victims it notified were unaware they were being scammed, so interventions must be designed for a customer who believes the investment is real.
• The money path is predictable. Savings, early-cashed deposits or new borrowing flow to a crypto exchange or kiosk, then to an address supplied by a stranger; FinCEN's red flags describe that path and give a SAR key term.
• Friction must be targeted and conversational. Generic warnings are clicked through; scam-specific questions, delays on high-risk first payments and trained human calls change outcomes.
• Platforms, banks and exchanges each hold part of the picture. Ad takedown, clone firm detection and shared intelligence stop victims earlier than any single firm can.

How investment fraud moves money

The FinCEN alert on pig butchering (FIN-2023-Alert005, September 2023) describes the pattern from the institution's side: an unsolicited contact recommends a high-return crypto investment, the customer moves fiat to a virtual asset service provider or buys at a kiosk, sends funds to an address the contact supplies, and later makes transfers labelled as taxes, fees or penalties. See the Cryptocurrency Scam Awareness Guide for the consumer view.

The scale institutions are facing

All figures are from the FBI IC3 2024 Internet Crime Report.

Operation Level Up, the FBI's proactive victim notification effort, notified 4,323 victims in 2024, estimated savings of about $285.6 million, and referred 42 victims to a victim specialist for suicide intervention. That last figure is a reminder that interventions are welfare conversations as well as fraud controls; see the Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide.

Detection signals for banks and payment firms

FinCEN's alert groups red flags into behavioural, financial and technical signals. Built into monitoring rules and models, they form a strong first layer:

Combine these with your own data: first payment to a new payee that is an exchange, a sharp change in payment velocity, remote access software active during a banking session, and inbound payments from unrelated individuals (which may indicate the victim is also being used as a mule; see the Money Mule Detection Guide). The Transaction Monitoring and Behavioural Biometrics Guide covers the monitoring stack.

Designing payment friction and interventions

Victims of investment fraud are often coached to lie to their bank ("say it is for a family member"), so friction has to get past a prepared story.

1. Risk-score the first payment. The first payment to a new exchange, kiosk operator or unknown investment company, especially after a period of inactivity or a savings cash-out, gets the highest scrutiny.
2. Ask scam-specific questions in the app. "Did someone you met online, or a new contact, suggest this investment?", "Have you been asked to pay a fee to withdraw your profits?" and "Are you buying cryptocurrency to send to an address someone gave you?" are more effective than "Is this payment genuine?".
3. Delay rather than decline. A hold of [24 to 72 hours] on high-risk first payments, with a call from a trained specialist, gives the customer time to talk to family and the bank time to check the payee.
4. Use human conversations for high-risk cases. Specialist teams trained in open questions, not scripts, and able to recognise coaching. In branches, staff need a clear escalation route, including to police where your jurisdiction runs a banking protocol.
5. Check the firm. For payments to investment firms, check the regulator register before release. The FCA advises using its Firm Checker, matching the firm reference number and contact details, and using only the contact details on the register, because clone firms copy real firms' names.
6. Follow up. After a declined or abandoned payment, contact the customer again; scammers often return with a new payment route.
7. Protect the vulnerable. Offer trusted contact arrangements, spending controls and opt-in blocks on crypto purchases.

In the UK, the PSR's reimbursement requirement for authorised push payment fraud (payments from 7 October 2024, up to £85,000 per claim, split 50:50 between sending and receiving firms) gives both sides a direct financial reason to invest in these controls. See the Authorised Push Payment (APP) Fraud Guide.

Controls for crypto exchanges and kiosk operators

• First-time buyer risk: new customers who fund large purchases and immediately withdraw to an external address are the classic victim profile. Apply a cooling-off period on first external withdrawals and show a scam warning naming the pattern.
• Withdrawal address intelligence: screen destination addresses against blockchain analytics and shared scam address lists; hold withdrawals to addresses linked to known fake trading platforms.
• Customer questioning at withdrawal: ask whether anyone else provided the address, whether the customer is using an "investment platform" they found through a new contact, and whether they have been asked to pay fees to access profits.
• Chain-hopping signals: FinCEN flags large ether deposits quickly converted to a lower-fee token and withdrawn; monitor for rapid conversion and withdrawal patterns on the laundering side.
• Kiosk controls: transaction and daily limits for new users, prominent on-screen warnings that no legitimate business or official asks for payment at a kiosk, live help lines, and refunds procedures for confirmed scams.
• Travel Rule data: originator and beneficiary information helps identify transfers to unhosted wallets and high-risk counterparties; see the Crypto Travel Rule Compliance Guide.
• Freezing and returns: respond quickly to law enforcement and bank requests to freeze funds, and keep a documented process for returning funds to verified victims.

Platforms: adverts, impersonation and takedown

Most investment scams start with an advert, a social media profile or a messaging group. Platform and brand teams can cut off the supply of victims.

• Advertiser verification: require financial services advertisers to prove regulatory authorisation before running investment ads, and recheck when the advertiser changes landing pages.
• Public figure impersonation: detect ads and profiles using celebrities, journalists or executives, including deepfake video, and remove them quickly. See the Spotting Deepfake Scams Guide.
• Clone firm and domain monitoring: regulated firms should monitor for lookalike domains and apps using their name, report them to registrars, hosts and app stores, and ask their regulator to publish a warning. The FCA publishes a Warning List of unauthorised firms, with daily email updates.
• Messaging groups: detect "investment club" groups run by new accounts that move users to external trading sites.
• Regulatory duties: in the UK, the Online Safety Act includes duties on the largest platforms concerning fraudulent advertising; check Ofcom's current implementation timetable for what applies to your service.
• Feedback loops: share confirmed scam domains, wallet addresses and advertiser identifiers with banks, exchanges and industry bodies. See the Fraud Data Sharing and Consortium Intelligence Guide.

Reporting and working with law enforcement

• US SARs: FinCEN asks institutions to use the key term "FIN-2023-PIGBUTCHERING" in SAR field 2 and the narrative, and to select "Fraud-Other" with the description "Pig Butchering". Include wallet addresses, transaction hashes, exchange names and the scam platform's domains.
• Victim reporting: encourage and help victims to report to IC3 in the US or the national reporting service elsewhere; see the Consumer Reporting Routes Map.
• Fast freezes: the FBI's Financial Fraud Kill Chain froze funds in 66% of the incidents its Recovery Asset Team handled in 2024; the same speed principle applies to exchange freezes.
• Proactive notification: be ready to act on law enforcement notifications that a customer is a probable victim, as in Operation Level Up, with a specialist call rather than a letter.

Decision guidance

• Rules or models: start with FinCEN red flag rules in shadow mode to measure volumes, then add models trained on confirmed scam outcomes. Rules give explainable interventions; models catch novel payment paths.
• Hold or block: holds with a conversation preserve the customer relationship and protect the vulnerable; outright blocks of all crypto purchases are blunt and push victims to other providers. Offer customer-chosen blocks instead.
• Small institutions: credit unions, small banks and payment firms can buy in red flag rules and scam address lists through consortiums, and concentrate human effort on first payments to exchanges by older or inactive customers.
• Large institutions: run a dedicated scam intervention team, real-time scoring on all channels, and a feedback loop from complaints and reimbursement claims into models.
• Exchanges: balance onboarding speed against first-withdrawal risk; a short cooling-off period on first external withdrawals catches many victims with little impact on genuine users.

Measuring the programme

• Prevented loss: value of scam payments stopped or abandoned after intervention, against confirmed scam losses.
• Intervention effectiveness: share of high-risk payments abandoned after a hold or call, and share of those later confirmed as scams.
• Repeat victimisation: share of victims who make further scam payments within 90 days, including recovery scams.
• Time to freeze: median time from a scam report to a freeze request at the receiving bank or exchange.
• False positive cost: holds and calls per confirmed scam, tracked to keep friction proportionate.
• Takedown speed: median hours from detection of a clone site or impersonation ad to removal.

The Fraud Metrics and KPIs Guide covers metric design in more depth.

Common failure patterns

• Generic warnings. "Is this payment genuine?" pop-ups that a coached victim clicks straight through.
• Treating the exchange as the end of the line. A bank allows payments to a regulated exchange without scrutiny because the exchange is legitimate, although the fraud happens one step later.
• One conversation, then release. Releasing a payment after a single call in which the customer repeats the scammer's cover story.
• Ignoring the second wave. No flag on known victims, who are then hit by "fee to withdraw" and recovery scams.
• Siloed signals. Fraud, AML and complaints teams each see part of the pattern and nobody joins it up.
• Slow takedown. Clone sites and impersonation ads using the firm's own brand stay up for weeks.

Framework mapping

For broader fraud programme structure see the Fraud Prevention Maturity Model.

Practitioner checklist

• Implement FinCEN pig butchering red flags as monitoring rules, starting in shadow mode.
• Risk-score first payments to exchanges, kiosk operators and new investment payees, especially after savings cash-outs or new borrowing.
• Replace generic warnings with scam-specific questions, and hold high-risk first payments for a specialist call.
• Check investment firm payees against regulator registers and warning lists, using register contact details only.
• For exchanges, add cooling-off on first external withdrawals and screen destination addresses against scam intelligence.
• Monitor for clone sites, apps and impersonation ads using your brand, and track takedown times.
• Flag confirmed victims for follow-up scams and recovery fraud.
• File SARs with the FinCEN key term and full blockchain detail, and support victims in reporting.
• Share scam domains, addresses and advertiser data through consortiums and with platforms.
• Report prevented loss, intervention effectiveness and repeat victimisation monthly.

Standards and references

• FBI IC3: 2024 Internet Crime Report
• FinCEN: Alert on Prevalent Virtual Currency Investment Fraud Schemes Commonly Known as Pig Butchering (FIN-2023-Alert005)
• FCA ScamSmart: How to avoid investment scams
• Payment Systems Regulator: APP fraud reimbursement protections
• Payment Systems Regulator: APP scams
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Romance and Investment Scam Awareness Guide · Authorised Push Payment (APP) Fraud Guide · Money Mule Detection Guide · Crypto Scam and Drainer Guide · Fraud Prevention Guide for Digital Businesses