FinCEN Advisory FIN-2021-A002 — COVID-19 Economic Impact Payment Fraud (Feb. 24, 2021)
Summary
FinCEN Advisory FIN-2021-A002, dated February 24, 2021, alerts financial institutions to fraud and other financial crimes involving the Economic Impact Payments (EIPs) authorized by the CARES Act and the Coronavirus Response and Relief Supplemental Appropriations Act of 2021. It lists the frauds U.S. authorities have detected: fraudulent, altered and counterfeit checks, theft of EIPs from the mail or through stolen identities, phishing that uses EIPs as a lure, and seizure of EIPs by companies that control a person's finances. Red flags include accounts receiving many EIPs for people other than the account holder, a child under age 17 whose account received numerous EIPs, rapid consolidation followed by cash or virtual-currency withdrawals, and nursing homes keeping residents' payments. FinCEN asks filers to put "FIN-2021-A002" in SAR field 2 and select SAR field 34(z) (Fraud - other).
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
FIN-2021-A002 February 24, 2021
Advisory on Financial Crimes Targeting COVID-19
Economic Impact Payments
Detecting, preventing, and reporting financial crimes related to Economic Impact
Payments is vital to the United States’ economic recovery, and critical to protecting
innocent people from harm.
This Advisory should be shared with: Introduction
• Chief Executive Officers
The Financial Crimes Enforcement Network (FinCEN)
• Chief Operating Officers
is issuing this advisory to alert financial institutions to
• Chief Compliance Officers
fraud and other financial crimes related to the Economic
• Chief Risk Officers
Impact Payments (EIPs),1 authorized by the Coronavirus
• AML/BSA Departments
Aid, Relief, and Economic Security (CARES) Act,2 and
• Legal Departments
the Coronavirus Response and Relief Supplemental
• Cyber and Security Departments
Appropriations Act of 2021.3
• Customer Service Agents
• Bank Tellers This advisory contains descriptions of EIP fraud, associated
red flag indicators, and information on reporting suspicious
activity. This Advisory is part of a series published by
SAR filing request
FinCEN on COVID-19-related frauds and criminal activity.4
FinCEN requests financial
institutions reference this advisory This advisory is based on FinCEN’s analysis of COVID-19-
in SAR field 2 (Filing Institution related information obtained from Bank Secrecy Act (BSA)
Note to FinCEN) and the narrative data, public reporting, and law enforcement partners.
by including the following key Additional COVID-19-related information is located on
term: “FIN-2021-A002” and select FinCEN’s website at https://www.fincen.gov/coronavirus,
SAR field 34(z) (Fraud - other). which also contains information on how to register for
Additional guidance for filing FinCEN Updates.
SARs appears near the end of
this advisory.
1. For more information about EIPs, see Treasury Press Release, “Treasury and IRS Begin Delivering the Second Round
of Economic Impact Payments to Millions of Americans,” (December 29, 2020); and Internal Revenue Service (IRS)
Economic Impact Payment Information Center, (Last updated February 17, 2021) and Coronavirus and Economic
Impact Payments: Resources and Guidance, (Last updated February 17, 2021). If Congress authorizes any future
payments, please monitor these resources for information related to any additional payments.
2. Public Law 116–136.
3. Public Law 116-260.
4. For a complete listing of FinCEN’s COVID-19-related publications, please visit FinCEN’s Coronavirus webpage.
1
F I N C E N A D V I S O R Y
EIP-Related Fraud and Theft
U.S. authorities have detected a wide range of EIP-related fraud and theft involving a variety of
criminal actors. The following examples are a non-exhaustive list of this type of criminal activity.
• Fraudulent checks: Fraudsters send potential victims fraudulent checks, instructing the recipients
to call a number or verify information online in order to cash the fraudulent EIP checks. Victims
are asked for personal or banking information under the guise that the information is needed to
receive or speed up their EIP. Fraudsters then use the information obtained to commit various
crimes, such as identity theft and the unauthorized access of bank accounts.5
• Altered checks: Fraudsters deposit altered EIP checks, often via automated teller machine (ATM)
or mobile device. These altered checks may modify the name of the payee, or leave the name
blank, and the amount may be altered prior to deposit. There is reporting of checks being
chemically altered so the original payee is removed.
• Counterfeit checks: Fraudsters deposit counterfeit EIP checks, often via ATM or mobile device.
Fraudsters have various methods to create a counterfeit check, including checks reproduced
from digital images of checks issued by the U.S. Department of the Treasury. However, such
counterfeit checks will often have irregularities involving the check number, paper, coloring,
and/or font.
• Theft of EIP: Such thefts can include individuals stealing an EIP from the U.S. mail; requesting
an EIP disbursal for an ineligible person; seeking another person’s EIP without the payee’s
knowledge and/or approval, or through coercive means; or using stolen Personally Identifiable
Information (PII), including providing false bank account information to the IRS to claim an
EIP.
• Phishing schemes using EIP as a lure: Fraudsters perpetrate phishing schemes using emails,
letters, phone calls, and text messages containing keywords such as “Corona Virus,”
“COVID-19,” and “Stimulus,” with the purpose of obtaining PII and financial account
information, such as account numbers and passwords.6
• Inappropriate seizure of EIP: A private company that may have control over a person’s finances
or serves as his or her representative payee seizes a person’s EIP, for wage garnishments or debt
collection, and does not return the inappropriately seized payments.7
5. See IRS News Release, “IRS Issues Warning about Coronavirus-related Scams; Watch Out for Schemes Tied to
Economic Impact Payments,” (April 2, 2020).
6. See IRS News Release, “IRS Warns Against COVID-19 Fraud; Other Financial Schemes,” (June 8, 2020). For more
information about phishing schemes and identity theft related to COVID-19-relief efforts, including red flags, see
FinCEN Advisory, FIN-2020-A005, “Advisory on Cybercrime and Cyber-Enabled Crime Exploiting the Coronavirus
Disease 2019 (COVID-19) Pandemic,” (July 30, 2020); and FinCEN Advisory, FIN-2020-A003, “Advisory on Imposter
Scams and Money Mule Schemes Related to Coronavirus Disease 2019 (COVID-19),” (July 7, 2020).
7. See Social Security Administration, Second Economic Impact Payment (Last updated January 15, 2021) and Economic
Impact Payments Paid by the CARES Act (Last updated November 23, 2020); and IRS Press Release, “Economic
Impact Payments Belong to Recipient, not Nursing Homes or Care Facilities,” (June 16, 2020).
2
F I N C E N A D V I S O R Y
Red Flag Indicators of Financial Crimes Related to EIPs
As no single financial red flag indicator is necessarily indicative of illicit or suspicious activity,
financial institutions should consider all surrounding facts and circumstances before determining
if a transaction is suspicious or otherwise indicative of potentially fraudulent activities related to
COVID-19. In line with a risk-based approach to compliance with the BSA, financial institutions
also are encouraged to perform additional inquiries and investigations where appropriate. FinCEN
has identified the financial red flag indicators described below to alert financial institutions to
potential fraud and thefts related to EIPs as well as to assist financial institutions in detecting,
preventing, and reporting suspicious transactions related to such activities. Such financial red flag
indicators may include:
Fraudulent, altered, counterfeit, or stolen EIP checks, Automated Clearing House (ACH) deposits, and
prepaid debit cards
An account holder attempts to deposit one or more checks that appear to be issued by the
U.S. Treasury, but are fraudulent or counterfeit checks.8 When questioned, the customer may
disclose that he or she:
(i) was sent a partial payment, and needed to verify his or her PII or financial information
before receiving the full EIP; or
(ii) received the check purportedly from a current or former employer with instructions that the
check was the customer’s “stimulus payment” and that he or she was to buy prepaid cards
and send them to another individual.
An existing account receives, or an account holder makes, multiple EIP-related deposits for
individuals other than the account holder(s), and the individuals named on the checks reside
outside the geographic region of the account holder, or do not have a history at the account
holder’s purported address. This may be indicative of funnel account activities in which
multiple EIPs are deposited or transferred throughout the United States into one account,
which may be held by a fraudster or a money mule working for the fraudster.
An existing account receives an excessive number of EIPs via U.S. Treasury check or deposits
related to a prepaid debit card linked to the same address (e.g., an account receiving more
checks than expected relative to the customer’s profile and financial institution’s customer due
diligence).
8. The U.S. Secret Service (USSS) and the Department of the Treasury announced several security features in official U.S.
Treasury checks. See USSS Press Release, “U.S. Secret Service in Partnership with the U.S. Department of the Treasury
Launch – Know Your U.S. Treasury Check Campaign,” (April 20, 2020). For a description of the official U.S. Treasury
check, see U.S. Treasury Check Security Features, (April 2020). The status of EIP and other Treasury checks can be
determined by using Treasury’s Bureau of Fiscal Services’ Treasury Check Verification System (TCVS).
3
F I N C E N A D V I S O R Y
A customer opens a new account with an EIP check or debit card, and the name of the
potential account holder is different from that of the depositor or the payee of EIP.
The EIP check is deposited, or the debit card’s funds are transferred, into dormant accounts
with little or no prior activity.
Theft of multiple EIPs
Individual accounts opened after the U.S. government announced the EIP program, receive
U.S. Treasury checks or direct deposits from the U.S. Treasury that could indicate multiple
EIPs, and for individuals other than the account holder.
The account holder is a child under age 17 at the end of the taxable year, but the account
received numerous EIPs.
Rapid transfers of multiple EIPs into one account could indicate that bad actors are
consolidating the payments. After the funds are consolidated, the funds may be quickly
(a) withdrawn via large cash withdrawals or serial ATM withdrawals; (b) used to purchase
convertible virtual currencies (CVC); (c) transferred out of the account via a money services
business such as cryptocurrency exchangers and peer-to-peer mobile payment systems, or
wire transfers to other accounts; (d) used for large purchases at merchants that offer cash back
as an option, in amounts not typical of this type of merchant; or (e) transferred onto prepaid
debit or gift cards.
An account receives several EIP-related deposits and almost immediately thereafter (a)
disburses funds for large purchases at merchants that offer cash back as an option, in amounts
not typical of this type of merchant, or (b) has funds transferred onto prepaid debit or gift
cards.
Deposits of one or more EIP U.S. Treasury checks or electronic deposits made into an account
held by (a) a retail business, or (b) a personal account of a business owner or employee and
the account holder is not the payee/endorser. This may indicate that the business is using
identifiers of its employees or customers to apply for their EIP benefits for the purpose of
inappropriately collecting the payments.
The same Internet Protocol (IP) address is used to transfer funds from several EIP debit
cards to a bank account, especially if that IP address is located outside of the United States or
associated with a business.
Other frauds and thefts occurring in an account receiving EIPs
An account receives (a) numerous deposits or electronic funds transfers (EFTs) that indicate
the payments are linked to EIPs, and (b) unemployment insurance payments9 from one or
more states in names that do not match the account holder(s).
9. FinCEN Advisory, FIN-2020-A007, “Advisory on Unemployment Insurance Fraud During the Coronavirus Disease
2019 (COVID-19) Pandemic,” (October 13, 2020).
4
F I N C E N A D V I S O R Y
An account with several EIP deposits also receives numerous tax refunds from federal and
state governments for individuals other than the account holder(s). The names indicated on
the EIPs and tax returns may be the same but are not those of the account holder(s).
Deposits of one or more EIP checks or electronic deposits are made into a nursing home or
assisted living facility’s business account and those payments have not been returned to
the resident. This may be an indication that the business is inappropriately withholding
residents’ EIP funds.
Information on Reporting Suspicious Activity
Suspicious Activity Report (SAR) Filing Instructions
SAR reporting, in conjunction with effective implementation of BSA compliance requirements
by financial institutions, is crucial to identifying and stopping EIP-related fraud and theft.
Financial institutions should provide all pertinent information in the SAR.
• FinCEN requests that financial institutions reference this advisory by including the key
term “FIN-2021-A002” SAR field 2 (Filing Institution Note to FinCEN) and the narrative
to indicate a connection between the suspicious activity being reported and the activities
highlighted in this advisory.
• FinCEN also requests that filers mention “economic impact payment” in the SAR narrative
along with any other relevant behavior, such as counterfeit checks, money mule activity, or
identity theft, to indicate a connection between those activities and EIP frauds and thefts.
Additionally, FinCEN requests that filers use this program-specific term and avoid relying
on generalized key terms, such as “stimulus check.”
• Financial institutions should also select SAR field 34(z) (Fraud - other) as the associated
suspicious activity type to indicate a connection between the suspicious activity being
reported and COVID-19. Financial institutions should include the type of fraud and/or
name of the scam or product (e.g., economic impact payment) in SAR field 34(z).
• FinCEN requests filers not report the potential victim of an EIP fraud scheme as the subject
of the SAR. Rather, all available information on the victim should be included in the
narrative portion of the SAR.
• Please refer to FinCEN’s May 2020 Notice Related to the Coronavirus Disease 2019
(COVID-19) and February 2021 Consolidated COVID-19 Suspicious Activity Report Key
Terms and Filing Instructions, which contain information regarding reporting COVID-19-
related crime, and reminds financial institutions of certain BSA obligations.
5
F I N C E N A D V I S O R Y
For Further Information
Questions or comments regarding the contents of this advisory should be addressed to the FinCEN
Regulatory Support Section at frc@fincen.gov.
For more information about TCVS, please visit Treasury’s Bureau of Fiscal Services website,
Treasury Check Verification System, or contact Fiscal Service at (855) 868-0151, option 1 or
paymentintegrity@fiscal.treasury.gov.
The mission of the Financial Crimes Enforcement Network is to safeguard
the financial system from illicit use, combat money laundering and its
related crimes including terrorism, and promote national security through
the strategic use of financial authorities and the collection, analysis, and
dissemination of financial intelligence.
6
File and source
- File
- FIN-2021-A002_Economic-Impact-Payments_2021-02-24.pdf
- Size
- 623,311 bytes
- SHA-256
- e40808f4ef76fe9e2843c2c2f0071b5bbc74f1b35388a6d7f4fbff21835f5cfe
- Original
- www.fincen.gov