• A recent advisory by the U.S. Treasury’s Financial Crimes Enforcement Network tied to the red flags of human trafficking puts more pressure on fincrime compliance professionals to help fight a global crime garnering hundreds of billions of dollars in illicit revenues.
• Faced with this unfathomable evil and new FinCEN guidelines, investigators have turned to Web Intelligence (WEBINT) technologies, which were once exclusive to government agencies, to turn the tables on traffickers, including checking online forums, chat apps, cam sites and escort sites for clues.  
• Thus, when investigated properly and with the right technology, these online platforms can yield a trove of web intelligence (WEBINT) and financial intelligence (FinTel) for investigators.
• When combatting trafficking, the disciplines of WEBINT and FinTel frequently overlap because street-level traffickers are not the brightest and have the tendency of flaunting their criminal lifestyles and purchasing behavior on social media, according to experts.

By Daniel Nisman
Head of Finance Sector Solutions at Cobwebs Technologies

The Author is a career investigator and serves as Head of Financial Crimes Solutions at Cobwebs Technologies, an Israel-based Web Intelligence company.

(Tel Aviv) In October 2020, the Financial Crimes Enforcement Network (FinCEN) modernized its transaction-monitoring guidance to help covered financial institutions combat the human-trafficking (HT) industry, which mints slave traders $150 billion worldwide per year.

For compliance and financial crime fighters already kept awake at night by a myriad of terror-financing and criminal money-laundering jitters, FinCEN’s advisory underscores just how far regulators are pushing banks to combat modern slavery.

The FinCEN advisory is also notable in that it puts more than anti-money laundering (AML) compliance teams on notice to look for the nuanced financial and human red flags tied to HT, noting that the information should be shared with nearly every level of a financial institution, from tellers to top management, the business line to the front line, including:  

• Chief Executive Officers
• Chief Operating Officers
• Chief Compliance Officers
• Chief Risk Officers
• AML/BSA Departments
• Legal Departments
• Cyber and Security Departments
• Customer-Facing Staff
• Money Services Businesses
• Casinos

Positioning banks on the front lines, this guidance  on identifying HT illustrates just how crucial the principle of “following the money” is when investigating sex traffickers and the complex online networks that often underpin their heinous enterprise.

The 2020 FinCEN missive builds on a seminal 2014 advisory by the bureau tied to HT and human smuggling, detailing potential suspicious activities that institutions could see in AML transaction monitoring systems and even in human interactions at the teller level.

Over the last decade, more individual banks, country financial intelligence units, regulators, investigators and watchdog groups have been working together to divine what tactics trafficking groups are using to monetize human suffering, move funds and support and grow their illicit networks.

At the global level, the Paris-based Financial Action Task Force (FATF), the international counter-crime compliance standard-setting body, has released several in-depth reports.

The most recent report in 2018 analyzed the money laundering risks tied to human trafficking and human smuggling and yielded insight on related financial flows, including regions at a higher risk for such crimes, such as source countries and destination countries.

Regional trafficking

Transnational trafficking flows are increasingly complex – victims are exploited within and between regions.

While many countries are source and destination countries, most countries tend to be either predominantly a source or predominantly a destination of trafficking victims.

The United Nations Office on Drugs and Crime (UNODC) found most victims detected were trafficked within the same geographical region.

For the majority of detected victims of transnational trafficking identified in the UNODC’s study, the origin country was in the same geographical region as the destination, which includes domestic trafficking.

Common regional trafficking flows include victims trafficked from SouthEastern Europe to Western Europe, from the Andean countries to the Southern Cone in South America, from East Asia to the Pacific, or victims trafficked across a single international border into neighbouring countries.

Trans-regional trafficking

In trans-regional trafficking, countries with developed economies remain key destinations, while victims tend to originate from countries with less developed economies.

The UNODC found that the Middle East, as well as most countries in Western and Southern Europe and North America, reported being destinations for trans-regional and long-distance trafficking.

In particular, they found that the wealthier the country of destination, the greater the number of detected victims from outside the immediate region.  

In Western and Southern Europe, detected victims held 137 different citizenships, particularly from Central and South-Eastern Europe (47%), SubSaharan Africa (16%) and East Asia (7%).

Similarly, North American countries detected victims from more than 90 countries of origin. The most prominent transregional trafficking flow in the study was from East Asia, as 16% of the detected victims in North America are citizens of East-Asian countries.

Trafficking victims from countries in Sub-Saharan Africa and East Asia are trafficked to the widest range of destinations. The UNODC found that 69 countries reported to have detected victims from Sub-Saharan Africa between 2012 and 2014.

To read the full FATF report, click here.

Traffickers ply their trade by kidnapping their victims, coercing them into drug addiction, ‘sextorting’ them with compromising photos, and duping them into exploitative employment arrangements.

Unlike the brothel-laden backstreets of Southeast Asia, Eastern Europe, and Latin America, however, America’s sexual slavery epidemic largely proliferates online via escort sites, dating apps, and even popular social media apps like Snapchat, WeChat, and Instagram.

Around the world, sex traffickers are prone to leaving digital clues on social media posts and classified ads that market their victims.

Thus, when investigated properly and with the right technology, these online platforms can yield a trove of web intelligence (WEBINT) and financial intelligence (FinTel) for investigators.

When combatting trafficking, the disciplines of WEBINT and FinTel frequently overlap because street-level traffickers are not the brightest and have the tendency of flaunting their criminal lifestyles and purchasing behavior on social media, according to HT experts.

FinCEN’s groundbreaking guidance empowers customer-facing staff and AML departments at financial firms with four new typologies and 10 updated “financial red flag indicators” to spot signs of HT and help law enforcement catch the worst kind of predators, who frequently exploit children as well.

These typologies include front companies, exploitative employment practices, funnel accounts, and alternative payment methods.

“Human traffickers routinely establish and use front companies, sometimes legal entities, to hide the true nature of a business, and its illicit activities, owners, and associates,” notes FinCEN.

The Treasury’s financial intelligence unit also writes that HT front establishments typically appear “legitimate with registrations and licenses.”

Frequently, these “establishments will appear to be a single storefront, yet are part of a larger network.”

Meanwhile, in one unusually sophisticated HT investigation, evidence mined from the forensic extraction of a gang member’s phone “revealed that the group’s illicit activity revolved around the purchase of Vanilla Visa prepaid credit cards, which were then used to purchase bitcoin on the Paxful virtual currency exchange.”

With this person-to-person or P2P-sourced crypto, which was much more difficult to trace prior to Western authorities’ crackdown on AML Know Your Customer (KYC) gaps, gang members purchased prostitution ads on the now-defunct Backpage website.

This sophisticated laundering tradecraft virtually masked the gangsters’ online footprints and would have stifled blockchain analysis, had HSI investigators not seized and cracked a key co-conspirators’ cell phone.  

From an intelligence standpoint, two of FinCEN’s updated financial indicators are also particularly relevant.

In the first case, FinCEN advises that AML analysts should be suspicious of customers who “frequently appear to move through, and transact from, different geographic locations in the United States.”

AML investigators should cross-reference customers that exhibit this behavior with “with travel and transactions in and to foreign countries that are significant conduits for human trafficking,” advises FinCEN.

Secondly, FinCEN highlights how HT networks will frequently reuse common identifiers.

The watchdog advises AML staff to be vigilant for customer accounts that share common contact data inputs, “such as a telephone number, email, and social media handle, or address, associated with escort agency websites and commercial sex advertisements.”

Faced with this unfathomable evil and new FinCEN guidelines, investigators have turned to Web Intelligence (WEBINT) technologies, which were once exclusive to government agencies, to turn the tables on traffickers.

Specifically, WEBINT can identify trafficker’s patterns and behaviors through social media and other channels publicly available to online investigators.

Notably, FinCEN has highlighted a new field (SAR Field 38(h)) in their suspicious activity reporting (SAR) template designated specifically for “human trafficking,” and advises covered institutions to include key digital identifiers such as “email addresses, phone numbers, and IP addresses” in SARs where sex trafficking is suspected.

Beyond the surface web, which consists of standard web queries on browser engines like Google, and the deep web that comprises chatter on social media and various peer-to-peer forums, WEBINT tools extend beyond the reach of commercial search engines into the ‘dark.’

Still, the vast majority of HT activity is transpiring on the surface and on popular social apps that comprise the deep web.

Beyond hunting and grooming young and vulnerable victims on popular social media platforms, the April 2019 arrest of a Belgian tourist in Australia, who bankrolled his holiday via the sale of child sex abuse material, illustrates the power of next-generation WEBINT analytics.

Thanks to a tip from the U.S.-based National Centre for Missing and Exploitation Children, the Australian Federal Police discovered that this tourist was advertising a website he administered and that was involved in the sale of child abuse material on various social apps, including Tumblr, Snapchat, and Instagram.

The man pleaded guilty in an Australian district court last month. He is also the first offender convicted of child exploitation offenses to have his assets seized by the AFP’s Criminal Assets Confiscation Taskforce (CACT).

The CACT managed to seize roughly $30,000 from two bank accounts in Australia and Germany and from the child abuser’s personal property.  

In a fluid, digital HT economy, where traffickers regularly migrate to new escort sites, online “hobbyist” forums, and mobile dating apps, next-generation WEBINT tools engineered to target static online classified websites like Backpage have become obsolete.

Fortunately, WEBINT technology has evolved to combat the next generation of cyber-enabled sex trafficking.

In the context of FinCEN’s elevated counter-HT regime, placing law-enforcement-grade intelligence collection tools in the hands of financial crime fighters in the private sector can thus optimize the detection and reporting of digital identifiers linked to traffickers, and enable banks to stand on the front lines in the battle against their evil trade.