Merchant-based money laundering part 2: Prepaid gift card smurfing

Editor's Note: This article originally appeared on the Association of Certified Financial Crime Specialists on January 26, 2017.

During the holiday season, when you were in a time crunch to get something for that special someone, or an acquaintance you felt obligated to shop for, you may have entered a pharmacy and noticed how easy it was purchase a prepaid gift card.

For you, it was an easy gift, because the recipient could likely use the plastic cash anywhere to get themselves something they actually wanted.

You could easily have gotten several prepaid cards and spent a few hundred dollars. In that scenario, everyone is happy because you get to shop en masse, and that ridiculously long Christmas list finally started to shrink – about the same time as the weight of your wallet.   

But that freedom of choice also extends to the criminal element, who also want the financial freedom and anonymity prepaid cards can offer – that is, if you employ classic smurfing techniques used to launder drug money and adapt them to the prepaid card, or stored value, front.

The problem is a challenging one with real life repercussions. In many recent high-profile criminal and terror acts, such as those in Paris and other countries, groups used prepaid cards to fund their operations.

These groups can act as “smurfs” by fanning out to many retailers without them putting all of the pieces together – in many instances choosing pharmacies, not unlike drug dealers scouring pharmacies in decades past for cold pills that, at the time, were a critical precursor for meth.

At issue is a sometimes disjointed relationship between banks issuing the cards, merchant acquirers processing the cards, the card companies with their name on the cards and the merchants using the cards. In this second piece on merchant-based money laundering, we will be looking at the role, responsibilities and some potential best practices for merchant acquirers.

In short, while some merchant acquirers may be banks, be part of a bank or owned by a bank and thus subject to financial crime compliance rules, in certain cases they simply perform designated functions through third-party relationships, thus creating a possible crease for criminals.  

Many acquirers are third-party companies that have visibility into what and how prepaid cards are being used and can gain insight into, say, if a large number of cards are being processed by a certain merchant, or even a high-risk foreign company or nebulous online operation.

But these merchant acquirers are typically more worried about a merchant that could be engaged in fraud, not the merchant processing cards as part of a broader international network to launder money.

Depending on the make up of the company, merchant acquirers may not be subject to formal anti-money laundering (AML) obligations under state, federal or contractual rules.

Organized criminal groups are increasingly exploiting this perceived gap in the stored value supply chain to move illicit funds and make them look clean, a dynamic even more insidious if the unsavory characters already have a merchant account at a brick-and-mortar or online business, or have co-opted a previously unsullied business through bribery or corruption.

'Open loop' is often most attractive for criminal ends

They do this by exploiting certain oversight mechanics and transaction thresholds created as part of AML and anti-fraud rules.

Typically, identification rules in bank transactions, such as a deposit or withdrawal of more than $10,000, and a wire transfer of more than $3,000, come with obligations to get individual details and put it into a customer transaction report (CTR).

As well, if a person goes into a bank and tries to deposit more than $10,000 in prepaid cards or uses more than $3,000 in cards to wire money, the bank would ask for identification.

On that note, as a point of context, if a seller of prepaid access, such as a pharmacy, sells a prepaid re-loadable card then the issuing bank needs to collect basic KYC information on the purchaser within a certain time period, or the card will be deactivated and the individual wont be able to load more money onto it.  

But, in many instances, if a criminal goes into any of the array of small and large stores that sell prepaid cards – the preferred method due to their ubiquity is pharmacies – and only spends between $300 and $500, they can purchase a card that can be used at nearly any merchant in the United States with nary a second glance.

Some retailers have set certain ID thresholds as low as $300 or $500, a figure that a card smurf would find out to determine his laundering ceiling.

The preferred method is through what are termed “open-loop” prepaid cards, typically associated with a major card or bank brand and that can be used across the United States and in some cases internationally. In the prepaid, or stored value, space, there are also “closed-loop,” cards, such as a non-reloadable card that can only be used at a specific restaurant or retailer.

Those have a significantly lower risk to be used by criminals to store and launder money, but still can be. 

The open-loop prepaid gift cards are issued by the same major card brands as non-reloadable, meaning you can only load cash on them one time. There are other open-loop prepaid debit cards which are reloadable, but reloading them more than once would require some type of verification of your identity with the issuing bank.

Also, you may have noticed that if you purchased an open-loop prepaid gift card with cash that there was no attempt by the store’s employees to verify your identity and the card was activated before you left the store. 

The non-reloadable open-loop prepaid gift cards typically have a maximum load amount of $500 and these cards can only be used at a physical or online merchant located within the United States. 

However, even with these sensible restrictions, these cards are susceptible to a money laundering scheme which can be described as prepaid gift card smurfing.

As we said, this article will explore the money laundering risks associated with a non-reloadable open-loop prepaid gift card, which we have shortened for editorial purposes to “prepaid gift card.” 

Even though it won’t be covered in this story, there is still an ongoing debate regarding prepaid cards which are carried across the United States border without counting towards the cross border reporting requirement of $10,000, though they clearly should, say experts.

Currently, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) is trying to create rules that would subject prepaid cards to the same rules as cash at border crossings, but the agency has run into political, economic and logistical hurdles to craft a system that would allow smooth travel and trade, but create a filter for card-carrying criminals.

The Scheme

Despite the dollar limit and geographic restrictions placed on prepaid gift cards, there are still money launderers that will exploit the ability to load cash anonymously onto these cards. 

This scheme requires effort and the money launders will need to have their own physical or virtual card terminals or a relationship with a business that does to extract the value from the cards to a bank account. 

The effort comes into play because an individual would need to travel from store to store purchasing prepaid gift cards with cash. 

This is not a new idea as this type of smurfing scheme has been well documented by various law enforcement agencies.

As we have stated, “smurfing” is where individuals, such as in the case of drug dealers on a physical scale, would make small purchases of Sudafed at different pharmacies to support illicit methamphetamine production – making it nearly impossible for any one pharmacy to put all the pieces together and report the activities to authorities.

Mexico restricts import of pseudoephedrine and ephedrine

But to truly understand the lengths that criminals will go to employ lower-ranking, expendable agents, or even dupe vulnerable or homeless people, to smurf gift cards, you need to get a quick history lesson on how pharmacies have been victimized in the past, in this case to by Mexican cartels to get a vital chemical precursor to meth.

Here is the story.

The Mexican drug trafficking organizations (DTO) were producing massive of amounts of methamphetamine with the help of imported chemicals and smuggling their end product to the United States in decades past.

To combat the DTOs the Mexican government restricted the import of chemicals used to produce methamphetamine, but ironically this led to the production operations being moved back to the United States.

“Pseudoephedrine and ephedrine import restrictions in Mexico resulted in decreased Mexican methamphetamine production in 2007 and 2008,” according to the Justice Department.

In 2005, the Government of Mexico (GOM) began implementing progressively increasing restrictions on the importation of pseudoephedrine and ephedrine. In 2007, the GOM announced a prohibition on pseudoephedrine and ephedrine imports into Mexico for 2008 and a ban on the use of both chemicals in Mexico by 2009.

Due to the strict regulation of these types of chemicals in the United States the DTOs found it easier to source the chemicals they needed by having smurfs purchase small amounts of Sudafed from various pharmacies, so doing the same thing to get their hands on dozens and hundreds of prepaid cards in some cases is no problem.   

For instance, in October 2007, a Fresno County investigation revealed that a couple “had been conducting daily pre-cursor chemical smurfing operations, soliciting homeless individuals to travel from store to store to purchase pseudoephedrine. In exchange, the couple paid each person approximately $30 and some-times gave the individuals alcohol,” according to the Justice Department.

Source: Merced County Sheriff's Department.

Note: This waste was left alongside the road in a commercial orchard in Merced County in 2008. Among the waste were approximately 10,000 empty pseudoephedrine blister packs.

The Sudafed smurfing operations illustrate that some people are willing to go out and purchase small amounts of a product from various store locations if they are compensated with money or drugs. 

However, thanks to the “Combat Methamphetamine Epidemic Act of 2005” and the National Precursor Log Exchange (NPLEx), which track an individual’s over-the-counter (OTC) medication purchases that contain the precursors used to manufacture methamphetamine, the illicit production of this destructive drug has been hindered to a certain degree. 

Density of Pharmacies in major cities

But that law has no bearing on prepaid cards, and they are just as available as precursor chemicals were in pharmacies.

Traveling from pharmacy to pharmacy to make small incremental purchases of prepaid gift cards would work best in major cities given the density of stores within a given radius.

For instance, just look at how easy it would be to jump from pharmacy to pharmacy in Gotham.

New York City is densely populated and based on a list issued by the Department of Health and Mental Hygiene, there were 253 pharmacies in the borough of Manhattan. 

These 253 pharmacies are only a subset of the total number of pharmacies in Manhattan because they were identified as the ones which provide the drug Naloxone without a prescription and generally most major pharmacies sell prepaid gift cards.

Map of NYC Pharmacies

Sammy the Smurf

Let’s examine a scenario where a fictitious Smurf named Sammy travels to 50 different pharmacies in one day and 250 over the course of the week as a way to see how much a smurf can launder. 

Sammy plans his route so he would visit the same pharmacy only once per week which would diminish any type of suspicion from the store’s employees because it would appear as if he was loading his weekly wage onto a prepaid gift card.

If, Sammy loaded $500 on 50 prepaid gift cards per day for 5 days per week, then it would total $25,000 per day and $125,000 per week.

If, Sammy the Smurf did this over a 52-week period then he would have loaded $6,500,000 of cash onto prepaid gift cards. 

Furthermore, if Sammy was compensated the New York minimum wage of $11.00 per hour for his efforts – something a criminal group acting as a real company could do – then the cost of activating 250 prepaid gift cards over the course of one week would amount to approximately three times his weekly wage for a 40-hour work week. 

The total annual cost of implementing this smurfing scheme would only be 1.33 percent or it would cost $87,880 to load $6,500,000 of cash onto prepaid gift cards which includes card activation fees and a full time Smurf earning the New York minimum wage.

Evading the Currency Transaction Report (CTR) threshold

Sammy the Smurf was a rather extreme example of prepaid gift card smurfing, but merchants being controlled by a criminal group, or working in concert with criminals for a fee, could use this scheme on a smaller scale to evade the $10,000 CTR threshold. 

There is nothing wrong with a customer depositing more than $10,000 in cash at their local bank, but it will need to be reported to FinCEN, the nation’s financial intelligence unit and arbiter of anti-money laundering (AML) laws, so some business owners are weary to deposit that much cash at one time. 

If, businesses were motivated to remain below the $10,000 threshold, for whatever reason, then they could load a couple of thousand dollars onto prepaid gift cards and process those cards at their physical or virtual card terminals.

But that begs the question: should a prepaid gift card be considered equivalent to cash?

Well, of course it should.  If, anyone can load cash onto a prepaid gift card at various retail locations and a merchant can process those cards which will result in an automated clearing house (ACH) transfer directly to their bank account, then what is the difference between that process and walking into a bank and depositing the physical cash?

Clustering customers and activity for outlier detection

To answer that, you have to get a better understanding of how prepaid card networks operate.

If a coopted merchant was engaging in a prepaid gift card smurfing scheme then there would be discernable red flags which could be detected by the merchant acquirer. 

Merchant acquirers enable merchants to “process credit and debit card payments and help in increasing sales by accepting the most popular cards to attract customers to their businesses,” according to a report by Capgemini.

Typically, a card payment transaction involves two sides: the first between the cardholder and the bank that issued their card; and the second between the merchant and the acquiring bank, according to the report.  

On the whole, cardholders only deal with merchants and the issuing bank while performing card transactions; they are not concerned with the merchant acquiring side of the industry, according to the technology and consulting firm.

However, this second acquiring side of the industry contains a network of highly advanced intermediaries who handle card transactions via authorization, clearing and settlement, and dispute management, according to the firm.

But merchant acquirers may need some help when it comes to identifying certain patterns that could be tied to money laundering.

To detect this type of behavior, the merchants would need to be clustered into similar segments that could be based on business classification, card type and processing volumes.

The businesses could be classified by standard industry lists such as the merchant category code (MCC) or the North American Industry Classification System (NAICS) code. 

The card processing volumes would be the total volume and value of transactions processed over a specific period of time. Merchants could be grouped into volume categories such as low, medium, high and very high. 

The business classification and volume category would be used to determine what the average processing profile was for each category of credit, debit and prepaid cards. The card type can be determined by the first 6 digits of the card which is known as the bank identification number (BIN).

As an example, let’s say the merchant acquirer grouped all of their merchants with a MCC of 5812 (Eating places and Restaurants) together with an average card processing volume between $10,000 and $30,000 per month. 

When all of the merchants within the 5812 code and $10,000 and $30,000 processing volume are grouped together then the average prepaid gift card volume is calculated to be 1.5 percent.

By parsing out these data points, if, a particular merchant has a prepaid gift card volume of 40 percent, then a merchant acquirer could determine it may be suspicious because it is a significant deviation when compared to the other members in the group.

The cost of regulation

But in order to nudge merchant acquirers to engage in ever more severe and technical analysis, it could take new, costly regulations or explicit AML obligations – something they sector would likely fight.

As the cost of regulation continues to balloon across various sectors of financial services a questions bubbles to the surface: is the problem really the regulation or the way organizations attempt to comply? 

Merchant acquirers and the major card brands do not have the same money laundering exposure as traditional banks, but this doesn’t mean that their products and services can’t be exploited for illicit purposes. 

The generation of cash from illicit activities could be derived from the most atrocious crimes and the ability to point law enforcement in the right direction through a suspicious activity report (SAR) has its own intrinsic value regardless of the dollar amount.