FinCEN's new analysis does not say Americans definitively lost $12.7 billion to digital-asset investment scams. It says 33,904 Bank Secrecy Act reports filed from September 8, 2023 through December 31, 2025 identified about $12.7 billion in reported financial activity tied to suspected scams. That activity measure can include attempted and completed transactions, inbound and outbound transfers, transfers between accounts, amended or continuing reports, duplicates, errors, and both lawful and illicit activity.
The map's useful finding is not one loss total. It is the relationship between two ways money leaves a victim, the institutions that see different fragments, and the laundering stages that make those fragments difficult to join before funds move abroad.
The question this map answers
What do FinCEN's report count and dollar amount actually measure, how do the two observed payment routes converge into digital-asset laundering, and where can a financial institution record evidence early enough to support reporting or recovery?
MyMap reviewed FinCEN's Financial Trend Analysis, FIN-2026-Alert005, and the agency's release at 4:18 AM Pacific Time on September 4. FinCEN released the analysis and alert on September 3. The dataset covers reports filed after the agency's September 8, 2023 alert through the end of 2025; the underlying activity can predate the filing window.
In this map, reported activity is the amount attached to selected BSA filings, not an adjudicated loss. A detection surface is the part of the lifecycle visible to one filing institution. A payment route is a sequence FinCEN observed in reporting, not a claim that every scam follows it. An off-platform address is outside the centralized exchange account where the victim purchased the asset; it is not automatically proven to belong to a named criminal. A derived join connects source-described stages into an analytical workflow while preserving those limits.
The dataset begins with a filing key term, not every scam
FinCEN selected BSA reports that referenced the key term from its 2023 alert, FIN-2023-PIGBUTCHERING. It used each report's filing date rather than the date of the underlying activity, then applied manual and automated review to identify patterns.
That method produced 33,904 reports from about 1,300 financial institutions. Money services businesses, predominantly in the digital-asset sector, filed 18,568 reports, or 54.8%, covering more than $5.5 billion in activity. Depository institutions filed 13,810, or 40.7%, covering about $6.4 billion. Securities or futures firms filed 1,504, or 4.4%, covering more than $784.5 million. Twenty-two reports from institutions categorized as “Other” covered more than $8.4 million.
Those categories add to the reported total; they do not create a clean victim-loss ledger. One transfer may appear from more than one direction or in continuing reporting. A filing may include attempted transactions, a broader network, or activity that is legal even though the subject or pattern generated suspicion. FinCEN excluded a small number of reports with outlier values, but it expressly warns that the remaining total may still be overly inclusive.
FinCEN also observed average monthly growth of 10.9% in report volume and 18% in reported activity during the review period. The agency says increased use of the alert's key term may contribute to that change, so the trend cannot be read as a pure growth rate for scam incidence.
Each institution sees a different part of the same lifecycle
Depository institutions often saw a customer liquidate savings, move money out of an investment account, apply for a loan, refinance property, or send a wire to a suspicious beneficiary. Securities and futures firms most often saw investment liquidation or an attempted outbound transfer. Digital-asset MSBs saw the purchase of digital assets, a transfer to an off-platform address, or several apparent victims sending to a shared address.
No single view necessarily contains the initial unsolicited message, the fabricated relationship, the false investment interface, every funding source, the beneficiary account, the blockchain path, and the ultimate destination. FinCEN says most filing institutions reported only a snapshot of a different phase. MyMap therefore draws three observation windows across the flow instead of treating one SAR as a complete incident record.
That distinction also explains why a customer's insistence on completing a transaction is evidence to preserve, not proof of criminal control. FinCEN reports that institutions sometimes detected a scam only after substantial funds had moved. In a small number of reports, an institution dissuaded a customer or recalled funds through a cooperating third party before they moved farther.
Two payment routes converge after control changes
In the first route, the victim opens or uses an account with a digital-asset MSB, purchases an asset, and sends it to an address the scammer directs. The victim technically controls the exchange account before the off-platform transfer. That makes the decisive control change difficult for the MSB to classify from account ownership alone.
In the second route, the victim sends fiat currency by wire or ACH to an account affiliated with a scammer. The receiving infrastructure may involve money mules, shell companies, professional money launderers, or an MSB that was fraudulently created and registered to appear legitimate. The recipient or launderer can then convert the fiat proceeds to digital assets.
FinCEN reports at least 22 digital assets in the reviewed filings. Ethereum, Tether, and USD Coin appeared most frequently, though many bank filings did not identify an asset. FinCEN's analysis using commercial blockchain tools says proceeds were nearly always exchanged into stablecoins, almost exclusively USDT, regardless of the original asset. That is a source finding about the reviewed evidence—not a rule that every USDT transfer or exchange customer is suspicious.
After conversion, the alert describes rapid movement through multiple addresses, consolidation wallets that commingle funds, mixers or tumblers, and swaps across blockchains and assets. Common collection addresses can receive from several victims before sending onward to decentralized-finance protocols or foreign exchanges. The initial receiving jurisdiction does not necessarily identify the final destination.
The service layer sits beside the payment route
FIN-2026-Alert005 adds a service ecosystem around the transaction path. “Guarantee marketplaces” can provide chat-based marketing, escrow, dispute resolution, transaction insurance, online accounts, phishing tools, corporate services, and money-laundering access. Professional money launderers can establish accounts and shell companies, recruit mules, convert fiat, and move assets.
MyMap places that service layer above both payment routes because it can support several stages without becoming the beneficiary of every transaction. The alert establishes that these services are used in the ecosystem. It does not establish that every marketplace vendor, messaging account, corporation, or wallet is controlled by the same organization.
Reporting should preserve the edge, not just the amount
For activity connected to the alert, FinCEN requests FIN-2026-SCAMCENTERS in SAR field 2 and the narrative, plus Fraud-Other with “Scam Centers” in field 34(z). It asks institutions to include available accounts, locations, people, entities, beneficial owners, other financial institutions, digital-asset addresses, transaction hashes, asset types, exchange or platform names, and relevant URLs, domains, or IP addresses.
Those fields are valuable because they join observation windows. An amount without the originating account, beneficiary, address, transaction hash, time, and communication channel cannot reliably show whether two filings describe the same route. A shared address or beneficiary can be a lead, but it still requires review for custody, ownership, timing, and legitimate activity.
SAR obligations depend on applicable BSA rules and an institution's knowledge or suspicion. The alert does not declare every red flag a mandatory rejection rule. It also encourages referring potential victims to the FBI's Internet Crime Complaint Center or the nearest U.S. Secret Service field office. FinCEN's Rapid Response Program can share intelligence with foreign financial-intelligence units, but recovery depends on speed, cooperation, and foreign legal authority; filing does not guarantee interdiction or return.
Confirmed, derived, and still unknown
FinCEN confirms the review window, selection method, 33,904 reports, approximately $12.7 billion in reported activity, filer-type breakdown, two observed payment routes, common conversion and laundering techniques, partial institutional views, requested SAR fields, and the limitations attached to the data.
MyMap derives the two-lane flow, the three detection surfaces, and the join key that follows control from source funds to beneficiary account or address and then through later transactions. These are a reproducible way to connect source-described observations, not a reconstruction of one named case.
The sources leave unknown the complete number of scams; unique victims; unique incidents; exact confirmed loss; how much of the $12.7 billion is duplicated, attempted, recovered, lawful, or erroneous; the owner and jurisdiction of every address; the final destination of each transfer; which institutions filed overlapping reports; and whether a specific customer, account, company, marketplace, or asset is illicit.
The practical next step is to preserve the first control-changing transaction as one evidence bundle: timestamp, source account, beneficiary or withdrawal address, amount and asset, transaction hash, platform, customer communication, and any recall action. Then link later hops without converting “suspected” into “proven” or “reported activity” into “loss.”