Cornerstone November 2023 Issue #46

Homeland Security Investigations Cornerstone

November 2023 ISSUE #45

200 Plus HSI Special Agents

Designated HSI Cornerstone representatives across all HSI field offices.


Did You Know?
HSI special agents are available to provide training and share red flag indicators, criminal typologies, and methods with businesses and industries that manage the very systems that terrorists and criminal organizations seek to exploit.

Binoculars1

BE ON THE LOOKOUT FOR ISSUE #47

December 2023

Money Laundering Typologies


Email Logo

Want to schedule a Cornerstone presentation?

Email Cornerstone@hsi.dhs.gov 
for more information.


Girl HELP

Child Sexual Exploitation in Financials

Child sexual exploitation involves victimizing a minor for sexual gratification or some other personal or financial advantage. It includes acts related to child sexual abuse material (pornographic images and video of children), transnational child sexual abuse and child sex trafficking. Each year, DHS forensically examines more than 3,000 terabytes of data in support of child sexual exploitation investigations. In particular, the permanency of child sexual abuse depicted in images and video allows offenders to victimize children with each view. Beyond hard drives where many perpetrators store thousands of files depicting the sexual abuse of children, smart phones and other web-enabled devices allow perpetrators to possess, transport, or have access to millions of files that depict the sexual abuse of children.

These web-enabled devices with digital cameras are in the palms of offenders’ hands all over the world, allowing perpetrators to produce and share child sexual exploitation and abuse material almost instantaneously. Traditionally, perpetrators share child sexual abuse material with one another in close-knit, likeminded communities online without profiting from the trade. Increasingly, though, perpetrators abuse children, mostly young children, and babies, remotely using an internet connected camera, or webcam, often called live streaming of abuse, for money. Abusers offer livestreaming for low prices and profit from the volume of transactions. A single livestreaming abuser may have thousands of buyers, many of whom are in the United States, interested in watching a livestreamed child sexual abuse session. A single buyer often views many thousands of unique abuse sessions.

Child sexual abuse is a crime that happens across race, religion and class and has lifetime effects. It includes any interaction between a child and an adult (or another child) in which the child is used for the sexual stimulation of the perpetrator or an observer. Child sexual abuse is often predicated on silencing the victim, and as a result, reporting and disclosure is low. Even without knowing the full scope of child sexual abuse instances, most experts will agree that 500,000 children will be impacted by child sexual abuse per year.

For more information, please refer to the Department of Homeland Security’s, “Strategy to Combat Human Trafficking, the Importation of Goods Produced with Forced Labor, and Child Sexual Exploitation,” (January 2020).

Studies by David Finkelhor, Director of the Crimes Against Children Research Center, show that:

  • 1 in 5 girls and 1 in 20 boys is a victim of child sexual abuse;
  • Self-report studies show that 20% of adult females and 5-10% of adult males recall a childhood sexual assault or sexual abuse incident;
  • During a one-year period in the U.S., 16% of youth ages 14 to 17 had been sexually victimized;
  • Over the course of their lifetime, 28% of U.S. youth ages 14 to 17 had been sexually victimized;
  • Children are most vulnerable to CSA between the ages of 7 and 13.
kid door hand

Understanding Child Sexual Exploitation

FinCEN (FIN-2021-NTC3) defines Child Sexual Exploitation (CSE) as conduct that includes travel in interstate or foreign commerce to engage in illicit sexual conduct with any child under the age of 18; extraterritorial child sexual abuse committed by U.S. citizens and nationals; child sex trafficking; and all other acts involving criminal sexual abuse of children under the age of 18.

Online Child Sexual Exploitation (OCSE) is the use of the internet or mobile phones as a means:

  • To engage or attempt to engage in child sexual exploitation
  • To persuade, induce, entice or coerce a minor to engage in any illegal sexual activity
  • To commit an offense involving child sexual abuse material

Types of Child Sexual Exploitation:

  • Online transmission of live video of a child engaged in sexual activity
  • Physical intrusion of a sexual nature, whether by force or under unequal or coercive conditions
  • Child pornography 
  • Child sex tourism  
  • Child sex trafficking/prostitution 

man gaming

Child Sexual Predator Typologies

Several sexual predator typologies have been identified and an examination of financial accounts for these patterns may warrant the filing of a suspicious activity report (SAR) or require further investigation.  As always, any one of the below or even several individual typologies do not mean the customer is participating in CSE; however, in the account review, look at the totality of the activity:

  • Payments (lower dollar domestic and cross border $10-$500 USD): Western Union, Money Gram, PayPal, Venmo, Zelle, Cash App or other money service remitters capable of sending payments to High-Risk Countries (HRC) Additionally, the use of cryptocurrency is utilized as a means of payment so be aware of payments to exchanges such as Coinbase, Binance or other forms of purchasing cryptocurrency (PayPal)
  • Travel and activities in HRC (transactions or bank account login) Airline ticket to HRC, hotel booked in HRC which are noted as: Brazil, Colombia. Dominican Republic, Ghana, India, Indonesia, Jamaica, Mexico, Romania, South Africa, Thailand, Philippines, and Ukraine
  • Privacy and Security: VPN, TOR, encryption software, virtual machine, IP account access in multiple states and HRC
  • Other Purchases that might be observed: server rental, screen capture, storage unit, gift card exchanges, online gaming (Roblox, Minecraft etc), adult toys, toy store, children’s clothing, amusement park, hotels in hometown or near airport, payments to adult pay websites
  • Know Your Customer (KYC): registered sex offenders and/or prior CSE related arrest, customers name, phone number, address, email address, etc. appear in negative new search or in classified ads, customer appears to have no social media profile or digital footprint, customers address on file differs significantly from branch location where account was opened with no legitimate reason

Men Red Flag

Red Flag Indicators

  • Know your customer: negative news or criminal history
  • Do the transactions make sense for the account holder
  • Review for suspicious or abnormal transaction types: modeling companies, to/from unrelated females, hotels/kid friendly resort, cannabis, low value cross border transfers
  • Review where money is coming from and/or going to High-Risk Countries
  • Payments to vendors who provide anonymity for VPN, encryption software, and live streaming platforms
  • IP addresses in multiple states
  • Transacting party has a record of CSE offenses
  • Accounts that appear to be a side account
  • Hotels in hometown or near airport without having airline tickets
  • Purchases on online gaming sites, toy store, children's clothing store, amusement park, candy shop, etc.
  • Account activity between 6pm and 2am
  • Pattern of P2P or money transfers
  • Payments to advertisers for adult ads or dating sites