|
The Homeland Security Investigations (HSI) Cross-Border Financial Crime Center (CBFCC) is issuing this notice to alert U.S. financial institutions of the prevalent use of counterfeit Chinese passports by Chinese money laundering organizations (CMLOs) to facilitate criminal activity. Operating throughout the United States, CMLOs, including those with suspected associations with Fujian Organized Crime groups, have become key cogs in the multi-billion-dollar criminal empires run by Mexican cartels and other transnational criminal organizations.
CMLOs recruit Chinese nationals living in the United States to assist with laundering the proceeds of crime. These “money mules” are often enlisted by CMLOs using social media platforms, including messaging apps such as WeChat. Money mules may be told they are providing money transmission services for international students, or they are servicing unbanked Chinese citizens residing in the United States. In some instances, money mules may not even be aware of the illegality of their actions, making it essential for financial institutions to be aware of the potential red flags identified further below.
Money mules are known to use counterfeit Chinese passports supplied by the CMLO to open bank accounts for the explicit purpose of moving, concealing, and laundering the proceeds of a variety of crimes, including drug trafficking, human smuggling, prostitution, bank fraud, fraudulent mass marketing, and other financial fraud schemes. For instance, analysis of a CMLO cell by the CBFCC identified that between July 2022 and November 2023, U.S. financial institutions filed hundreds of Currency Transaction Reports—documenting tens of millions of dollars in cashier’s check purchases—associated with dozens of bank accounts opened with counterfeit Chinese passports. These accounts associated with this CMLO cell were used to launder proceeds derived from fraud and other suspected crimes.
HSI has observed that CMLOs also use counterfeit Chinese passports to perpetrate large-scale bank fraud schemes, such as “check kiting,” where they open a series of accounts at one bank and then deposit checks drawn from another series of bank accounts opened at a different financial institution. The CMLO takes advantage of the period it takes for the checks to clear (“float” time) to drain the bank accounts before the crediting financial institution is made aware that the accounts from which the checks were drawn have insufficient funds.
CMLOs are known to use WeChat to purchase high-quality counterfeit Chinese passports that are produced in China and subsequently shipped to the United States. HSI investigations have confirmed that some of these passports also contain counterfeit U.S. visas as well as counterfeit entry stamps. Upon receipt, CMLOs provide these counterfeit passports to Chinese money mules where they are used to establish bank accounts at U.S. financial institutions.
Chinese money mules recruited for these schemes often purport to be students or workers in the hospitality or food service industry, such as a chef, cook, waitress, laborer, or delivery driver, when opening bank accounts at financial institutions. These mule accounts are often funded with an initial small dollar cash deposit (e.g., $100), followed by large dollar cash deposits shortly thereafter that are inconsistent with the stated occupation of the account holder. Once opened, it is not uncommon for other members of the CMLO to use and have access to the accounts. As documented in HSI investigations, CMLOs often fly Chinese money mules to different areas of the country to make deposits into existing mule accounts. Investigators noted several instances where money mules were instructed to wear face masks when conducting transactions at financial institutions. On occasion, other members of the criminal organization were present when conducting counter transactions at banks, often claiming to act as translators.
Funds deposited into money mule accounts are almost immediately withdrawn and used to purchase cashier’s checks, generally in round-dollar amounts between $10,000 and $100,000—although negotiable instrument purchases up to and including $380,000 are noted—made payable to third parties not affiliated with the account holder. Cashier’s checks purchased by money mules are generally negotiated by the payees at different financial institutions located throughout the United States and subsequently withdrawn, with the funds used to purchase assets such as luxury goods, jewelry, or electronics. These high-value items (e.g., smart phones) are subsequently exported from the United States to China, Hong Kong, or elsewhere where they are resold for a profit.
Funds laundered as part of these schemes are also used by the CMLO to purchase real estate in the United States. For example, in September 2023, a Chinese national claiming to be a cook at a Chinese restaurant opened a checking account at a U.S. financial institution using a fraudulent Chinese passport. Between September and October 2023, the account holder purchased more than $4 million in cashier's checks made payable to various individuals and limited liability companies, including real estate companies located in major U.S. metropolitan cities. These negotiable instruments were funded either directly with cash or from recent cash deposits that had been made into the account. Purchases of U.S. real estate by CMLOs appear to be consistent with Chinese underground banking activities performed on behalf of Chinese nationals seeking to evade the People’s Republic of China’s capital flight restrictions.
 |
• Account holder declines requests for “Know Your Customer” (KYC) documents.
• Chinese passport used to open the account contains a forged or counterfeit identification page and visa stamp.
• Same photograph used for both the passport and visa image although purportedly issued years apart.
• Use of sequential passport numbers by apparently unaffiliated account holders.
• Multiple bank accounts opened by different identities using the same Chinese passport number at the same financial institution.
• Bank accounts opened with different identities and passport numbers, but with the same physical address, phone number, or email address.
• Account holder lists their occupation as laborer, restaurant worker, hospitality worker, self-employed, or unemployed at account opening, then immediately commences purchasing negotiable instruments with large amounts of cash, non-commensurate with their employment status.
• Bank account opened with small cash deposits, then solely used to purchase high-value negotiable instruments with large amounts of cash, payable to multiple individuals and businesses.
• Account holder acting evasive or otherwise unsure of the spelling of official check payees or refusing to answer questions regarding the source or purpose of the funds.
• Information provided by the account holder in support of transactions appears false or contradictory.
• Account holder attempts to avoid filing of Currency Transaction Reports, including attempting to bribe bank branch officials with designer gifts.
• Account holder unable to explain the source of large cash deposits; when asked for names, addresses, and relationship of the parties who provided the cash, the requested information is not provided.
• Almost all the credits and debits in the account holder’s checking account do not appear to be for payroll or living expenses.
• The source of the cash and the relationship between the account holder and the cashier's check recipient(s) is unknown and the volume appears excessive for a personal account.
HSI encourages the public to report suspected suspicious activity through its toll-free Tip Line at 1-866-347-2423 or by completing an online Tip Form available at https://www.ice.gov/webform/ice-tip-form.
For areas outside the United States and Canada, callers should dial 802-872-6199. Hearing-impaired users may call TTY 802-872-6196.
|
