AI Fraud Decoded 5 | Inside the Money Trail Scammers Make Vanish

Taiwanese investigators say the money stolen in scam-center fraud schemes rarely stays in a single account long enough to be recovered, as criminal networks increasingly route stolen funds through stablecoins, gold and decentralized crypto wallets to erase any trace back to victims.

According to an anonymous official at Taiwan's Bureau of Investigation who spoke about the mechanics of fraud-related money laundering, once money leaves a victim's bank account, it typically passes through a chain of intermediaries. These include straw accounts, cash couriers, and so-called "water rooms," laundering operations that consolidate and redistribute illicit funds, before being converted into crypto assets, gold, or other forms of value that are far harder for police to trace or freeze.

Fraud operations in Taiwan have grown increasingly specialized, the official said, splitting into two distinct functions: so-called "call centers," which handle the direct deception of victims, and "water rooms," which manage the incoming funds, divide profits and process proceeds of crime. This division of labor makes it far harder for law enforcement to dismantle an entire operation in one sweep. Busting a call center does not necessarily expose the laundering network behind it, and different call centers may share the same water room or vice versa, with the roles constantly reshuffling.

The result, the official explained, is that fraud proceeds are best understood not as a single-account problem but as a network problem. A victim's transfer typically moves first into a straw account, then is withdrawn or forwarded by a courier, before landing with a water room for consolidation. Each additional layer makes the money harder to trace back to its origin, and each new node in the chain adds another obstacle investigators must clear.

Despite its reputation as the currency of choice for criminal networks, bitcoin is not necessarily the preferred tool among Taiwan's fraud syndicates, the investigator said. Its price volatility and the relative difficulty of acquiring it make it a poor fit for launderers, who prioritize speed, price stability, and ease of use for lower level operatives handling the cash.

Tether's USDT has instead become the more common instrument in domestic fraud laundering, the official noted, largely because of its dollar pegged design and broad circulation across Southeast Asia. That regional liquidity makes it simple for water room operators to train inexperienced couriers to move funds quickly without worrying about sudden swings in value.

The official contrasted this with a separate use case circulating online: screenshots reportedly showing dark web vendors demanding payment in Litecoin. That preference reflects a different set of priorities, namely anonymity and lower transaction costs for illicit marketplace sales, rather than the laundering logic driving domestic fraud networks toward USDT. The two are not contradictory, the official said, but simply reflect different criminal use cases for different digital assets.

Crypto assets are not the only channel used to move stolen funds, according to the investigator. Fraud networks look for payment tools that share a few key traits: anonymity, ease of transfer, and public trust in the asset's value. Cash filled that role for years, and virtual assets, particularly USDT, later became dominant. But officials say gold has increasingly entered the mix as a laundering and payment vehicle, partly because it is a familiar store of value for ordinary victims and, unlike a bank account, cannot be frozen instantly by authorities.

Gold has not replaced stablecoins as the primary tool, the official stressed, but its rising use illustrates how fraud networks continuously adapt their methods in response to enforcement pressure. As one channel draws more scrutiny from police, criminal groups shift to whatever asset offers the least friction and the lowest risk of being intercepted in real time, a pattern the investigator described as continuous "iteration" in how scam proceeds are moved and concealed.

A common misconception, the official said, is that because blockchain transactions are recorded publicly, tracing stolen crypto funds should be straightforward. In practice, that is only true up to a point. When funds land in a centralized exchange that enforces know your customer verification and cooperates with law enforcement, investigators can often identify the account holder behind a transaction.

The complication arises when funds instead move into decentralized wallets, which can be created instantly through an app with no registration or identity verification attached. Investigators may be able to see exactly which wallet address received a given transfer, but have no way of linking that address to a real person. The paradox, as the official put it, is that the money trail can be perfectly visible on chain while the identity behind it remains completely opaque. Funds are traceable, but the people controlling them are not. Once assets move further, through additional wallet transfers or cross chain swaps, the difficulty compounds even further, and any eventual return to a centralized exchange depends on that exchange's willingness to cooperate and on cross border legal arrangements being in place.

Beyond identifying who controls a wallet, prosecutors face a separate hurdle: proving continuity of funds. Investigators say fraud networks frequently use coin "mixing" services, which blend funds from multiple sources to obscure their origin, along with cross chain and multi hop transfers that move assets between different blockchains or convert them into other asset types.

For a criminal case to hold up, authorities must do more than show that money moved. They must establish that the specific funds eventually recovered are the same funds a victim was originally defrauded of. That link is relatively straightforward when money changes hands only once or twice, allowing investigators to trace timing, amounts and flow. But when funds are moved rapidly through several hops, mixed with other sources and shifted across chains within a short period, establishing that continuity becomes significantly more difficult, a gap that matters as much in court as it does in the initial investigation.

Once fraud proceeds cross national borders, the case stops being a purely domestic financial crime and becomes a matter of international judicial cooperation, exchange compliance, and inconsistent regulatory standards from country to country. Some overseas exchanges recognize fraud as a cross border problem and cooperate by sharing account data, the investigator said, while others decline to do so, citing local privacy laws, regulatory constraints, or business considerations. This creates a frustrating gap where investigators can see that funds entered a specific exchange but cannot obtain the account information behind it.

Compounding the challenge, the different components of a single fraud operation, the call center, the water room, the victims, and the laundering nodes, are often scattered across several countries. A scam call might originate overseas, a victim might wire money from Taiwan, a water room in a third country might process the funds, and the assets might ultimately land in an exchange or wallet under yet another jurisdiction. Each border crossed adds another layer of legal procedure, language barriers, regulatory friction, and cooperation costs, underscoring, officials say, that anti fraud enforcement cannot succeed as a single country effort. Without cross border intelligence sharing, mutual legal assistance, and cooperation from exchanges and stablecoin issuers, funds with a clear on chain history can still stall indefinitely over questions of identity and jurisdiction.

Investigators describe the fraud money trail as less a disappearance than a rapid handoff. A sum that begins as a routine bank transfer from a victim's account can, within hours, pass through a straw account, a courier withdrawal, conversion into USDT or gold by a water room, and then a decentralized wallet involving mixing and cross chain transfers, potentially ending up at an overseas exchange. Each conversion raises the cost of tracing the money, and each additional layer of division of labor widens the distance between the fraud network and its victim.

Officials caution that once funds enter this laundering chain, the odds of full recovery drop sharply, meaning the most effective defense against fraud has to happen before a transfer is made: before sharing account credentials, before providing a one time verification code, and before clicking into a fraudulent platform. By the time money moves, the deceptive message has typically already worked its way through social media, text messages, phone calls and chat apps well before the transfer itself occurs. （Related： AI Fraud Decoded 7 | Inside Taiwan's 165 Anti-Fraud Hotline, Where Human Judgment Still Outpaces AI ｜ Latest ）

​Original Article in Chinese​