The COVID-19 pandemic has generated various government responses, ranging from social assistance and tax relief initiatives to enforced confinement measures and travel restrictions. While unintended, these measures may provide new opportunities for criminals and terrorists to generate and launder illicit proceeds. While the precise situation and public health responses in each country vary according to the impact of COVID-19, the evolving risk picture detailed in this section is based on the following general assumptions:
- Governments, businesses and individuals are increasingly turning to online systems to enable remote work. Individuals under “lockdown” (or other movement restriction measures) are also increasingly turning to online platforms for social interaction.
- Businesses that are classified as non-essential have physically closed. Both essential and non-essential business are seeing increased online sales.
- The COVID-19 pandemic has driven significant demand for medical supplies, such as personal protective equipment, ventilators and medicines and there is a global shortage of such goods due to the overwhelming demand.
- Banks and financial institutions remain in operation with some offering more limited services and restricting in-person banking.
- The closure of many businesses due to “lockdown” measures and other restrictions on trade and travel has led to mass unemployment or the furloughing of workers, loss of government revenue and a general economic recession that will impact the financial and social behaviour of businesses and individuals.
- Government resources have been reprioritised towards responding to COVID-19, taking resources away from other areas of work.
- With global trade volumes in decline and individual travel at a near standstill, conventional transnational organised crime schemes that take advantage of global supply chains and the traditional illicit revenue schemes of organised crime groups are impacted by COVID-19.
Reporting from FATF members, observers, and open sources indicate that criminals have attempted to profit from the COVID-19 pandemic through increased fraudulent activities. At the time of writing, the primary fraudulent activities include:
- Impersonation of officials: In such cases, criminals contact individuals (in person, email or telephone) and impersonate government officials with the intent of obtaining personal banking information or physical cash. In some cases, criminals impersonate hospital officials who claim a relative is sick and require payment for treatment, or government officials requesting personal banking information for tax relief purposes. Cases involving government impersonation are likely to increase as governments around the world disburse grants and tax relief payments to their citizens, with criminals attempting to profit from these payments.
- Counterfeiting, including of essential goods (such as medical supplies and medicines): Given the high demand, there is a significant increase in online scams involving certain medical supplies, personal protective equipment and pharmaceutical products. In such cases, the suspects claim to be employees of businesses, charities, and international organisations offering masks, testing kits and other products, and request credit card information for payment or a shipping fee but never deliver the goods. In some scenarios, victims were asked to make payment in advance via bank transfers and then directed to collect goods from various locations, but were then subsequently informed that there were no such arrangements. In similar scams, the goods are delivered to the consumer but are counterfeit or ineffective.1 Such scams target both individual consumers and businesses. FATF members are also seeing an increase in false and misleading COVID-19 treatment claims and vendors selling illegal products marketed as “miracle” cures.
- Fundraising for fake charities: FATF members highlight an increase in fundraising scams. In such cases, criminals posing as international organisations or charities circulate emails requesting donations for COVID-19-related fundraising campaigns (purportedly for research, victims and/or products). Recipients of these emails are then directed to provide credit card information or make payments through the suspect’s secure digital wallet.
- Fraudulent investment scams: The economic crisis resulting from COVID-19 has led to an increase in investment scams, such as promotions falsely claiming that products or services of publicly traded companies can prevent, detect or cure COVID-19. Reporting by FATF members highlighted that microcap stocks, typically issued by the smallest companies, may be particularly vulnerable to fraudulent investment schemes as they are low-priced stocks with often limited publicly-available information. This facilitates the spread of false information about the company.
There has been a sharp rise in social engineering attacks, specifically phishing email and mobile messages through spam campaigns. These attacks use links to fraudulent websites or malicious attachments to obtain personal payment information.
- Email and SMS phishing attacks: Criminals are exploiting concerns about COVID-19 to insert malware on personal computers or mobile devices. In one example, cybercriminals posed as the World Health Organization (WHO) and sent email and mobile messages to lure individuals into clicking malicious links or opening attachments, which subsequently reveal the individual’s user name and password. Various versions of these phishing attacks are currently being reported. Other examples include government impersonation via SMS to lure individuals to fraudulent government websites to obtain personal account information and/or sensitive usernames and passwords.
- Business email compromise scams: Amid a sharp rise in global remote working, cybercriminals are also exploiting weaknesses in businesses’ network security to gain access to customer contact and transaction information. This information is then used in targeted phishing emails whereby the criminals pose as the compromised business and request payment for legitimate goods and/or services but instead direct this payment into their illicit accounts. In another example, a company received spoofed emails similar to those sent by their business partner to redirect payment transfers to scammers’-controlled bank accounts, under the pretext of paying for large supplies of surgical masks and hand sanitiser.
- Ransomware attacks: Reports also indicate that cybercriminals are using different methods to insert ransomware on personal computers and mobile devices. For example, some FATF members report that cybercriminals are using malicious websites and mobile applications that appear to share COVID-19– related information to gain and lock access to victims’ devices until payment is received. Organisations at the forefront of the COVID-19 response can be heightened targets for cybercriminals. Specifically, hospitals and other medical institutions have increasingly become targets of cybercriminals for ransomware attacks.
Impact on Other Predicate Crimes
- Human Trafficking and Exploitation of Workers: Criminals may take advantage of the pandemic to exploit vulnerable groups. This may lead to an increase in the exploitation of workers and human trafficking. The suspension or reduced activity of government agencies regularly engaged in detecting human trafficking cases and identifying victims of trafficking (including workplace inspectors and social and health care workers) means that cases may go undetected. The shutdown of workplaces, slowdown in the economy, rising unemployment, and financial insecurity are factors that could result in an increase in human exploitation. One FATF member has advised reporting entities to be increasingly alert to the exploitation of workers and trafficking in vulnerable persons.
- Online Child Exploitation: There are reports from some members of a rise in the production and distribution of online child exploitation material, often for profit. With the closure of schools, children are increasingly using the internet during “lockdown” periods, which could lead to an increase in online child exploitation. There are also reports that “lockdowns” and travel bans are increasing demand for this material.
- Organised Property Crime: With many properties currently uninhabited due to COVID-19, there are reports of an increase in organised property crime/theft.
Financing of Terrorism
The United Nations has warned that threats related to terrorism remain and that terrorist groups may see opportunities for increased terrorist and terrorist financing activity while government attention is focused on COVID-19. This is a particular concern in the Sahel region. One FSRB Secretariat and one FSRB member raised concerns about terrorist groups using the COVID-19 crisis to raise and move funds and increase existing illicit activity to finance their operations. As international humanitarian and aid responses to COVID-19 increase, governments should emphasise the importance of implementing the risk-based approach when mitigating the risk of funds being diverted to support terrorists and terrorist groups.
Summary of Potential Money Laundering / Terrorism Financing Risks
Given the relatively early stages of the health and economic crisis, the majority of risks currently reported relate to proceeds generating predicate offences. ML/TF-specific trends or typologies emerging from COVID-19 are still in the early stages of identification. Nevertheless, some national authorities have indicated that their FIUs have begun issuing COVID-19-related typologies and indicators to their private sector. At the time of writing, ML typologies relate to misuse of virtual assets to launder illicit proceeds and misuse of the formal banking system. No specific TF typologies related to COVID-19 have been reported by FATF or FSRB members. In summary, and as outlined in the key findings, the potential ML/TF risks emerging from the aforementioned threats and vulnerabilities could be:
- Criminals finding ways to bypass CDD measures by exploiting temporary challenges in internal controls caused by remote working situations, in order to conceal and launder funds;
- Increased misuse of online financial services and virtual assets to move and conceal illicit funds;
- Exploiting economic stimulus measures and insolvency schemes as a means for natural and legal persons to conceal and launder illicit proceeds;
- As individuals move money out of the banking system due to financial instability, this may lead to increased use of the unregulated financial sector, creating additional opportunities for criminals to launder illicit funds;
- Misuse and misappropriation of domestic and international financial aid and emergency funding by avoiding standard procurement procedures, resulting in increased corruption and consequent ML risks;
- Criminals and terrorists exploiting COVID-19 and the associated economic downturn to move into new cash-intensive and high-liquidity lines of business in developing countries, both for the laundering of proceeds as well as to fund their operations, as well as fraudulently claiming to be charities to raise funds online.