Money laundering and terrorism financing in virtual environments: a feasibility study

Transcription

1 Money laundering and terrorism financing in virtual environments: a feasibility study This is the peer reviewed author accepted manuscript (post print) version of a published work that appeared in final form in: Irwin, Angela SM, Slay, Jill, Choo, Kim-Kwang Raymond & Lui, Lin 2014 'Money laundering and terrorism financing in virtual environments: a feasibility study' Journal of money laundering control, vol. 17, no. 1, pp This un-copyedited output may not exactly replicate the final published authoritative version for which the publisher owns copyright. It is not the copy of record. This output may be used for noncommercial purposes. The final definitive published version (version of record) is available at: Persistent link to the Research Outputs Repository record: General Rights: Copyright and moral rights for the publications made accessible in the Research Outputs Repository are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognize and abide by the legal requirements associated with these rights. Users may download and print one copy for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the persistent link identifying the publication in the Research Outputs Repository If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.

2 The Library Educating Professionals, Creating and Applying Knowledge, Engaging our Communities This article is 2014 Emerald Group Publishing and permission has been granted for this author accepted manuscript (post-print) to be posted to an institutional repository. The link to the ROR record is available here: Emerald does not grant permission for this article to be further copied/distributed or hosted elsewhere without the express permission from Emerald Group Publishing Limited. The final published version (version of record) is available from the following link:

3 Abstract Money laundering and terrorism financing in virtual environments: A feasibility study 1 Angela S M Irwin, telephone: , irwas001@mymail.unisa.edu.au Jill Slay, Kim Kwang Raymond Choo Forensic Computing Lab, Advanced Computing Research Centre Lin Liu, School of Information Technology & Mathematical Sciences University of South Australia Mawson Lakes, SA, Australia, 5095 Purpose: There is a clear consensus of opinion that virtual environments and virtual currencies pose a money laundering and terrorism financing threat. What is less clear, however, is the level of risk that they pose. This paper aims to clarify the suitability of virtual environments for conducting money laundering and terrorism financing activities. Design/method/approach: A number of experiments were conducted to estimate the quantity of funds that could be moved through these environments. These experiments took into account a number of factors such as the number of accounts that would need to be opened to launder/raise a specific amount of funds, the amount of funds that could be placed within a certain timeframe and the transaction limits imposed by each of the massively multiplayer online games (MMOGs) and online financial service providers (OFSPs) involved in the money laundering and terrorism financing scenarios. Each scenario was allocated a feasibility score. The feasibility score rated the likelihood of the in-world scenario being successful or unsuccessful and provided the reasons for this. Feasibility was based on the following criteria: ease of use, time taken to launder/raise funds; amount of funds laundered/raised; cost to launder/raise funds; risks mitigated and chances of detection. A number of experiments were conducted to determine the feasibility of money laundering and terrorism financing in virtual environments. Due to space constraints, this paper looks at one scenario in detail. Details of the other experiments/virtual money laundering scenarios can be made available on request to those in the law enforcement field. Findings: The findings of this research show that money laundering and terrorism financing can take place inside virtual environments. Virtual money laundering and terrorism financing offer high levels of anonymity, potentially low levels of detection and removes many of the risks associated with realworld money laundering and terrorism financing activity. However, this comes at the cost of ease, time and, in some cases, the amount of funds laundered. Large sums (millions of dollars) can be laundered in virtual environments, but this exponentially increases the level of effort involved in setting up accounts and placing, layering and integrating funds. All of the virtual money laundering scenarios investigated can be easily transferred to terrorism financing. In fact, many of the negative aspects of virtual money laundering are removed when applied to virtual terrorism financing. The most significant risk comes from terrorism financing rather than money laundering as a small amount of funds in the wrong hands can have a devastating impact. For example, the funds necessary to conduct the attack against the Twin Towers in New York was small, and these amounts could be transferred through virtual environments undetected and with very little chance of identifying the real-world identity of those who performed the transactions or those who receive the funds. 1 Corresponding author

4 Originality/value: A number of authors have described potential virtual money laundering scenarios but some of these are out-of-date due to closed loopholes, all are rudimentary and make no attempt to discuss the practicality or feasibility of using these scenarios. Current examples of virtual money laundering do not discuss how the scenarios compare to traditional methods employed by perpetrators. Another weakness of current virtual-world money laundering examples is the absence of red flag indicators or detailed behaviours that may alert service providers, anti-money laundering and counter terrorism financing (AML/CTF) investigators and/or law enforcement agencies to the presence of virtual money laundering or terrorism financing behaviour. This research addresses those issues by providing a detailed analysis of how the virtual scenario might be carried out, including strengths and weaknesses, cost of conducting the scenario, feasibility of using the scenario and red flag indicators/suspicious behaviours that may be present when conducting the scenario. This information is vital for informed governmental policy-making. Keywords: Anti-money laundering/counter terrorism financing (AML/CTF), virtual environments, feasibility study, massively multiplayer online games, online fraud Classification: Research paper 1. Introduction As Internet technologies become more advanced, so have the ways in which money launderers, terrorism financers and criminals utilise them for illicit and illegal activity. The introduction of new payment methods, virtual environments and the ease of maintaining anonymity on the Internet have helped to transform the criminal underworld, offering new ways to move large sums of money with relative ease (Pearce, 2012; Jacobson, 2010, FATF, 2010). The Internet has become a fertile ground for terrorists to obtain funds to support their operations by participating in activities ranging from credit card theft using phishing, hacking and keylogging attacks through to money laundering (Strayer, 2011 and Jacobson, 2010). In recent years, there has been much debate about the risks posed by virtual environments. Concern is growing about the ease in which massively multiplayer online games (MMOGs) 2 may be used for economic crimes such as money laundering, fraud and terrorism financing (Methenitis, 2009; Sanders, 2009; Sullivan, 2008; Vallance, 2008; Tefft, 2007; World-check, 2007 and Castranova, 2005). Many believe that potential and opportunity exist for allowing large sums of money to be moved across national borders without restriction and with little risk of detection (Pearce, 2012; Keene, 2011; Tsuruoka, 2011; BBC, 2008; Heeks, 2008; Leapman, 2007; Lee 2005). The ease in which money launderers and/or terrorists have turned to virtual environments and digital currencies, when traditional avenues of funding are restricted or lost, has become problematic for governments (e.g. counter-terrorism agencies) and security professionals alike (AUSTRAC, 2012; Vallance, 2008). With Second Life in particular, its fast-growing economy has left many legal experts claiming that the lack of even basic regulation of its banks and stock exchange could provide a haven for money launders, fraudsters and terrorists to hide and move funds around to avoid the surveillance they would be subject to in the real world (Chambers-Jones, 2012 A ; Pearce, 2012; Leapman, 2007). There is a clear consensus of opinion that virtual environments are potential targets for cybercriminals, money launderers and terrorism financers. However, there is much debate about the level of risk that these environments pose. Some believe that money laundering in virtual 2 A MMOG is a multiplayer video game which is capable of supporting hundreds or thousands of players simultaneously. They are played on the Internet. Many games have at least one persistent world, however others just have large numbers of players competing at once in one form or another without any lasting effect to the world at all. Examples of MMOGs are Second Life, World of Warcraft and Entropia Universe.

5 environments is a real threat that requires regulation similar to that seen in the real-world (Chambers-Jones, 2012 A ; Pearce, 2012; Leapman, 2007). However, others believe that virtual environments and virtual currencies do not provide the scale necessary for large-scale money laundering activity (Nino, 2011, AUSTRAC, 2012). For example, Detective Superintendent Colin Dyson, commander of the New South Wales Police Fraud and Cybercrime Squad, in a media interview indicated that virtual worlds hold more appeal to criminals as a platform for communication and co-ordination than for laundering the proceeds of crime (Pearce, 2012). This may be due to the additional administrative overheads and potential limitations on volume that exist in virtual environments. AUSTRAC s 2012 typology report identified virtual worlds and digital currencies such as Bitcoin as potential vulnerabilities, stating while the nature and extent for money laundering through digital currencies and virtual worlds are unknown, it is important to recognise their potential for criminal exploitation, particularly in response to tighter regulation of established or traditional financial channels (AUSTRAC, 2012, p 16). AUSTRAC (2012) also states that because digital currencies are currently not widely accepted as payment for goods and services, it limits the avenues through which digital currency can be used to convert, move and launder illicit funds. The limited size of digital currency markets, in turn, reduces the extent to which large amounts of illicit value can be moved. It believes that the overall utility of digital currencies for criminals, at this point, may currently be limited to niche crimes in the cyber environment and individual or smaller scale illicit activity. Sullivan (2008) blames the negligible means of monitoring financial activity, sparse due diligence, poor customer identification rules, and the absence of mandated forms or reports to complete when suspicious activity is detected, for making virtual worlds fertile grounds and ripe with opportunity for criminal elements. He claims that because the virtual realm is completely unregulated, it is a voluminous means of money movement and could potentially provide a safe harbour for money launderers, fraudsters and/or terrorists. He believes that virtual worlds could be considered as the virtual counterpart to the Hawala system 3. Some believe that the anonymity provided by virtual environments also contributes to their desirability for illicit activity. Tefft (2007) and Brown (2010) blame the absence of know your customer (KYC) regulations, which removes the onus from MMOGs to correctly identify account holders before allowing them to move real and virtual funds through their accounts, as a contributor to illicit activity. The ease in which it is possible to open accounts and perform financial transactions using stolen credit card numbers and prepaid Visa or MasterCard gift cards were cited by Brown (2010) and Choo (2008 A ). A number of authors have described potential virtual money laundering scenarios (Tefft, 2007; World-check, 2007; Sullivan, 2008; Sanders, 2009 and AUSTRAC, 2012). Tefft (2007) looked at the susceptibility of unregulated virtual banks and their ability to become money laundering centres. He provides an example of how money launderers, using financial professionals in their employ as front men, purchase a virtual bank license. Although the scenario described by Tefft (2007) could provide the opportunity to launder vast sums of money, many of the loopholes which would make this scenario possible have been closed or tightened. For example, in 2008 Second Life introduced Terms of Service that prohibit the offering of banking services, in-world investment funds and stock offerings to any entity without proof of an applicable government registration statement or financial institution charter, thereby making this money laundering scenario much more difficult, if not 3 An underground banking system based on trust whereby money can be made available internationally without actually moving it or leaving a record of the transaction (definition from

6 impossible, to carry out. In addition, in 2009 Entropia Universe received a real-world banking license making them subject to real-world regulations, allowing regulators to gain valuable insight into possible money laundering activities which may take place inside this environment. World-check (2007), Sullivan (2008), Sanders (2009) and AUSTRAC (2012) provide simple scenarios that may facilitate virtual-world money laundering. Although the scenarios described by each are a good starting point to showing how money laundering might occur in virtual environments, they contain a number of weaknesses. For example, the scenarios do not discuss the practicality or feasibility of using virtual environments to carry out the money laundering or terrorism financing activity. Since the people using these scenarios are likely to have real-world money laundering or terrorism financing schemes in place, the examples do not discuss how the scenarios might compare to traditional methods in respect to ease of use, the amount of funds that can be laundered/raised, how long it would take to launder/raise the same amount of funds possible in traditional, real-world environments, the cost to launder/raise the same amount of funds possible in traditional, real-world environments, the risks that are present in the virtual-world scenarios and the chances of detection compared to that experienced in real-world environments. The money launderer or terrorism financer would take these factors into account before deciding to convert or supplement his or her money laundering or terrorism financing activity with unfamiliar and potentially complicated techniques. Another weakness of the virtual-world examples described by Tefft (2007), World-check (2007), Sullivan (2008), Sanders (2009) and AUSTRAC (2012) is the absence of red flag indicators or detailed behaviours that may alert service providers, AML/CTF investigators and/or law enforcement agencies to the presence of virtual money laundering or terrorism financing behaviour. In traditional money laundering and terrorism financing investigations, a series of red flag indicators can normally be detected. This will also be true for virtual money laundering or terrorism financing. Red flag indicators are an important tool to help service providers, AML/CTF investigators or law enforcement agencies decide whether a particular activity, financial transaction or series of transactions by an account holder or entity are atypical in nature or vary from normal activity and require further, in-depth investigation. It must be noted that the presence of a red flag indicator does not imply illicit or illegal activity or guilt. However, in most cases the existence of multiple indicators raises suspicion of potential criminal activity. This paper represents the findings of the fourth phase of a research project. The overall aim of the project, which is being undertaken in Australia, is to establish whether it is possible and/or feasible to launder money and raise funds for terrorism inside virtual environments (Irwin et al, 2013). The first phase of research involved the collection and statistical analysis of three hundred money laundering and terrorism financing typologies (Irwin et al, 2012a). The statistical analysis phase attempted to measure the size of the money laundering and terrorism financing problem, identify threats and trends, the techniques employed and the amount of funds involved to determine whether the information obtained about money laundering and terrorism financing in real-world environments could be transferred to virtual environments. The second phase of research investigated how modelling could be used to provide an easy-to-follow, visual representation of the important characteristics and aspects of money laundering and terrorism financing behaviours (Irwin et al, 2012b). The third phase of research examined the account setup and account verification procedures carried out by a number of popular MMOGs and OFSPs. It also investigated whether the payment method used by an account holder to place funds into his or her account hinders or helps investigators to expose the identity of that account holder in a real-world context (Irwin et al, 2013). The rest of the paper is structured as follows: section 2 discusses the methodology/experiment design. Section 3 provides a detailed breakdown of the virtual money laundering scenario. Section

7 3.1.1 shows the costs of conducting the virtual scenario. Section discusses the feasibility of conducting the virtual scenario over the traditional method. It discusses the feasibility score allocated to each of the scenario attributes and discusses how we arrived at that score. Section presents the suspicious activity/red flag indicators associated with each of the services providers discussed in the virtual scenario. Section 3.2 looks at whether the virtual money laundering scenario can be applied to terrorism financing. Finally, section 4 concludes the paper. 2. Methodology The aim of the experimentation phase of research was to attempt to replicate the money laundering and terrorism financing behaviours discovered during the typological 4 analysis (Irwin et al, 2012a), typology modelling (Irwin et al, 2012b) and in-world observation (Irwin et al, 2013) phases of research. All of the typologies were reviewed to determine which ones would be suitable for replication in one or more of the MMOGs selected for experimentation (see Irwin et al, 2013 for more details of MMOGs selected for review). Four real-world money laundering and two real-world terrorism financing typologies were selected for in-world replication. The scenarios selected were based on trends discovered during the statistical analysis phase of research. The four money laundering scenarios selected for experimentation were also examined to determine their suitability for terrorism financing. The real identities of the MMOGs and OFSPs have been concealed to ensure that the contents of this paper are not misused. However, we can provide the dataset to law enforcement agencies/entities upon request. Most of the in-world experiments were conducted inside MMOG 1 (see Irwin et al, 2013) as it provided the best opportunity for conducting the widest range of experiments. MMOG 1 has a mature in-world economy, businesses can be created and land can be purchased inside this environment - the creation/use of shell or front companies 5 and the purchase of land are common layering 6 and integration 7 techniques. It was also believed that the environment provided by MMOG 1 was most suited to smurfing 8 and structuring 9 activity, which prove effective for obfuscating the money trail. Although most of the in-world experiments were conducted inside MMOG 1, MMOG 2 was used in one of the scenarios as it readily accepted the use of prepaid Visa/MasterCard gift cards and could be used to layer transactions and, therefore, confuse the money trail. Determining whether it is possible to conduct money laundering and terrorism financing activity in virtual environments is only one side of the coin. The other side is determining the feasibility of using the virtual scenario over traditional money laundering or terrorism financing methods. To determine this, a number of elements were examined: ease of use; time taken to launder money/raise funds for terrorism financing; amount of funds laundered/raised for terrorism financing; cost to launder funds/raise funds for terrorism financing; risks mitigated and chances of 4 Typology is a term used by the FATF to describe money laundering and terrorist finance methods and techniques. 5 A front company is a business that commingles illicit funds with revenue generated from the sale of legitimate products or services. Criminals use front companies to launder illicit money by giving the funds the appearance of legitimate origin. 6 Layering is the second phase of the classic three-step money laundering process between placement and integration. Layering involves distancing illegal proceeds from their source by creating complex levels of financial transactions designed to disguise the audit trail and to provide anonymity. 7 Integration is the third and final stage of money laundering in which funds introduced into the financial system are invested or applied. 8 Smurfing involves the use of multiple individuals and/or multiple transactions for making cash deposits, buying monetary instruments or bank drafts in amounts under the reporting threshold. 9 Structuring is the Illegal act of splitting cash deposits or withdrawals into smaller amounts, or purchasing monetary instruments, to stay under a currency reporting threshold.

8 detection. A number of rating scales were used to assign each element a value. These are shown in Tables 1 to 6 below. The rating scales should be read as follows: the most negative outcome receives the lowest score and the most favourable outcome receives the highest score. Ease of use Low High Very difficult to use. Involves many complex steps. Requires extensive knowledge of VEs and IT. Somewhat difficult to use. Requires some complex steps and good knowledge of VEs and IT. Moderately difficult to use. Requires some complex steps and some prior knowledge of VEs and IT. Easy to use. Requires no complex steps and no prior knowledge of VEs but some prior knowledge of IT. Very easy to use. Requires no complex steps and no changes to the way the suspect would conduct offline ML/TF. Table 1 Ease of use of virtual scenario Time taken to launder/raise funds 10 Long Short The funds take more than 2 weeks to move through the financial system and VE. Funds take between 1 and 2 weeks to move through the financial system and VE. Funds take less than a week to move through the financial system and VE. Funds take a few days to move through the financial system and VE. Funds move through the financial system and VE within 24 hours. Table 2 Time taken to launder/raise funds using virtual scenario Amount of funds laundered/raised compared to traditional methods (overall) Low High Significantly less than can be achieved using traditional realworld methods. Slightly less than can be achieved using traditional real-world methods. Similar to what can be achieved using traditional realworld methods. Slightly more than can be achieved using real-world methods. Significantly more than can be achieved using real-world methods. Table 3 Amount of funds laundered/raised using virtual scenario Cost to launder funds/raise funds for terrorism financing High Low Cost to the ML/TF is more than 25% of capital. Cost to the ML/TF is 16-24% of capital. Cost to the ML/TF is 11% to 15% of capital. Cost to the ML/TF is 6% to 10% of capital. Cost to the ML/TF is less than 5% of capital. Table 4 Cost to launder/raise funds using virtual scenario (% of capital) 10 This refers to the time taken to process and transfer the first tranche of money and includes the purchase of financial instruments, setup of accounts, placement of funds inside accounts, transfer of funds out of accounts and transfer of funds to overseas accounts.

9 Risks mitigated/addressed Low High All of the risks associated with ML/TF are still present. Many of the risks associated with ML/TF are still present. Some of the risks associated with ML/TF are removed. Many of the risks associated with ML/TF are removed. All of the risks associated with ML/TF are removed. Table 5 Risks mitigated when using virtual scenario Chances of detection High Low It would be very easy to detect suspicious behaviour and/or transactions and associate these with an individual in a real-world context. It would be easy to detect suspicious behaviour and/or transactions and take minimal investigation to associate these with an individual. It would be possible to detect suspicious behaviour and/or transactions but it would be moderately difficult to associate these with an individual. It would be difficult to detect suspicious behaviour and/or transactions and take extensive investigation to associate these with an individual. It would be impossible to detect suspicious behaviour and/or transactions and associate these with an individual in a real-world context. Table 6 Chances of detection when using virtual scenario Each element was assigned a value in order to determine the overall feasibility of each of the virtual scenarios under investigation. The overall feasibility is used to determine whether or not a particular virtual scenario is likely to achieve a desirable outcome. If a scenario receives a high score (i.e. 1) for each of the elements examined, that scenario should be considered feasible with a high probability of a desirable outcome, i.e. the scenario would be very easy to use, it would take a short period of time to launder/raise funds, a large amount of funds could be laundered/raised, the cost of laundering/raising the funds would be low, all of the risks normally associated with money laundering/terrorism financing would be mitigated and the chances of detection would be low. Conversely, if a scenario receives a low score (i.e. 0.2) for each of the elements examined, that scenario should be considered unfeasible with a high probability of an undesirable outcome, i.e. the scenario would be very difficult to use, it would take a long period of time to launder/raise funds, a small amount of funds could be laundered/raised, the cost of laundering/raising the funds would be high, all of the risks normally associated with money laundering/terrorism financing would still be present and the chances of detection would be high. A normal rating table might work by multiplying the score for each element to produce an overall rating. However, this approach was unsuitable for this project as some of the elements had heavier weighting then others and this approach may skew the overall result. A score of 0.6 or greater for each element may be considered acceptable, making an overall score of or above feasible. However, what happens when some of the values are above 0.6 and some are below 0.6 (see examples 1 and 2 in Table 7).

10 Ease Time Amount laundered Cost Risks mitigated Chances of Detection Score Feasibility Example Feasible Example Feasible Table 7 Example feasibility rating scores Both of the examples shown in Table 7 would return feasible results. However, in reality example 2 would be considered unfeasible due to many of the risks associated with real-world money laundering/terrorism financing still being present and the chances of detection being high. In this case it is likely that the money launder or terrorism financer would continue to use their current method of laundering rather than go to the effort of learning a new technique which offers no real added benefit. Although example 1 provides the same overall score, it would be considered worthwhile as the cost to launder the funds is relatively low, many of the risks are removed and the chances of detection are low. With this in mind, it is believed that more weighting should be given to elements risks mitigated and chances of detection. If these scores are high, i.e. score 0.6 or more, a score lower than 0.4 in one of ease, time, amount laundered or cost would be considered acceptable. Scenarios where cost, risks mitigated and chances of detection receive low scores (below 0.6), even if ease, time, amount laundered or cost receive scores 0.6 or more; the scenario will be classified as unfeasible (see Table 8). Ease Time Amount laundered Cost Risks mitigated Chances of Detection Score Feasibility Example Feasible Example Feasible Table 8 Amended example feasibility rating scores There is one caveat to this rule. This is when the effort and initial costs in setting up and maintaining a scenario far exceed the amount of funds to be laundered (i.e. the amount to be laundered element receives a score of 1 and the cost element receives a 0.2). In this case, another virtual money scenario may be more suitable. Once a feasibility score was assigned to each virtual scenario, suspicious activity/red flag indicators that may be associated with each scenario were determined. Red flag indicators may alert the MMOG, OFSP or law enforcement agencies to suspicious and anomalous behaviour and possible money laundering or terrorism financing activity and are, therefore, an important detection tool. During the experimentation phase of research, the project suffered from a lack of funds to conduct experiments. Many money laundering schemes involve large sums of cash (in the hundreds of thousands of dollars or more). However, our experiments could only be carried out using a relatively small amount of funds. These funds were used to test whether a behaviour, transaction or scenario was possible and then knowledge learned through review, analysis and experimentation was applied to determine whether a specific scenario might be successful using larger sums. It should be noted that since scenarios could not be tested using large sums of money, we have been unable to determine with any degree of certainty whether any of the scenarios tested would trigger anomaly detection software, and therefore, the funds lost or frozen. Although this situation is not ideal, it provides us with an understanding of the steps and behaviours involved in each in-world money laundering or terrorism scenario and allows us to highlight the red flag indicators that may be

11 associated with each scenario to assist MMOGs, online financial service providers (OFSPs) and law enforcement agencies detect that money laundering or terrorism financing activity may be present. A number of assumptions were made when carrying out this research. For instance, it was assumed that suspects had access to the tools of the trade normally utilised by criminals and/or criminal organisations. For example, access to fake identity documents, access to unregistered/anonymous mobile telephones and, in some cases, such as drug trafficking, access to a wide network of accomplices or associates who may assist in the placement, layering and integration of funds. 3. In-depth analysis and discussion of virtual money laundering scenario This section provides a detailed breakdown of the virtual money laundering scenario. The real-world money laundering scenario demonstrates how a business, directed by the Suspect, claimed to be returning low profits even though large sums of cash were being deposited into his personal bank account and then transferred to a bank account overseas (see Figure 1). It is believed that the funds entered into the Suspect s personal bank accounts were from the company s activities and there was a deliberate attempt to avoid paying tax by making it appear that the company was unprofitable. Figure 2 demonstrates how the Suspect in this case could use virtual environments to launder his funds. The Suspect could use the cash obtained from his company to purchase over-the-counter prepaid Visa/MasterCard gift cards. The gift cards could then be used to purchase virtual credits from MMOG 3. Once the virtual credits have been purchased and placed into the MMOG 3 account(s), the credits could be sold to OFSP 6 and the real-world currency transferred onwards to a number of PayPal accounts. By purchasing prepaid Visa/MasterCard gift cards, the virtual-world scenario offers the advantage that funds and cash do not need to be transacted through a bank account, allowing greater levels of anonymity to be achieved 11. However, the virtual-world scenario would only be successful if the Suspect could purchase sufficient prepaid Visa/MasterCard gift cards, the funds contained within them used to successfully purchase virtual currency, the virtual currency deposited into one or more MMOG 3 accounts, the virtual currency converted back to real-world currency with the assistance of a third party organisation, such as OFSP 6 12, and then transferred to a PayPal account, all without raising suspicion. The amount of funds laundered during a typical tax evasion scenario can be varied. For example, the minimum, average and maximum sums laundered during typical tax evasion operations is AUD 176,000, AUD 2M and AUD 7.8M respectively (Irwin et al, 2012a). The total number of prepaid Visa/MasterCard gift cards that the Suspect would need to purchase in order to achieve these amounts is 880 (17 cards per week), 10,000 (192 cards per week) and 39,000 (750 cards per week) respectively 13. While it may be possible for the Suspect to purchase 17 cards per week without attracting too much attention, it would be impractical, if not impossible, for him to obtain a sufficient number of cards to launder large sums of money without attracting unwanted attention. 11 It should be noted that purchasing gift cards over-the-counter may not provide total anonymity, especially if closed-circuit television (CCTV) surveillance systems are in use at the retail outlet where the cards have been obtained. 12 A third party organisation must be used as MMOG 3 do not buy-back credits 13 Each card is valued at AUD 200 which is the maximum value of prepaid Visa/MasterCard available at Australia Post.

12 Larger sums could be laundered if third parties were used to purchase prepaid Visa/MasterCard gift cards on the Suspect s behalf. Once the Suspect has the untraceable prepaid Visa/MasterCard gift cards in his possession, he must place these funds into MMOG 3. This must be done without triggering any suspicious transaction monitoring software that MMOG 3 may have in place. Taking into account the transaction limits imposed by MMOG 3, it would take 2,120 days (almost six years) to place AUD 176, into an account. This is obviously too long to be a serious money laundering option. In addition, funding a single account with AUD 176,000 worth of prepaid Visa/MasterCard gift cards within a 12-month period would, in itself, attract high levels of suspicion. Therefore, the Suspect would be required to open a number of accounts through which the funds could be moved. It is envisaged that the Suspect would be required to open a minimum of 17 accounts to reduce the chances of raising suspicion. This also spreads the risk of losing funds, should some of the accounts be frozen. Opening 17 separate accounts, and purchasing virtual credits up to the maximum monthly limit of AUD 2,500, allows up to AUD 42,500 to be placed in a 30-day period 15. It would take 125 days (between four and five 30-day periods) to place AUD 176,000. However, suspicions would likely be raised if the maximum of AUD 2,500 was deposited every month. Therefore, the Suspect would be required to purchase random amounts of virtual currency from MMOG 3 at random intervals. Variability would have a direct impact on the number of accounts that need to be opened in order to launder the desired amount of funds. Figure 3 illustrates the affect variability of amounts placed has on the numbers of accounts that need to be created for the minimum, average and maximum amount of funds laundered. As can be seen from Figure 3, no matter how much variability is introduced, a prohibitively large number of accounts would need to be opened to launder AUD 2M and AUD 7.8M. Therefore, laundering funds through MMOG 3 using prepaid Visa/MasterCard gift cards is suitable only for lowlevel money laundering schemes where a limited amount of funds are involved. The aim of the money laundering scheme is to be able to get the funds out of the virtual environment in a form that can be used in the real-world. Therefore, the Suspect needs to be able to exchange his virtual funds for real-world currency. However, MMOG 3 does not buy-back unused credits. Therefore, credits must be sold to a third party organisation such as OFSP 6. OFSP 6 purchases MMOG 3 credits for cash and deposits the funds into the seller s PayPal account(s). OFSP 6 can purchase up to 5 million MMOG 3 credits at a time, which converts to USD 1,750.00/AUD 1, Table 9 shows the length of time it would take to sell the virtual credits held inside each of the MMOG 3 accounts. To launder the funds in the time specified in Table 9, the Suspect must sell to OFSP 6 five million credits from each account once per week. 14 To place AUD 2M and AUD 7.8M it would take 24,096 days (over 60 years) and 93,976 days (over 257 years) respectively x AUD 2, Currency conversion as at 16 May 2012

13 Total amount To be laundered No of MMOG 3 accounts Amount per week laundered by all MMOG 3 accounts (cumulative) Number of weeks to launder funds AUD 176, , AUD 2M , AUD 7.8M , Table 9 Time taken to launder MMOG 3 funds through OFSP 6 To minimise the amount of suspicion that may be raised by selling MMOG 3 credits at the maximum permissible amount to OFSP 6 each week, variability would need to be introduced to reduce the chances of a pattern being detected by anti-fraud software that may be in place. However, introducing variability has a direct impact on the length of time that it would take to convert virtual funds to real-world funds. The most successful way to reduce suspicion would be to sell MMOG 3 credits to more than one third party virtual currency exchange. The funds raised from the sale of MMOG 3 credits to OFSP 6 are transferred to a PayPal account. There are no limits to the amount of funds that can be accepted into a PayPal account. However, the sending and withdrawal limit imposed on an account is AUD 4,200 and AUD 700 per month respectively. The sending limit is the maximum amount a user can send (or spend) per account. The withdrawal limit is the maximum amount that a user can transfer to a bank account or credit/debit card. PayPal removes both of these limits when a user completes the verification process. If AUD 176,000 was to be filtered through one unverified PayPal account, it would take nearly 42 months (3.5 years) to send the funds to another account or spend the funds and it would take 252 months (nearly 21 years) to transfer the funds onwards to a bank account or credit/debit card. Obviously this is too long a timeframe to make it a viable money laundering option. Although verifying a PayPal account or opening numerous personal PayPal accounts may reduce the time required to launder the money, it is highly likely that the account(s) would be limited 17 due to suspiciously high/unusual activity levels. The best option would be for the Suspect to open one or more PayPal merchant accounts as the funds filtered through these accounts could pass as legitimate business income and, therefore, attract less suspicion. The funds could also be passed through the account on a more frequent basis without attracting undue attention. On a regular basis the funds could be transferred out of the PayPal account to a local or overseas bank account of the Suspect s choice The cost of conducting the virtual scenario There are a number of costs involved in carrying out the virtual money laundering scenario: the cost to obtain prepaid Visa/MasterCard cards; the cost of selling MMOG 3 credits to OFSP 6; the cost of transferring funds from OFSP 6 to a PayPal merchant account and transferring the funds to an overseas bank account. There is no fee to transfer funds from the PayPal merchant account to an overseas bank account as long as that bank account is linked to the PayPal account. The cost of obtaining the prepaid Visa/MasterCard gift cards from Australia Post is shown in Table 10. These figures take into account the number of cards that would need to be purchased in order to launder the desired amount of funds, the fees involved in obtaining the cards and the cost of activating the cards. For example, to launder AUD 176,000, 880 cards valued at AUD 200 each would need to be purchased. The fee to activate each of the cards is AUD This translates to a cost of AUD 181,236 to obtain and activate the cards. 17 Whilst an account is limited the account holder can receive or request money, update account information, add a card, add a bank account and send refunds but the account holder cannot send money, withdraw money from the account, close the account, add money to the account, remove a card or remove a bank account.

14 Min Ave Max Amount to be laundered AUD 176,000 AUD 2M AUD 7.8M Number of prepaid Visa/MasterCard gift cards required (AUD 200 value each) ,000 39,000 Cost to activate each card (AUD 5.95) AUD 5,236 AUD 59,500 AUD 232,050 Total cost to obtain and activate prepaid Visa/MasterCard cards from Australia Post AUD 181,236 AUD 2,059,500 AUD 8,032,050 Amount of funds lost when selling credits to OFSP 6 AUD 80,960 (Loss of 46%) AUD 920,000 (Loss of 46%) AUD 3,588,000 (Loss of 46%) Fees for receiving funds from OFSP 6 to PayPal merchant account 2% 1.1% 1.1% Total cost of receiving funds into PayPal merchant account AUD 3520 fees + AUD 0.30 per transaction AUD 22,000 + AUD 0.30 per transaction Table 10 Cost of conducting the virtual tax evasion scenario AUD 85,800 + AUD 0.30 per transaction The cost of selling MMOG 3 credits to OFSP 6 was also examined. On the 23 July 2012, it cost USD 200 to buy 300,000 credits from MMOG 3. To sell those same credits to OFSP 6, the seller would receive only USD 108, resulting in a loss of USD 92 (46% of the funds). Using the above conversion rates, Table 10 shows the losses that would be incurred by the Suspect if he wished to sell AUD 176,000, AUD 2M and AUD 7.8M worth of MMOG 3 credits to OFSP 6. This loss seems excessively high, therefore, OFSP 7, another currency exchange provider, was examined to determine how much USD a user could expect to receive for 300,000 MMOG 3 credits (see Table 11). On the 23 rd July 2012, OFSP 7 would purchase 300,000 MMOG 3 credits from a seller for USD 120. They also charge the seller an additional transaction fee of 2% for transactions up to USD 2, or a flat rate fee of USD for transactions over USD 25,000. The transaction fee translates to USD 2.40 for every 300,000 credits purchased. The final amount returned to the user for every 300,000 credits is USD The exchange rate offered by OFSP 7 is better than that offered by OFSP 6 but still represents a significant loss of capital. Please note that OFSP 6 buy MMOG 3 credits at a rate of USD 40 per 100,000 credits. They do not provide a more favourable exchange rate for larger sums exchanged. The cost of transferring the proceeds of the sale of MMOG 3 credits to OFSP 6 to a PayPal merchant account is shown in Table 10. The fees charged by PayPal is dependent on the monthly sales processed through the Merchant account. A fee of 2%, 1.1% and 1.1% and a transaction fee of AUD 0.30 per transaction is applicable to AUD 176,000, AUD 2M and AUD 7.8M respectively. OFSP 6 OFSP 7 Amount received when selling USD 200 worth of MMOG 3 credits USD 108 USD 120 Transaction fee applied/cost Nil/USD 0 2%/USD 2.40 Total amount received USD 108 USD Total loss of Capital (%) 46% 41.2% Table 11 Losses incurred when selling USD worth of virtual credits to OFSP 6 or OFSP 7 Instead of buying virtual credits from MMOG 3 and reselling them to a third party registered seller or currency exchange, it may be more cost effective to buy the credits directly from the registered seller or virtual currency exchange and have them credited directly to the MMOG 3 account. For example, at the time of research (24 th July 2012) OFSP 7 had a special offer where they were selling 300,000 MMOG 3 credits for USD This is significantly less than the cost of USD 200 to buy the same amount of virtual credits directly from MMOG 3. If the virtual credits were purchased

15 from OFSP 7 and resold to OFSP 7 (or another competitively priced virtual currency exchange) the losses in exchange would be significantly less. For example, buying and selling virtual credits with OFSP 7 would result in approximately an 18% loss in conversion rate (buy MMOG 3 virtual for USD sell MMOG 3 virtual credits for USD = loss of USD 25.98). An amended virtual scenario, where virtual funds are purchased and sold using OFSP 7, is shown in Figure 4. In the new scenario the Suspect uses the cash obtained from his company to purchase over-thecounter prepaid Visa/MasterCard gift cards. The Suspect opens numerous MMOG 3 accounts. The gift cards are used to purchase virtual currency from OFSP 7 which is then automatically forwarded to the MMOG 3 accounts. Once the virtual credits have been purchased and placed into the MMOG 3 account(s), they are transferred to a number of other Avatar accounts owned by the Suspect. The virtual currency is then sold back to OFSP 7. To avoid drawing the suspicions of OFSP 7, the Suspect would be required to transfer the virtual currency purchased from OFSP 7 between various MMOG 3 accounts so that it does not appear that the same person is purchasing and reselling the same virtual credits back to OFSP 7. The proceeds of the sale (real-world currency) are transferred to a number of PayPal accounts and then transferred onwards to an overseas bank account(s). The cost of conducting the amended virtual scenario is shown in Tables 12 to 14. Table 12 shows the cost involved in laundering AUD 176,000. Number of prepaid Visa/MasterCard gift cards obtained 880 Cost to activate cards (AUD 5.95 each) AUD 5,236 Total amount of funds lost when purchasing and selling virtual credits via AUD 31, OFSP 7 Total cost of receiving funds into PayPal merchant account AUD AUD 0.30 per transaction Cost of transferring funds to overseas bank account AUD 0 Minimum cost to launder AUD 176,000 AUD 37, (21.41%) Table 12 Cost of conducting amended virtual tax evasion scenario (AUD 176,000) Table 13 shows the cost involved in laundering AUD 2M. Number of prepaid Visa/MasterCard gift cards obtained 10,000 Cost to activate cards (AUD 5.95 each) AUD 59,500 Total amount of funds lost when purchasing and selling virtual AUD 361, credits via OFSP 7 Total cost of receiving funds into PayPal merchant account AUD 3, AUD 0.30 per transaction Cost of transferring funds to overseas bank account AUD 0 Minimum cost to launder AUD 2M AUD 424, (21.25%) Table 13 Cost of conducting amended virtual tax evasion scenario (AUD 2M)

16 Table 14 shows the cost involved in laundering AUD 7.8M. Number of prepaid Visa/MasterCard gift cards obtained 39,000 Cost to activate cards (AUD 5.95 each) AUD 232,050 Total amount of funds lost when purchasing and selling virtual AUD 1,409, credits via OFSP 7 Total cost of receiving funds into PayPal merchant account AUD 15, AUD 0.30 per transaction Cost of transferring funds to overseas bank account AUD 0 Minimum cost to launder AUD 7.8M AUD 1,657, (21.25%) Table 14 Cost of conducting the amended virtual tax evasion scenario (AUD 7.8M) Feasibility of using the virtual scenario over the traditional method Table 15 shows the feasibility and desirability of using the virtual scenario to launder the minimum, average and maximum amount of funds typically involved in tax evasion activity. Amount to be laundered Ease Time Amount laundered Cost Risks mitigated Chances of Detection Feasibility Desirability AUD 176,000 (Minimum) Feasible AUD 2M (Average) Unfeasible AUD 7.8M (Maximum) Unfeasible Table 15 Feasibility of the virtual scenario A feasibility score was allocated to each of the scenario attributes. The following paragraphs discuss how we arrived at this score. Ease of use (Feasibility scores: MIN = 0.8; AVE = 0.8; MAX = 0.8) The real-world scenario is much simpler to conduct than its virtual-world counterpart. Although individual steps of the virtual-world money laundering scenario are simple to conduct, and require no prior knowledge of virtual environments and a minimum level of knowledge of information and Internet technologies, complexity is introduced in the administration of the virtual-world scenario due to the large number of prepaid Visa/MasterCard gift cards that would need to be purchased, the number of accounts that would need to be set up with various service providers and the number of identities that would need to be obtained or constructed. The Suspect would need to purchase gift cards from a variety of retail outlets to ensure that suspicions are not raised. The Suspect would also be required to have what might be considered a complex system in place for opening accounts, funding accounts and moving funds between accounts. This would need to be done in such a manner that the dirty funds could not be traced back to the Suspect s real world identity.