Forensic accountants are marrying old-fashioned sleuthing techniques with complex blockchain investigations as criminals increasingly turn to cryptocurrencies to launder the proceeds of fraud.
Gleaning "fingerprints" from bank statements, tax returns, or electronic devices can be key to deducing the illicit ownership of cross-border, opaque cryptocurrencies such as bitcoin, those who track such activity said.
"For the criminally active insider who's looking to embezzle, it can be an attractive way to try to steal money," said Robert Musiala, Esq., Chicago-based blockchain counsel at BakerHostetler.
"As a forensic investigator, you need to be aware of the industry because it's not going away," said Musiala, lead author of the fall 2019 AICPA Eye on Fraud report, Cryptocurrencies: Forensic Techniques to Meet the Challenge of New Fraud and Corruption Risks.
High-profile Ponzi schemes, multilevel marketing, and investment scams involving virtual currencies have grabbed headlines in the United States in recent years as authorities and regulators crack down on crypto-crime.
But there's scant information available on the success rate of private investigations when it comes to tracking down and ultimately recovering illicit cryptocurrency holdings.
Investigators and blockchain experts say the industry urgently needs to get a firm grip on increasingly mainstream virtual currencies and spot the telltale signs that they are being used to squirrel away illicit funds.
Here are five tips to track down cryptocurrency:
Check the entry and exit points
Cryptocurrency can be bought in a variety of ways, so many investigations start with a paper trail.
Bank and credit card statements are often the first stop for investigators. These may show a suspect has bought virtual currencies through an online exchange such as Coinbase, where popular currencies such as bitcoin and ether (the token of the Ethereum blockchain system) are traded.
Finding these "entry and exit" points can be invaluable for forensic accountants as they look for financial crumbs to follow, said Mark DiMichael, CPA/ABV/CFF, a partner in New York-based Citrin Cooperman's forensic, litigation, and valuation services department.
Using blockchain, the transparent ledger that records the transaction history of each coin, investigators can then start to piece together any scraps of information they glean to try to prove ownership of the virtual funds.
"If you know the options that are available, you can assess the situation and start your investigation," said DiMichael. "If you have no idea where to look, it's going to be really hard to find."
In the United States, investigators have successfully subpoenaed cryptocurrency exchanges to hand over transaction records, said DiMichael, who has tracked down virtual money hidden by spouses in divorce cases.
All types of businesses that accept bitcoin as payment can be subpoenaed to hand over information about transactions that investigators can use to help track and identify cryptocurrency holdings, he added. However, the success of such subpoenas depends on the jurisdiction.
Create a profile of the suspect
Building up a comprehensive profile of a suspect is key to helping investigators follow their trail, and ultimately to perhaps recovering any money they may have stashed away, according to the AICPA Eye on Fraud report.
Determining whether a suspect has experience trading cryptocurrency or already has accounts with major exchanges raises the likelihood of a suspect's putting ill-gotten gains into virtual money.
There's always the chance a suspect may declare that they engaged in virtual currency transactions on their annual tax returns, as the IRS now requires, said Citrin Cooperman's DiMichael.
Even in-house surveys asking about cryptocurrency holdings can also help identify which employees have knowledge of the sector, said BakerHostetler's Musiala.
"There's a wealth of valuable publicly available information on the blockchain itself, but in many cases special tools, combined with ample contextual knowledge, are necessary to interpret that data. However, there's also typically a fair bit of valuable information that can be gathered from traditional investigative work," said Paul Sibenik, case manager at CipherBlade, a London-based blockchain forensics and investigation agency.
"We tend to find that marrying blockchain forensics together with more traditional digital forensics investigative work results in a far more effective outcome in the end," said Sibenik.
Find the devices and extract the evidence
Computers and mobile phones seized as part of an investigation can be a gold mine when it comes to uncovering evidence that could indicate a suspect has converted money into cryptocurrency.
Expert forensic analysis of electronic devices and personal email accounts may show they have installed cryptocurrency exchange apps to trade online.
Emails could include virtual currency "addresses" used to receive payments. Or a suspect might have buried their private "keys," the unique alphanumeric codes needed to approve transactions, inside their device.
Forensic device analysis can also potentially uncover useful information about the "wallets" that can be used to store cryptocurrency keys and account information.
While cryptocurrency information can be held in paper wallets, such as those dispensed by bitcoin ATMs, other options include USB-style hardware wallets, mobile wallets used on phones, and online wallets held in the cloud.
"How the person holds their cryptocurrency will have some impact on how it's being investigated," said Citrin Cooperman's DiMichael.
Drill down into the transactions' details
Determining a suspect has converted money into virtual currency is just the starting point.
The next challenge is to join together any details uncovered, such as information on wallets, addresses, and keys, to link transactions to the person under investigation.
It can be a complicated, time-consuming task that requires specialized technical skills and access to investigative blockchain software that few accountants have in-house.
Increasingly, accountants are outsourcing that side of their investigation to professional blockchain forensic firms that have the experience, technical knowledge, and tools to effectively investigate, said Sibenik.
"When you're dealing with larger volumes of transactions or cases, especially in cases where people are using a plethora of personal wallets involving thousands of transactions, which is fairly common, along with some obfuscation techniques, few accounting firms are equipped to handle that type of investigation," he said.
Just to complicate the task further, anonymous "privacy coins" now on the market, such as Monero, do not publicly disclose much pertinent transaction data.
But as with bitcoin, investigators can still find "fingerprints" at entry and exit points that could show that someone has bought or sold Monero, even though Monero itself can't be traced off-exchange between personal wallets, Sibenik explained, adding that the liquidity and availability of bitcoin means it's still by far the most common cryptocurrency to utilize and hold.
Get the right talent
For complex investigations, Musiala suggests forensic accountants add people with compliance and anti-money laundering expertise to their teams, as well as virtual currency experts.
And companies that lack the in-house technical skills and blockchain intelligence software can employ external forensic experts to help trawl through transactions.
While cracking cryptocurrency might be a new challenge for some forensic accountants, it still relies on their tried and tested traditional investigative skills.
"Matching up cryptocurrency transactions, traditional transactions and then the additional layer of online behavior of the criminal… will allow you to actually trace transactions and create opportunities for actual recovery of cryptocurrency assets or other forms of value," said Musiala.
— Sophie Hares is a freelance writer based in Mexico. To comment on this article or to suggest an idea for another article, contact Drew Adamek, a JofA senior editor, atAndrew.Adamek@aicpa-cima.com.
