Credit card laundering is a form of money laundering that pushes illegal proceeds through the credit card payment system so they come out looking like ordinary merchant sales. Criminals set up or take over merchant accounts, run transactions against stolen or illicit funds, and let the deposits settle into bank accounts as what appears to be normal business revenue. Federal penalties reach up to 20 years in prison under the main money laundering statute, and prosecutors routinely add charges for access device fraud and aggravated identity theft on top.
The Three Phases of the Scheme
Credit card laundering follows the same arc as other money laundering, adapted to the payment system. Placement gets the illicit money into the financial system, often by converting stolen card numbers or dirty funds into prepaid cards, digital wallet balances, or merchant account deposits that look routine.
Layering is where the payment ecosystem does the heavy lifting. Funds move through multiple merchant accounts, payment processors, and bank accounts, producing a tangle of transactions that hides the origin. A single batch of money may pass through several shell companies before landing somewhere that looks like a legitimate operating account. Integration is the last step: spending or investing the now-clean funds, which by that point are indistinguishable from earned income.
Common Methods
Fictitious Sales
The simplest technique is processing charges for goods or services that were never delivered. A criminal opens a merchant account, runs card transactions against it, and books the deposits as sales. Digital goods work especially well because there is no physical shipment to verify.
Transaction Laundering
Transaction laundering happens when someone processes card payments through another merchant’s account without the payment processor’s knowledge. The approved merchant acts as a front while the real transactions involve illegal goods, banned products, or pure fabrication. Payment aggregators, which bundle many sub-merchants under one master account, are particularly exposed: a bad actor can slip in among legitimate sellers and collect proceeds before the pattern surfaces. FinCEN has warned financial institutions to apply thorough due diligence to payment processors, including verifying required state licenses and checking for pending investigations against the processor or its owners.1Financial Crimes Enforcement Network. FinCEN Advisory FIN-2012-A010
Shell Companies and Front Businesses
Shell companies are the backbone of most operations. They carry real business registrations and real merchant accounts, sometimes with a website and a scattering of legitimate customers, but most of the revenue is laundered. Because forming an entity in most states costs a few hundred dollars or less and can be done online, criminals spin them up and abandon them faster than investigators can shut them down.
Structuring
Structuring breaks a large sum into smaller transactions to stay below the $10,000 threshold that triggers a Currency Transaction Report under the Bank Secrecy Act.2FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Appendix G – Structuring Structuring is itself a federal crime regardless of whether the underlying money is dirty, and a pattern of sub-threshold transactions can still generate a Suspicious Activity Report.3Financial Crimes Enforcement Network. Suspicious Activity Reporting (Structuring)
Refund and Chargeback Manipulation
In a refund scheme, the criminal processes a bogus refund to a card, making it look like a return, then extracts the credited amount through another channel. Chargeback schemes work the other direction: the criminal makes a real purchase, receives the goods, and disputes the charge to claw back the payment while keeping the merchandise. Both create paper trails that read as commerce gone wrong rather than deliberate laundering.
Who’s Involved
Schemes require several roles, and not everyone in them knows what they’re doing. Organizers design the operation and control the flow of funds, typically after acquiring stolen card data through breaches, phishing, or dark-web marketplaces. Complicit merchants are the critical link: entirely fake businesses, or real ones whose owners agreed to process fraudulent charges for a cut.
Money mules move funds between accounts and are often recruited through fake job listings promising easy pay for “payment processing” work. Many mules don’t grasp what they’re facilitating until law enforcement arrives. Cardholders whose numbers are stolen are victims, though investigators may treat a compromised account with suspicion until the picture clears.
Federal Penalties
Prosecutors stack charges to capture the full scheme, and the exposure adds up fast.
Money Laundering (18 U.S.C. 1956)
The main federal statute punishes anyone who conducts a financial transaction knowing the funds come from illegal activity, with intent to promote further illegal activity or conceal the source. The maximum is 20 years in prison and a fine of $500,000 or twice the value of the property involved, whichever is greater. Conspiracy carries the same penalty as the underlying offense.4Office of the Law Revision Counsel. 18 US Code 1956 – Laundering of Monetary Instruments
Transactions in Criminally Derived Property (18 U.S.C. 1957)
A companion statute makes it a separate crime to knowingly engage in any monetary transaction over $10,000 involving criminally derived funds. The maximum is 10 years per offense and a fine of up to $250,000, or twice the property involved.4Office of the Law Revision Counsel. 18 US Code 1956 – Laundering of Monetary Instruments
Access Device Fraud (18 U.S.C. 1029)
Federal law classifies credit cards as “access devices.” A first offense involving the production, use, or trafficking of counterfeit or unauthorized access devices carries up to 10 years for most violations, and up to 15 years for certain categories such as possessing device-making equipment. A second conviction doubles the maximum to 20 years, and the court can order forfeiture of any personal property used in the offense.5Office of the Law Revision Counsel. 18 US Code 1029 – Fraud and Related Activity in Connection With Access Devices
Fraudulent Use of Credit Cards (15 U.S.C. 1644)
Using a counterfeit, stolen, or fraudulently obtained credit card to obtain goods, services, or money worth $1,000 or more in a one-year period is punishable by up to 10 years in prison and a $10,000 fine. The same penalties reach transporting fraudulent cards across state lines and knowingly receiving goods obtained through fraudulent card use.6Office of the Law Revision Counsel. 15 USC 1644 – Fraudulent Use of Credit Cards; Penalties
Aggravated Identity Theft (18 U.S.C. 1028A)
When the scheme uses someone else’s identity, prosecutors can add aggravated identity theft. It carries a mandatory two-year prison sentence that runs consecutively to whatever the defendant receives on the underlying fraud, with no option to serve it concurrently.7Office of the Law Revision Counsel. 18 US Code 1028A – Aggravated Identity Theft
Actual Sentences
Statutory maximums are the ceiling, not the norm. According to the United States Sentencing Commission, the average sentence for credit card and other financial instrument fraud was 26 months, and 92.7 percent of defendants received prison time.8United States Sentencing Commission. Quick Facts: Credit Card and Other Financial Instrument Fraud Defendants convicted of money laundering under 18 U.S.C. 1956 alongside the fraud counts face significantly longer sentences.
Civil Forfeiture
The government can also take property connected to a laundering scheme without waiting for a criminal conviction. Under the civil forfeiture statute, any real or personal property involved in a money laundering transaction or traceable to one is reachable, including bank accounts, vehicles, real estate, and equipment.9Office of the Law Revision Counsel. 18 USC 981 – Civil Forfeiture
Forfeiture reaches proceeds of access device fraud under 18 U.S.C. 1029 as well. In cases involving illegal goods or services, “proceeds” means total property obtained from the offense, not net profit. A merchant account that ran $2 million in fraudulent transactions cannot deduct operating costs from the forfeiture amount.9Office of the Law Revision Counsel. 18 USC 981 – Civil Forfeiture
How Schemes Get Detected
Banks and payment processors are the first line of defense. When an institution detects suspicious activity involving $5,000 or more, it must file a Suspicious Activity Report with FinCEN within 30 calendar days of initial detection. If no suspect has been identified, the institution gets another 30 days, capped at 60 days total. Ongoing schemes require immediate telephone notification to law enforcement in addition to the SAR.10Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions
In practice, acquiring banks and processors watch for transaction volumes that don’t match the merchant’s stated business size, sudden spikes in chargebacks, charges that don’t fit the merchant’s product category, and strings of round-dollar amounts that look nothing like real retail activity.
If Your Card Is Used in a Scheme
Federal law caps a cardholder’s liability for unauthorized credit card charges at $50 under the Truth in Lending Act, and even that cap only applies if the issuer provided notice of potential liability, a way to report the loss, and a method to identify authorized users. If any of those conditions is missing, the cardholder owes nothing. Charges made after you notify the issuer are entirely the issuer’s loss.11Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
Most major issuers go further with zero-liability policies that absorb the $50 as well. Review statements regularly, and if you spot charges you didn’t make, call your issuer immediately and follow up in writing within 60 days. Prompt reporting protects your rights and helps investigators flag accounts that may be part of a larger laundering operation.