Elder Financial Exploitation: How to Detect It and File a SAR

Elder financial exploitation (EFE) is the illegal or improper use of an older adult’s funds, property or assets. It can be carried out by strangers in scams or by a trusted person such as a family member, caregiver or financial advisor through theft or misappropriation of access. FinCEN has characterized The U.S. Treasury's 2024 National Money Laundering Risk Assessment describes EFE as a growing money laundering threat, and financial institutions filed more than 155,000 EFE-related Bank Secrecy Act (BSA) reports over a single 12-month period between June 2022 and June 2023.

FinCEN’s data cleanly divides EFE into two subcategories, and this split is the basis for everything else in this article. Elder scams constitute about 80% of EFE related BSA filings and involve money being sent to a stranger or an imposter for a promised benefit that the older adult does not receive. The perpetrator is often unknown to the victim in these scams. Elder theft, the theft of the older adult’s assets, funds or income by an otherwise trusted person, accounts for about 20% of EFE related BSA filings. The perpetrator is known, most often an adult child of the victim, followed by caregivers, attorneys and financial advisors. The 80/20 split is quoted directly from the FinCEN Financial Trend Analysis for June 2022 June 2023, and it sets the detection strategy and the SAR narrative approach for each institution.

This guide describes what EFE looks like in transaction data, how to set up monitoring to catch it, and how to file the SAR that FinCEN expects and the December 2024 interagency guidance reinforces.

• Why EFE Is a BSA/AML Priority, Not Just a Consumer Issue
• Common EFE Schemes: What Scams Are Targeting Elderly Customers
• FinCEN’s Red Flags: 24 Indicators for Financial Institutions
• How to Set Up Your Systems to Detect EFE
• What FinCEN Expects When Filing an EFE SAR
• Beyond the SAR: APS & Law Enforcement Reporting
• How Sanction Scanner Supports EFE Detection

Why EFE Is a BSA/AML Priority, Not Just a Consumer Issue

Elder financial exploitation is largely considered to be a consumer protection issue, a type of fraud against a vulnerable population. That framing underplays what is changing for financial institutions in 2024 and 2025. EFE is now a specific Bank Secrecy Act/Anti Money Laundering (BSA/AML) priority, with its own regulatory infrastructure.

The scale is not only human, it’s regulatory. FinCEN’s April 2024 Financial Trend Analysis of BSA reports submitted between June 2022 - June 2023 that contained either the key term from FinCEN’s June 2022 EFE Advisory or selected “Elder Financial Exploitation” as a suspicious activity type found 155,415 filings during this 12 month period, reporting suspicious activity, including attempted transactions $27 billion of EFE-related suspicious activity. Between June 2023 and January 2024, FinCEN continued to receive a steady, ongoing volume of approximately 16,000 EFE related BSA reports each month. According to the 2024 Interagency Statement on EFE, an AARP BankSafe Initiative study estimated annual EFE losses at $28.3 billion, and the Treasury’s 2024 National Money Laundering Risk Assessment identified EFE as “a growing money laundering threat” linked to more than $3 billion in reported financial losses annually.

Behind this data is a thick, coordinated regulatory momentum. In June 2022, FinCEN published an Advisory (FIN-2022-A002) that formally established the EFE reporting construct, including the critical term for SAR narratives and the 24 red flags that financial institutions should be on the lookout for. Then FinCEN’s April 2024 Trend Analysis reported what the reporting had actually uncovered. The Treasury’s 2024 National Money Laundering Risk Assessment has called out EFE specifically as an emerging money laundering risk. On December 2024, the federal banking agencies the Federal Reserve, OCC, FDIC, NCUA, CFPB, and FinCEN, in coordination with the Conference of State Bank Supervisors, released an Interagency Statement on Elder Financial Exploitation, outlining certain risk management practices banks should adopt.

The bottom line here is that if your institution serves elderly customers, documented EFE detection and reporting capabilities are no longer optional. This is a compliance obligation, not a public relations initiative, with active regulatory attention behind it.

Common EFE Schemes: What Scams Are Targeting Elderly Customers

FinCEN’s Trend Analysis identified the types of scams that were the basis for EFE related BSA filings. Knowing what actually shows up in the data, as opposed to the popular media picture of elder scams, is key to configuring monitoring that catches what is actually happening.

Account takeover. 22% of the EFE scam SARs report this scheme. Most common type of scam in the FinCEN dataset. Most often in a tech support scam or in a phishing, the victim is a senior citizen who unwittingly provides a stranger access to their account, then makes a transfer or withdrawal. FinCEN also observed that illicit actors more frequently stole funds through unsophisticated means, guessing passwords rather than sophisticated technical intrusion. For the institution, the red flags include unexpected password changes, logins from new devices and rapid outbound transfers that don’t match the customer’s history.

Scam type not known. 23% of the EFE scam SARs fall under this category. A category which deserves to be mentioned for itself, as it is indicative of the fact that many EFE cases are reported before the specific type of scam is fully understood. The transaction pattern is clearly suspicious, but the underlying manipulation (may be romance, tech support, government impersonation or something else) has not been completely unpacked at the time of filing.

Tech support scams. 10% of the EFE scam SARs report this scheme. The victim is persuaded to give remote desktop access to the fraudster. The fraudster then starts wire transfers, or more often, persuades the victim to purchase a large amount of gift cards . Fake calls from “Microsoft” or “Apple” support. The institution sees odd wire transfers while or immediately after a phone call, large gift card purchases, and often a distressed, coached customer at the counter.

Romance scams. 9% of the EFE scam SARs report this scheme. Emotional manipulation over weeks or months before financial transfers to a supposed partner the victim has never met in person. Over an extended period, often international, the institution is witnessing increasing transfers to new beneficiaries.

Pretending to be a government official. 8% of the EFE scam SARs report this scheme. The scammer poses as an IRS, Social Security Administration or local police officer threatening immediate arrest, cancellation of benefits or assets being seized if the victim does not pay. The institution receives an emergency wire or cash withdrawal from a customer in trouble who cannot explain the purpose.

Other scam types identified. 28% of the EFE scam SARs fall under this category. Plus, a residual category of 41 types of scams identified in the FinCEN analysis, lottery and prize scams, investment and pig butchering scams targeting elderly customers through cryptocurrency platforms, grandparent scams, charity scams, and others.

Trusted person theft. (20% of all EFE SARs fall under this category. The elder theft category which is distinct from the above scam typologies: Adult children are responsible for almost 40% of the crimes, followed by caregivers, attorneys with power of attorney authority and financial advisors, the FinCEN manual review shows. The signals are structural, not transactional: Changes in account signatories, a new power of attorney suddenly exercised, ATM withdrawals at unusual hours or locations, checks written to new parties. This is the hardest kind to detect because the perpetrator has legitimate access.

The scam type distribution in the table below is the operational picture what actually produces the 16,000 per month SAR volume that FinCEN receives.

FinCEN’s Red Flags: 24 Indicators for Financial Institutions

In June 2022, FinCEN issued an advisory that described 24 red flags in two categories (i.e., 12 behavioral and 12 financial) for financial institutions to watch for in an effort to identify EFE. These are the ultimate operational reference and any credible EFE detection program should be based on them.

Frontline staff sees behavioral red flags during customer interactions. They are particularly important because they draw attention to signals that transaction monitoring alone cannot see.

The customer appears confused, nervous or fearful during a transaction, especially a large one or one with unusual instructions. The customer is accompanied by a new friend, caregiver, or family member who directs the customer's actions, speaks for the customer, or interrupts the customer when they are attempting to answer questions. The customer enters into transactions that do not make economic sense based on the customer's known financial needs, patterns or apparent state of mind. The customer is unable to provide details of the purpose or destination of a transaction. The customer reports that someone is “helping” with their finances, someone unknown to the institution and not an authorised person in any way. The customer has had financial activity that closely follows recent unexplained changes to legal documents like a new power of attorney, changes to a will or beneficiary designations. The customer appears to be on the phone or being coached during the transaction, getting real-time direction. The customer exhibits physical signs of neglect, fear or unusual anxiety that are out of character for previous interactions. The customer gets concerned about a family member or acquaintance and starts making unusual transfers to help with the situation. The customer cannot identify their own beneficiaries or authorized signers or seems to have forgotten recent account activity. The customer requests transactions that the institution has cautioned or warned against (specifically gift cards, wire transfers to unknown parties, or cryptocurrency). And the customer’s demeanor changes suddenly during the course of the transaction from calm to distressed or clear to confused.

What the monitoring systems look for are financial red flags in transaction data. These are directly configurable as rules in a transaction monitoring platform.

Unusually large withdrawals or transfers that are inconsistent with the customer’s normal pattern of activity. New beneficiaries added to accounts, especially international locations, crypto exchanges or unknown parties. Changes in signatories on accounts, especially the inclusion of a new person whose relationship to the customer cannot be verified. A new power of attorney on file with the institution. Large unexpected withdrawals from the account. Multiple wire transfers or cashier’s checks to unknown parties, especially if done with high frequency or in increasing amounts. One of the best single signs of an active scam is purchasing large amounts of gift cards. A regular decline in your account balance with no corresponding life change to explain it, such as retirement spending or documented medical expenses. Transactions identified for known scam typologies, e.g. transfers to jurisdictions commonly associated with romance and lottery scams. A customer with a previously stable financial history starts writing overdrafts, missing bill payments, or writing bounced checks. Cash withdrawals from ATMs in locations that are inconsistent with the customer's residence or travel patterns. Closing savings, investment or CD accounts before maturity: Proceeds going to strange places. Loan applications, especially for reverse mortgages or home equity products. Then disbursement to third parties.

For operational purposes, all 24 red flags are classified in the table below by method of detection.

How to Set Up Your Systems to Detect EFE

EFE detection is more a pattern break problem than a threshold problem. Older customers have long, established transaction histories, sometimes decades long. EFE is an anomaly from that established baseline and the most powerful monitoring configurations are built around detecting the anomaly, not fixed thresholds that would treat every large transaction equally.

When a customer has had a $50,000 savings balance for 10 years and suddenly withdraws $30,000 it is a very different signal than a new customer withdrawing the same $30,000. Monitoring systems that flag both equally will be flooded with false positives on the new customer, but then miss the real EFE event. Systems that read against the customer’s own history will catch the deviation and let the new customer activity through.

Most of the work is done by six monitoring configurations.

Criteria for deviation from baseline, age calibrated. Flag transactions that are a certain percentage of the customer’s rolling monthly activity for the past 6 to 12 months, say 200% to 300%. The threshold for deviation for customers above 65 years old should be lower than the general population as the base of elderly customers generally is more stable and a large deviation is more likely to be exploited.

New beneficiary plus age rules. If a customer age 65+ adds a new payee to their account and initiates a transfer within 24 hours, this will trigger an elevated alert. The two events are unremarkable alone and a strong pattern together.

Track gift card purchase. One of the strongest individual indicators of an active tech support or IRS impersonation scam is an elderly customer buying multiple gift cards in a short time period. Merchants that have a large elderly clientele should establish specific rules for this pattern rather than treating gift cards as normal merchant activity.

Changes in wire transfer patterns. An elderly customer initiating an international wire transfer for the first time, particularly to jurisdictions commonly associated with romance and lottery scams, is an elevated risk event that should result in either a hold pending customer contact or at minimum, immediate case creation.

Change of signatory or power of attorney (POA) and increase in transactions. Signature pattern of elder theft by trusted person: New power of attorney registered or new signatory added to account with material increase in transaction volume within 30 days. The monitoring layer should associate the account authority change event with the subsequent transaction activity, rather than treat them as unrelated.

Crypto exposure. A first time customer who is elderly wiring money to a cryptocurrency exchange is a strong pig butchering indicator. As the occurrence of fraud in crypto investment targeting elderly customers is increasing, this scenario should be set with higher thresholds compared to the general population.

The key architectural point is that EFE monitoring is not a separate system with separate infrastructure. This is a set of additional rules and scenarios set up on top of the institution's existing transaction monitoring and fraud detection platform. Sanction Scanner’s rule engine manages EFE-specific scenarios via the same interface used for AML structuring rules and fraud velocity rules; the operational discipline is scenario design and calibration, not a new build.

What FinCEN Expects When Filing an EFE SAR

FinCEN has been explicit about how EFE SARs should be filed, and the specificity matters because that is how the agency tracks EFE trends and feeds intelligence back to law enforcement.

SAR activity type In the suspicious activity characterization field 38(d) the current SAR form), the filer should check “Elder Financial Exploitation.” This activates FinCEN’s EFE tracking and ensures that the report is captured in the analyses that inform Trend Analyses and Advisories.

The keyword in the story. The SAR narrative must include the key term “EFE FIN-2022-A002.” This term specifically links the filing to FinCEN’s June 2022 EFE Advisory and, along with the activity type checkbox, is how FinCEN identified the 155,415 filings analyzed in the April 2024 Trend Analysis. Without the key term, the filing may not be included in EFE specific analytics.

Content of story. The story should include details about the alleged abuse: What kind of abuse it was (scam or theft, and if possible which specific scam typology); the relationship between the perpetrator and the victim (stranger, adult child, caregiver, attorney, financial advisor); how the abuse was perpetrated (romance scam, tech support, account takeover, POA abuse, etc); the financial impact including specific amounts and accounts that were impacted; the specific red flags (behavioral and financial) that triggered the investigation; and what actions the institution took, including any transaction holds placed on the victim's accounts, any contact with the customer, or any referrals to Adult Protective Services (APS).

Timing. EFE SARs do have the usual SAR filing deadline of 30 days from detection. However, earlier filing is strongly encouraged for active, ongoing exploitation in which the customer continues to lose funds, and some institutions file an initial SAR right away and add an amended SAR as the picture becomes clearer. The expectation from the regulators is that the filing is done in a timely manner so that it is operationally useful and not that it takes the full 30 days.

Voluntary filing. Even when activity falls below the thresholds for mandatory SARs, FinCEN explicitly encourages voluntary EFE SAR filing. These reports allow law enforcement to see patterns across institutions and geographies, and they feed into the aggregate data that FinCEN uses in its EFE specific analyses. A voluntary filing posture is a meaningful part of what FinCEN and the interagency framework now expect from mature programs.

Beyond the SAR: APS & Law Enforcement Reporting

The filing of a SAR does not satisfy all of the reporting obligations related to EFE, which was made clear in the December 2024 Interagency Statement. There are four other channels surrounding the SAR.

Adult Protective Service (APS). Many states require financial institutions to report suspected elder exploitation to APS. Some states require this for all bank employees, whereas other states limit the reporting requirement to particular positions. The Interagency Statement expressly encourages APS reporting where consistent with applicable law, as a supplement to, not a substitute for, SAR filing. States have widely varying requirements, with 34 states and Puerto Rico taking up EFE in their 2023 legislative sessions alone. Institutions should instead map their specific state obligations against the National Adult Protective Services Association’s guidance rather than assuming a uniform standard.

Police. The FBI’s Internet Crime Complaint Center (IC3) is the main reporting mechanism for cyber enabled EFE. Local police deal with theft and physical elder abuse that happens in person. The Department of Justice also has a National Elder Fraud Hotline at 833 FRAUD 11 (833 372 8311). FinCEN specifically advises that institutions refer customers who may be victims of EFE to the hotline to assist in reporting to the appropriate government agencies.

FinCEN Rapid Response Program. In cases where the cyber enabled fraud involves transferred funds to fraudulent accounts, the Rapid Response Program (RRP) of FinCEN can help in the recovery of funds. As of April 2026, the RRP had facilitated the interdiction of $1.8 billion and the recovery of over $1 billion in stolen proceeds on behalf of 5,790 US victims, working with law enforcement and foreign partners across more than 96 jurisdictions.

Trusted contact designation. The Interagency Statement encourages institutions to establish trusted contact procedures for older customers, allowing the institution to contact someone if it identifies signs of possible exploitation without taking formal legal action. Trusted contact programs have been put in place by securities firms under FINRA Rule 4512, and depository institutions are trending towards doing the same for deposit accounts. This is a lower friction control than formal reporting and is often the first step in intervening in an active scam.

Delays in disbursement, holds on transactions. Some states now allow financial institutions to temporarily freeze transactions suspected of involving EFE, typically for a specified time period during which the institution can contact the customer, a trusted contact or APS. The Interagency Statement supports this practice to the extent consistent with applicable law. Institutions in states that permit holds should be explicit in documenting policies and training frontline staff on when and how to invoke them.

How Sanction Scanner Supports EFE Detection

Institutions already have the monitoring infrastructure in place to detect AML and fraud, and this can be used to detect EFE. Scenario configuration and case management support is the differentiator, not a separate product build.

Transaction monitoring. Configurable rules for the above EFE-specific scenarios baseline deviation calibrated for elderly customers, new beneficiary plus age correlation, gift card purchase monitoring, wire transfer pattern changes, and signatory/POA change plus transaction spike. All configured using the same visual rule builder as AML and fraud rules.

Fraud detection. Behavioral analytics identifying pattern breaks in long-standing customer relationships the specific signal that catches EFE against a stable baseline. Session, device, and behavioral signals that uncover the account takeover pattern behind 22% of EFE scam SARs.

Continuous monitoring. Ongoing reassessment of customer risk that identifies changes in the customer’s risk profile a new POA, a change in signatory, a change in transaction geography as they happen, rather than at the next scheduled review.

Case management. SAR-ready documentation for EFE filings including the FinCEN key term “EFE FIN 2022 A002” and the “Elder Financial Exploitation” activity type field. This is to make sure the operational discipline of correctly categorized EFE reporting is supported by the workflow, rather than left to analyst memory.

The architectural point is that EFE is not a stand-alone compliance product. It is a well-defined set of scenarios within the fraud and AML monitoring layer, and the institutions that are doing well are the ones that have explicitly configured those scenarios, trained frontline staff on the behavioral red flags, and integrated APS and law enforcement reporting into their standard response playbook. That configuration is not a competitive advantage; it’s the operating floor in the current regulatory environment.

Sources

[1] Financial Crimes Enforcement Network. Elder Financial Exploitation: Threat Pattern & Trend Information, June 2022 to June 2023. 2024.

[2] Financial Crimes Enforcement Network. FinCEN Issues Analysis on Elder Financial Exploitation. 2024.

[3] Financial Crimes Enforcement Network. Advisory on Elder Financial Exploitation (FIN-2022-A002). 2022.

[4] Board of Governors of the Federal Reserve System, CFPB, FDIC, FinCEN, NCUA, OCC, and State Financial Regulators. Interagency Statement on Elder Financial Exploitation. 2024.

[5] U.S. Department of the Treasury. 2024 National Money Laundering Risk Assessment. 2024.

[6] Financial Crimes Enforcement Network. Fact Sheet on the Rapid Response Program (RRP). April 2026.

[7] eCFR, U.S. Code of Federal Regulations. 31 CFR 1020.320: Reports by Banks of Suspicious Transactions. 2025.

Deniz Zerin

Senior Content Writer

View full profile →