Leveraging social media intelligence to support money laundering investigations

Revealing lifestyle indicators and financial patterns through user-generated content, social media has become a rich source of information for money laundering investigations.

The number of social media platform users is increasing at an explosive rate. SearchEngineJournal found that social media users worldwide reached 5 billion this year, representing 63.7% of the global population and nearly 95% of all internet users.

Social media users post all types of content to their profiles, most of which are public. For instance, a person on vacation posts information about their locations, places they visit and the activities they do. Images and videos posted online can be analyzed to reveal different information such as their business relationships, close friends, their participation in public events such as concerts and other social gatherings in addition to their romantic relationships and passion in life (their preferred music, sports, art, food and travel destinations).

The techniques of harvesting data from social media platforms have developed in recent years as these platforms have become a rich source of information for open-source intelligence (OSINT) examiners to conduct all types of online investigations, particularly those related to money laundering activities.

What is SOCMINT?

SOCMINT is a sub-branch of OSINT focused on acquiring useful intelligence from social media platforms.
Social Media Intelligence (SOCMINT) has become essential to modern investigations, particularly in uncovering money laundering activities. By leveraging the vast amounts of publicly available data on social media platforms, investigators can reveal hidden connections, track suspicious behavior and gain valuable insights into the digital lives of individuals and organizations under scrutiny.

Using SOCMINT to investigate money laundering activities

General OSINT investigations focus on gathering publicly available information from diverse sources in bulk about a specific entity, while SOCMINT investigations leverage information found on social media platforms that reveal lifestyle indicators and financial patterns through user-generated content, such as posts showcasing luxury purchases, high-value assets (cars, jewelry, high-value clothing brands) or frequent international travel that may be inconsistent with declared income sources.

Here is how SOCMINT can be used practically to support money laundering investigations:

Identifying digital assets and online presence

OSINT gatherers first need to collect and analyze the target individual or entity's social media presence, including examining social media profiles, business pages, forums and encrypted messaging apps.

To find all social media profiles of an entity, we can use the following tools/online services:

• WhatsMyName - Find all social media profiles of a particular username
• theHarvester - A command line tool for finding names, emails, IPs, subdomains and URLs by using various public resources
• Maigret - A command line tool for finding usernames across social media platforms
• Sherlock - Another tool for reverse username search across 400 social media networks

After finding all related social media profiles, we need to inspect their biographies and posts for financial services, cryptocurrency investments or high-yield trading claims.

Using SOCMINT to inspect lifestyle indicators

OSINT gatherers can observe their target individuals' social media posts to anticipate their suspicious spending. For example, posts on Facebook, Instagram or other social media services showcasing expensive sports cars, jewelry, wearing clothes from costly designers and excessive traveling to famous destinations in addition to high-end dining can reveal a luxury lifestyle that could be inconsistent with declared income. The existence of such an issue can suggest potential hidden wealth or acquiring funds from illicit business activities such as bribery or illicit trade.

Here are some online services to help you reveal more information regarding target individual spending:

• Tripadvisor - Provides reviews from millions of travelers who travel to numerous worldwide destinations about the places they visit. The information we can get includes information about hotels, restaurants, flight companies and travel agencies, along with their costs
• LonelyPlanet - Another website that provides travel guide information            
• Booking.com - Reveals typical accommodation costs and luxury hotel pricing  worldwide
• WatchBase - The ultimate online watch database, it provides full details on any watch, focusing on high-end mechanical watches
• Chrono24 - Provides information about precious watches. Its database contains information about 550,171 watches from 127 countries
• 1stDibs - Provides information about high-end jewelry and designer items such as furniture, arts and fashion
• Forevermark - Search for jewelry by photo
• Ernestjones - Visual search tool for jewelry
• Kay Jewelers - Another visual search tool for jewelry, it allows refining search according to gender, category and price
• Jewelry Identifier Gemstone ID - A mobile app for identifying rocks gem

We should also inspect visiting high-risk countries as this could indicate affiliation with criminal war suspects or conducting illicit activities, such as drug and firearms dealing. Here are some links to official government trip advisory websites that provide contextual information about high-risk countries:

• Government of Canada's official travel advice - This website lists the global destinations that Canadian people are not advised to visit because of political instability or war-related risks
• USA official travel advisory -  Provides detailed contextual information about global destinations and why US citizens should not visit a particular country or territory (e.g., due to risk of terrorism, civil unrest, kidnapping or hostage taking, or armed conflict)
• UK foreign travel advice - Provides advice and warnings about travel abroad, including entry requirements, safety and security, health risks and legal differences
• Interpol red notice - View and search public red notices for wanted persons worldwide (see Figure 1)

Figure 1 - The Interpol public Red Notice database

Sometimes, OSINT analysts may need to verify precious possessions that appear in social media posts, such as watches, jewelry and clothes from high brands. To inspect such examples, we first need to take a screen capture of the item, enlarge it (if required) and conduct a reverse image search to see its actual value. Here are some free online services for verifying luxury items in social media posts:

Photo enlargement:

• Image Enlarger - A free online service for making photos bigger within seconds
• Photoenlarger - A free photo enlarger that does not require registration
• Bigjpg - AI-powered image upscaling online service
• LetsEnhance - Increase image resolution and improve quality using AI technology

Reverse image search:

• Google images
• TinEye
• Yandex reverse image search
• PimEyes - Specialized in facial recognition and finding similar images

For example, Mark Zuckerberg's video on Instagram at the beginning of January revealed he was wearing a Greubel Forsey watch worth nearly 1 million dollars. By taking a closer snapshot of the watch and executing a reverse image search to see where it also appears, we can find the actual cost of his watch and verify its authenticity through luxury watch databases (see Figure 2). This technique demonstrates how SOCMINT analysis can reveal specific high-value assets and their exact market value through careful visual documentation and verification.

Figure 2 - Video source

Mapping money laundering networks

Money launderers commonly use a web of accounts, proxies or intermediaries to move illicit funds. OSINT gatherers can track these networks by analyzing followers and engagement analysis. For instance, suppose we are tracking an individual for money laundering; by analyzing his social media followers and engagement, OSINT gatherers might find a network of individuals who frequently interact with their posts. Those people should be inspected to see if they can provide new leads for our investigations.

Key engagement indicators to monitor include:

• Recurring financial discussions in comments and re-share
• Shared travel patterns between followers
• Business partnerships with other entities could be revealed through tags
• Cross-platform presence of the same network

OSINT gatherers should utilize network visualization tools for relationship mapping. Tools such as Maltego and Gephi allow viewing complex relationships between large numbers of entities spread across the web. By visualizing the network, investigators can identify key players who might be orchestrating the money laundering operation.

SOCMINT techniques provide OSINT gatherers with advanced capabilities to detect money laundering activities through social media analysis. This includes examining digital footprints, tracking lifestyle indicators and mapping relationship networks. Through specialized tools for digital presence identification, verification of luxury possessions such as cars and real estate, and network visualization, OSINT gatherers can uncover hidden wealth and suspicious financial patterns. Integrating SOCMINT with investigative methodologies enables precise tracking of financial activities and identification of money laundering networks through publicly available social media data.

Remember to stay secure and anonymous while you research. Protect your identity and the intent of your investigation with a purpose-built digital investigations platform like Silo for Research.