The Mechanics of Grooming: How Criminal Networks Build Their Infrastructure from the Inside Out

To disrupt a system, you have to understand how it operates. And the system by which organised criminal networks recruit young people into financial exploitation is considerably more sophisticated than the phrase “social media scams” suggests.

This is not a story of naive young people stumbling into obvious traps. It is a story of deliberate, patient, and psychologically astute grooming, carried out at scale, through the platforms young people use every day, and often by people they already trust.

Where recruitment begins

Scammers use platforms such as TikTok, Instagram, and Snapchat to advertise fake job opportunities, often framed as “quick cash” schemes. Hashtags such as #EasyMoney, #CashFlipping and #Drops circulate alongside what appear to be testimonials from peers who have already “earned” through these channels. The messaging is calibrated to resonate: flexible, low-effort, risk-free income at a moment when many young people are acutely short of money.

Criminals exploit online platforms to recruit witting and unwitting victims, sometimes enticing them with financial incentives and misrepresenting the dangers of involvement. They downplay the harm caused by the criminal activity generating the illicit funds, and in many cases tell young people explicitly that what they are being asked to do is entirely lawful.

The initial ask is almost always presented as trivial. Let someone transfer money through your account. Hold funds for a short time. Take out a phone contract and pass on the device. There is no suggestion that anything illegal is occurring.

The escalation pattern

What recruiters understand, and what many institutions do not, is that the grooming process is not a one-off transaction. It is a graduated relationship, built on trust, obligation, and increasingly on fear.

The first “favour” establishes a pattern. A small payment confirms that it works. A second request follows, slightly larger. The young person is now, in the recruiter’s framing, a partner rather than a victim. They have received money. They have taken a step. The narrative shifts imperceptibly from “easy work” to “you’re already in this.”

By the time the young person attempts to withdraw, the dynamic has often changed entirely. Those found to be involved in financial exploitation can end up with a criminal record and face prison, a fine, or community service. They endanger themselves and those around them by communicating with dangerous criminals, and risk becoming complicit in serious and organised crime. But even before formal consequences arrive, the threat of exposure is itself a powerful mechanism of control.

The specific exploitation of financial vulnerability

Various factors are driving the rise in WUFE (Witting and Unwitting Financial Exploitation) including the increased ease of opening accounts, the high volume of transfers, and economic uncertainty, which makes people more susceptible to offers of quick, easy money.

This matters for practitioners. The profile of a young person susceptible to recruitment is not the profile of a “criminal type.” It is the profile of someone under financial pressure, with limited banking experience, digitally active, and socially connected to others who may already be involved. Those already financially vulnerable are most at risk. Warning signs for professionals include sudden inflows of money followed by immediate transfers out of the account, vague job offers mentioning “money handling” or “account use,” anxiety or reluctance to explain the source of incoming funds, unexplained cash machine withdrawals, and young people displaying sudden or unexplained wealth such as new phones, clothing, or cash that cannot be accounted for.

One organisation working to document and expose exactly these patterns is The Crooks Project, an initiative that transforms real crime cases into short docudrama episodes for young people. By working directly with those who have lived experience of exploitation, it has built a detailed, ground-level picture of how recruitment and escalation actually unfold. The phone contract scheme is one of the clearest examples it has surfaced.

A young person is told they can take out a mobile phone contract, hand over the device, and receive payment. They are reassured it can be cancelled, or that it will not appear on their credit file. In reality, they are left with the debt. Multiple contracts may be taken out in quick succession, each with the same assurances. The result is significant and lasting damage to the young person’s credit profile, with no recourse and no route back.

Why this is so hard to detect

The challenge for transaction monitoring teams is that the early stages of WUFE activity are, by design, difficult to distinguish from normal account behaviour. A customer being a student is not a red flag in itself. But if that customer suddenly starts to make surprisingly large transactions, it might be a sign of financial exploitation. The challenge is that by the time the transactions become anomalous, the grooming may already have been underway for weeks or months.

Multiple customers’ accounts being accessed from the same device can suggest that those accounts are now controlled by a single person. Reluctance during KYC checks is another indicator, though context matters significantly.

Detection is further complicated by the social dimension of recruitment. Criminals deliberately use peers as recruiters, identifying young people who are already deeply embedded in the network and deploying them to bring others in. To the person being approached, the ask comes from someone they know and trust, a friend, a classmate, someone from their social circle, which makes it far harder to recognise as a threat. The peer doing the recruiting may genuinely believe they are passing on a good opportunity. Or they may be operating under pressure themselves, with their own continued involvement contingent on expanding the network. Either way, the result is the same: the criminal organisation grows through relationships, not coercion, at least at first, and by the time a young person realises what they have been pulled into, they are already inside a structure that is very difficult to leave.

The scale of what is being missed

The nearly two million accounts involved in financial exploitation reported by 257 financial institutions in 21 countries in 2024 likely represent only a fraction of the accounts either in use or lying dormant within the world’s 44,000 financial institutions. The visible data is, by every informed estimate, the tip of a much larger problem.

For anti-financial crime professionals, the implication is clear: standard detection frameworks were not designed with this type of exploitation in mind. Understanding the human architecture of recruitment is not a soft-skills exercise. It is a necessary part of building detection approaches that work.
Become a WFFA member to access practitioner-led intelligence, expert briefings, and a peer network actively working to address the full complexity of financial crime.