Technology & Digital Applications Flashcards

An agent reviewing wire transfer records notices transactions routed through multiple correspondent banks across different countries. This technique is known as:

Answer: Layering in a money laundering scheme

Layering is the second stage of money laundering, where funds are moved through complex transactions to distance them from their illegal origin.

What does OSINT stand for, and how is it used by Treasury Enforcement Agents?

Answer: Open Source Intelligence—gathering information from publicly available sources for investigative leads

OSINT involves collecting investigative information from public sources such as social media, court records, and news to build cases without legal process.

A suspect uses encrypted messaging applications to coordinate financial crimes. Under what legal authority can agents potentially access message content?

Answer: A Title III wiretap order issued by a federal judge for real-time intercepts, or a warrant for stored content

Title III authorizes real-time interception with court approval, while stored message content requires a warrant; both require judicial oversight.

Which of the following best describes a 'hash value' in digital forensics?

Answer: A unique numerical fingerprint generated from digital data used to verify file integrity

A cryptographic hash (e.g., MD5 or SHA-256) produces a unique value for a file; any alteration changes the hash, proving the evidence was not tampered with.

When a Treasury agent wants to track the financial activity of a known criminal organization, which automated system links financial reports filed under the Bank Secrecy Act?

Answer: FinCEN's FINCEN 314(b) information sharing program and analytical databases

FinCEN's databases aggregate BSA filings and allow investigators to identify financial networks linked to criminal organizations.

An agent discovers that a suspect has deleted financial records from a computer. What forensic reality is most relevant to recovering this evidence?

Answer: Deleted files often remain on the drive until overwritten and can frequently be recovered with forensic tools

Deletion typically removes only the file pointer; the actual data remains on the storage medium until new data overwrites it, enabling forensic recovery.

What is 'spear phishing' and why is it a particular concern in attacks targeting financial institutions or government agencies?

Answer: A targeted phishing attack using personalized details about the victim to increase credibility and success rates

Spear phishing uses victim-specific information to craft convincing deceptive messages, making it far more effective against high-value targets than generic phishing.