Following the money has long been a core pillar of the fight against organized crime. But many criminal groups are adapting faster than the measures designed to disrupt them. Identifying those who profit from illicit business is no longer enough. The key now lies in tracing the payments and services that enable the wider criminal ecosystem to function.

This was a major topic of discussion in New York in July, during the UN Office on Drugs and Crime (UNODC)’s World Day Against Trafficking in Persons. Issues raised ranged from online scam centres to gang economies in Haiti, and a common theme emerged: organized criminal operations depend on financial and logistical support that often extends well beyond those directly carrying out the offences.

During the event, some participants highlighted progress already made. Representatives from INTERPOL, for instance, described new tools for interrupting payments and identifying criminal assets, and various member states outlined recent legal reforms that support asset investigations and seizure, as well as enhanced international cooperation. Banks and other financial institutions noted that unusual payroll payments, linked accounts, shared IP addresses and phone numbers can reveal connections between seemingly separate criminal groups.

These developments highlight the value of looking beyond the proceeds of crime to consider how contemporary criminal markets operate as ecosystems. Scam centres, for instance, may function as individual offices or compounds, but they are also often nodes in much larger networks that share recruitment systems, victim data, technology, money laundering services and political protection. Technology and crime-as-a-service models enable these operations to target victims across borders and languages at a relatively low cost.

At the same time, these criminal organizations remain heavily dependent on human labour. Some workers are complicit, while others are recruited through fraudulent job offers or deceptive recruitment practices. It is estimated that 300 000 people from 66 countries have been trafficked into scam compounds in South East Asia alone.

Before profits from illicit businesses are laundered, payments are made for various activities, including recruitment, transport, property, telecommunications, data, software, payroll and protection. Some legitimate companies may be complicit in providing these services, others do so unknowingly. Tracing these operating costs, together with digital and corporate information, can help reveal connections between seemingly unrelated accounts and businesses. This strategy can also help identify enablers used by several operations, which may be more valuable to disrupt than a single bank account or visible compound.

Taking a broader approach to following the money through an organized criminal ecosystem means working backwards through the criminal enterprise to identify those who paid the recruiters, supplied the technology, transported the workers, received rent or protection payments, and converted or laundered the proceeds. As banks, technology companies and law enforcement agencies often only hold fragments of this information, it is crucial to share intelligence across sectors and jurisdictions.

This kind of collaboration can help disrupt payments at various stages of an illicit operation, thereby increasing the operating costs for criminal groups. Recovered assets can also support victim assistance and reintegration.

The recommendations recently shared by the UN Convention Against Transnational Organized Crime (UNTOC) Working Group on Trafficking in Persons and the first UN Commission on Crime Prevention and Criminal Justice resolution addressing trafficking for forced criminality are relevant in this context. Recognizing forced criminality as a trafficking issue can prevent investigations from stopping at the coerced workers who carried out the fraud. It would also draw attention to those who control labour, arrange payments and profit from exploitation. In this view, victim identification and financial investigation would complement each other rather than being treated as separate objectives.

The blurred line between victim and offender, which is increasingly emerging in scam operations involving trafficking and coercion, also has a financial dimension. Low-level workers who handle accounts or payments are still frequently prosecuted for fraud they were forced to commit. Applying the non-punishment principle and improving victim identification would shift the focus of investigations towards managers, recruiters and financial decision-makers. Using proceeds recovered from criminal assets to support survivors would also help to align financial investigations with protection, while reducing the likelihood of victims being recruited back into criminal operations.

An ecosystem approach is also important because scam centres are known to adapt when enforcement increases. Closing one compound may simply result in the operation being relocated elsewhere. Financial intelligence should therefore monitor changes in recruitment routes, company registrations, property use and demand for digital or financial services in new or emerging locations. This can help to identify displacement earlier, including cases where management, workers, infrastructure and proceeds are spread across different jurisdictions.

The same logic can be applied to Haiti’s governance crisis. The gangs in Port-au-Prince generate revenue through cocaine and firearms trafficking, but also through the control of transport, fuel and food distribution, corruption and money laundering. A broader financial analysis could reveal how income from one market finances another, or is channelled into legitimate businesses and protection networks. This would provide a clearer picture of how the gang economy holds together. Eliminating the visible offenders without disrupting the financiers, facilitators and markets behind them would leave the overarching system intact, allowing it to adapt and recover.

As recent UN meetings have made clear, there is a growing awareness of the importance of following the money across an organized criminal ecosystem. However, this approach requires a shift in focus. It means connecting financial data with information on recruitment networks, corporate records and digital infrastructure. Governments, financial institutions, technology companies, international organizations and civil society all have access to different parts of this system. Bringing these insights together will be critical to strengthening international cooperation against increasingly complex and sophisticated criminal networks.