LIVE
TRACECHAIN™FORENSICS
FRAUD INTELLIGENCE · CASE FILES · GLOBAL SCOREBOARD
REPORT FRAUD Find your country and who to contact ▸🔍 Search cases, companies, countries, agencies
INTEL
PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED] / PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED]
◂ MIDDLE EAST & NORTH AFRICA◂ ALL REGIONS
🇮🇷

IRAN

State-backed hacking
CAPITAL Tehran · POPULATION 91.6M (2024, UN WPP est.)
FRAUD TYPES
State-sponsored hacking (Charming Kitten APT), ransomware source, cyber espionage
KEY FACTS
More source than victim. APT groups such as Charming Kitten target crypto exchanges. Hacktivism.
REPORT FRAUD IN IRAN1▸
No agency for Iran in our directory yet.
See all countries we cover ▸
Search the Report Fraud directory.
BORN HERE▸
Nobody in our case files was born in Iran yet.
OPERATED HERE▸
Nobody in our case files is documented as operating from Iran yet.
FRAUD METHODS TIED HERE2▸
From the Global Fraud Encyclopedia and the cases above. Tap a method for its page.
#3 RansomwareEncyclopedia ▸#22 PhishingEncyclopedia ▸
KNOWN FOR▸
State-bank embezzlementOil-revenue diversionRansomware extortionCrypto-enabled sanctions evasion
THE PICTURE▸

Iran's best-documented fraud cases are huge insider bank and oil-revenue embezzlements, including the $2.6bn Bank Saderat forged-credit scandal, for which businessman Mahafarid Amir Khosravi was executed in 2014 (RFE/RL, 2014). Iranian-based cybercriminals have also run extortion schemes abroad: in 2018 US prosecutors charged two men in Iran over SamSam ransomware, which allegedly caused more than $30M in losses (US DOJ, 2018). Iran is on the FATF blacklist, and its crypto exchanges are now a focus of sanctions. In June 2026 OFAC sanctioned Nobitex and three other exchanges that together moved at least $40bn, citing sanctions evasion and payments linked to the IRGC and ransomware (Elliptic/Chainalysis, June 2026). Enforcement at home depends on the judiciary and the FATA cyber police, and has included death sentences for large-scale economic crimes.

TOP FRAUDSTERS FROM HERE4▸
Babak Zanjani CONVICTEDREPORT PENDING
~$3bn (oil revenue not repaid, as reported; ~$2.1bn in assets later returned) · 2013–2024
Oil-sales middleman who failed to hand over billions in oil revenue he handled for the state while getting around sanctions; sentenced to death, which was later commuted.
SOURCE: Iran International, 30 Apr 2024
Mahafarid Amir Khosravi CONVICTEDREPORT PENDING
$2.6bn (fraudulent bank credit) · 2007–2011
Used forged documents to obtain credit from Bank Saderat and other lenders and used it to buy state-owned companies. It was Iran's largest fraud since 1979.
SOURCE: RFE/RL, 24 May 2014
Faramarz Shahi Savandi FUGITIVEREPORT PENDING
$6M+ ransom collected; $30M+ victim losses (per indictment) · 2015–2018
Charged with deploying SamSam ransomware from inside Iran against hospitals, cities and public bodies.
SOURCE: US DOJ, 28 Nov 2018
Mohammad Mehdi Shah Mansouri FUGITIVEREPORT PENDING
$6M+ ransom collected; $30M+ victim losses (per indictment) · 2015–2018
Co-defendant charged in the SamSam ransomware campaign against more than 200 victims.
SOURCE: US DOJ, 28 Nov 2018
FRAUD BY CATEGORY▸
No official body here publishes a breakdown of fraud by type, so we show none rather than guess.
KEY NUMBERS▸
$2.6bn Bank Saderat forged-credit scandal, the largest fraud case since 1979 (RFE/RL, May 2014)
$40bn+ Crypto moved by Nobitex, Wallex, Bitpin and Ramzinex (OFAC-sanctioned June 2026) (Elliptic, June 2026)
200+ SamSam ransomware victims (US indictment) (US DOJ, Nov 2018)
~$2.1bn Assets Babak Zanjani returned before his sentence was commuted (Iran International, Apr 2024)
WHO FIGHTS IT▸
Judiciary and Revolutionary Courts have given death sentences for large economic crimes (Khosravi, executed 2014; Zanjani, commuted to 20 years in 2024).
FATA cyber police (set up 2011) handles online fraud and phishing cases.
External pressure: FATF blacklist; US DOJ indictments (SamSam, 2018); OFAC sanctions on Iranian crypto exchanges (June 2026) and on the Shelbit/Aban Tether network (Aug 2026).
SOURCES▸
US DOJ press release, 28 Nov 2018
RFE/RL, 24 May 2014
Iran International, 30 Apr 2024
Elliptic, OFAC sanctions Nobitex, June 2026
US Treasury press release sb0598, 7 Aug 2026
Case lists and figures compiled September 2026 from court records, regulators and major press; statuses change. Series reports above are fact-checked case files.
🏠 HOME📁 CASES🚨 WANTED🎮 PLAY🌍 WORLD