Cartels Fund Operations via Timeshare Fraud
FBI warns that Mexican cartels, including CJNG, are running timeshare fraud scams that have cost American seniors over $300 million.
The FBI has issued a consumer warning describing a rise in timeshare fraud schemes targeting older Americans, with proceeds increasingly funding Mexican cartels such as the Jalisco New Generation Cartel (CJNG), the Gulf Cartel, and the Sinaloa Cartel. The scams unfold in three phases: an initial contact offering to help exit, rent, or sell a timeshare while extracting upfront fees; a follow-up phase impersonating law firms promising restitution; and a final phase impersonating government agencies (OFAC, Mexican FIU, INTERPOL) to extort further payments under threat of prosecution or asset seizure.
While primarily a social-engineering and financial fraud scheme rather than a technical intrusion, the operations do involve some cyber-enabled elements—spoofed emails mimicking legitimate institutions, forged documents, and networks of fake company websites and business registrations used to lend credibility to the scams. The FBI notes CJNG as the predominant cartel involved, though independent call centers in Mexico are also implicated. Over 6,000 victims have reported losses exceeding $300 million over the past five years.
The FBI, working with DEA, Treasury/OFAC, and private-sector financial partners, urges victims to report incidents quickly via IC3, noting that the first 12 hours after a fraudulent wire transfer are critical for potential fund recovery. The advisory is primarily a public-awareness and victim-reporting call rather than a technical threat bulletin.
Detection guidance
Credential Harvesting for Timeshare/Financial Accounts
Detects phishing landing pages or credential-capture forms mimicking timeshare, law firm, or government portals. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Credential Harvesting for Timeshare/Financial Accounts
description: Detects suspicious web requests to credential-capture or phishing landing
pages impersonating timeshare companies, law firms, or government agencies (OFAC,
INTERPOL, Mexican FIU). Generalises on the URL pattern mimicry and form submission
to unauthenticated endpoints rather than specific domain registrations.
tags:
- attack.initial-access
- attack.t1585.002
logsource:
category: proxy
product: windows
detection:
selection_url_mimic:
url|contains:
- timeshare
- ofac
- interpol
- fiu-mexico
selection_suspicious_endpoint:
url|contains:
- login.php
- auth.php
- signin.php
- verify.php
- confirm.php
selection_form_post:
http_method: POST
filter_legitimate_domains:
hostname|endswith:
- ofac.treasury.gov
- interpol.int
condition: selection_url_mimic and selection_suspicious_endpoint and selection_form_post
and not filter_legitimate_domains
falsepositives:
- Legitimate timeshare company login pages
- User accessing government authentication portals through bookmarks
level: medium
id: 749d243a-a2bf-5799-98fd-1760b6edfb6b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.fbi.gov/news/stories/mexican-cartels-targeting-americans-in-timeshare-fraud-scams-fbi-warns
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free