Gaming currencies and skins

As of September 2026: The FATF gaming and gambling report and risk indicators were published on September 9, 2026, and the UK Gambling Commission published its 2026 money laundering risk assessment on July 30, 2026. Valve's October 2019 restriction covered CS:GO keys as announced then; current game policies may differ. The CFPB report is from April 2024. We found no prosecution that charges laundering of crime proceeds through in-game items, so this page describes fraud cash-outs and regulators' risk findings rather than convictions.

Also called: in-game currency laundering · video game money laundering · skin laundering · online gambling laundering.

What is gaming-currency laundering?

Many video games have their own money: coins, gems, points and other in-game currency. They also have items that other players want, such as weapons, character outfits and “skins,” which change how a piece of equipment looks. In some games these can be bought for real money, and in some they can be sold on again, either inside the game’s own market or on outside websites.

When virtual items can be turned into real money, they can be used to move value. That gives criminals a way to place funds, which is the first stage of laundering (see placement), and to add distance from the source by moving items between accounts (see layering).

This page also covers online gambling, because the two overlap. Online gambling sites and gaming platforms use the same kinds of payment methods, including e-wallets, mobile money and virtual assets, which FATF calls vulnerable to money laundering risks. The Financial Action Task Force (FATF) examined casinos, gambling and video gaming together in its 2026 project.

The frontier is newer and smaller than most techniques on this site, and the evidence has limits. What is well documented is fraud: stolen card details turned into cash through virtual items. What is less documented is the classic laundering story of drug or organised-crime money passing through a game. We say which is which below.

How does it work?

The pattern that regulators and researchers describe has four steps. It is described here at the level of public reports, not as a method.

1. Illicit value goes in. Most often this is a stolen payment card used to buy currency or items from the publisher’s official store. In the version researchers worry about, it could also be crime proceeds used to buy them directly.
2. The items are moved. The CFPB describes a person opening several accounts, buying gaming assets with illegal funds and sending the assets to other accounts. Each move breaks the link a little further.
3. The items are sold on a third-party marketplace or an informal channel such as social media, usually at a discount, to real players who want a bargain.
4. The seller is paid in fiat or crypto. The money now looks like the proceeds of selling game goods. If the original purchase was by stolen card, the card issuer later reverses it, and the cost falls on the publisher.

Gambling has its own version. FATF’s 2026 alert warns of criminals using gambling platforms to move money without actually gambling, and of “smurfing,” meaning many small transactions meant to stay under detection thresholds. As with casinos, the aim is a cash-out that appears to be gambling funds.

Why it works

Real value, low friction. In-game goods cost real money, so there is always a buyer. RUSI’s 2019 review noted that the trade in game items goes back decades. It cited an economist’s mid-2000s estimate that eBay was then trading about $30 million a year in in-game goods. Because the price is whatever a player will pay, a discount does not stand out.

Thin identity checks. A game account usually needs an email address and a payment method, not the identity checks a bank does. Third-party marketplaces may ask for even less. This is the same gap that appears with other prepaid and digital value.

Regulation has not caught up. RUSI wrote that online games are not regulated in the way financial services are, so there are no clear expectations of what operators must do to identify criminal activity. It argued that a game where items can be swapped for fiat currency looks like a virtual currency exchange, and said neither FATF nor FinCEN had stated whether in-game currencies fall under AML rules. The FATF’s 2026 project notes that the platforms and services around gaming, such as social media and digital marketplaces, may also sit outside regulation.

Cross-border by default. Players and platforms span countries with different rules. FATF said criminals and illegal operators exploit differences between jurisdictions, and that these differences create barriers to sharing information.

Scale. Small purchases are hard to notice. But the same thing that hides one purchase, its small size, is also a weakness. Publishers see every transaction, and a single ring buying thousands of items makes a pattern.

The evidence: Valve, Sixgill and the regulators

Fortnite V-bucks (January 2019). Sixgill, a security firm, reported that criminals were buying V-bucks with stolen bank card details from Fortnite’s official store and reselling them at a discount to other players on the dark web and through social media. Their report was covered by The Independent and OCCRP. RUSI’s review also cited a software company’s report of a group that used stolen cards to make many Apple accounts, bought items in mobile games and resold them on third-party sites for fiat currency. RUSI’s comment was that buying items with stolen cards is no different from buying any other goods with them, and that the payment processor bears the main responsibility for spotting it, though the game company may hold useful data.

CS:GO keys (October 2019). In Counter-Strike: Global Offensive, players use “keys” to open loot containers. Keys could be traded and sold. On October 28, 2019, Valve announced that keys bought in-game could no longer leave the purchasing account, so they could not be sold on the Steam Community Market or traded. Valve explained that most key trades it had seen were between legitimate customers, but that “worldwide fraud networks” had recently shifted to using CS:GO keys to liquidate their gains, and that nearly all key purchases that ended up traded or sold on the marketplace were believed to be fraud-sourced. This is a company’s own finding, not a court’s. Valve did not name anyone or give figures. But it is one of the clearest examples of a publisher changing its economy because of laundering-style abuse. It also cost legitimate players something: Valve said the change would affect some legitimate users.

The CFPB (April 2024). In its report on banking in video games, the US Consumer Financial Protection Bureau said the ability to transfer and convert gaming assets to fiat or crypto “has led to a proliferation of money laundering and fraud on gaming platforms.” It described the multi-account pattern above, and said such practices make illegal funds “less traceable with each step.” The report relies on academic work, not on prosecutions, so it is best read as a warning about a risk.

FATF (September 9, 2026). After a year-long project with contributions from more than 80 jurisdictions, FATF published risk indicators for gaming and gambling. It found illegal gambling to be one of the most significant risks, said illegal offshore operators often present themselves as legitimate businesses, and listed warning signs: multiple accounts and payment methods under different identities, discrepancies between customer and payment information, suspicious identity documents, and unusual betting patterns. The full case studies are shared only with public authorities.

A regulated example: 32Red and Platinum Gaming (March 2023). The UK Gambling Commission fined the two online operators £7.1 million in total for failures that included anti-money laundering weaknesses. It said 32Red’s financial triggers for AML review were set too high, and that one account was still allowed to deposit and gamble for two weeks after the deadline for an information request had passed, adding up to £16,280 gambled. The fine was for weak controls, not for a finding that the money was criminal.

How it gets caught

Publishers and payment companies do most of the catching. For stolen-card purchases, the card issuer’s chargeback is an obvious signal: the real cardholder disputes the charge, sometimes weeks later, and a cluster of disputes tied to one tradeable item points to a ring. Publishers can then look at the accounts that received the items, and at where those items were sold.

A platform that sees one player buy currency, send it to a new account and cash out has the data to act. RUSI pointed out that game companies hold information such as interactions with other players that can help identify a criminal or expose a network.

For gambling, the tools are the ones used in casinos: customer identification, source-of-funds checks, monitoring for deposits followed by little play and a withdrawal to another method, and reporting of suspicious activity to the financial intelligence unit (see suspicious transaction reports). Regulators fine operators that do not do this, as the 32Red case shows. The UK Gambling Commission’s July 2026 risk assessment reminds every licensee to update its own risk assessment.

The larger fix is design. Valve’s answer was to stop new keys from leaving the account, which removed the cash-out. Restricting how items can be traded or sold trades a little convenience for a lot less risk. See how detection works for the wider set of tools.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026