U.S. whistleblower says Mastercard, Visa failed to stop payments for child sex abuse material on OnlyFans

Paysafe

24/01/2025 11:00

By Andrew R.C. Marshall, Linda So
       Jan 24 (Reuters)  - 
    Mastercard and Visa failed to stop their payment networks
from laundering proceeds from child sexual abuse material and
sex trafficking on the popular website OnlyFans, according to
allegations in a previously undisclosed whistleblower complaint
filed with the U.S. Treasury’s financial crimes unit.
  
    The whistleblower, a senior compliance expert in the credit
card and banking industries, said the two giant card companies
knew their networks were being used to pay for illegal content
on the porn-driven site since at least 2021, and accused them of
“turning a blind eye to flows of illicit revenue.”
  
    The complaint was filed in January 2023 with the Treasury’s
Financial Crimes Enforcement Network (FinCEN) and the U.S.
Justice and Homeland Security departments, the whistleblower
said. 
  
    The complaint said that the whistleblower and other
anti-trafficking experts, including U.S. federal agents, alerted
Visa and Mastercard to unlawful content on OnlyFans in a series
of calls in 2021 and 2022. The federal agents corroborated the
presence of child sexual abuse material on OnlyFans, the
complaint said. 
  
    It also drew heavily on a 2022 study by an anti-trafficking
group that said it had found a “high volume” of OnlyFans
accounts with “common indicators” of child sexual abuse material
or sex trafficking. The whistleblower said he helped with the
study, which was shared with the card companies. 
  
    On OnlyFans, Visa and Mastercard process payments between
content creators and their customers. When the content is child
sexual abuse material, the card companies are “directly handling
the proceeds of these illicit transactions,” said the
complaint. 
  
    By continuing to process payments on OnlyFans,
     
    Mastercard and Visa had “willfully failed” to maintain
effective anti-money laundering programs required by the Bank
Secrecy Act, said the complaint, which urged FinCEN and the two
other federal agencies to take action against the card
companies. 
  
    Reuters reviewed an email confirming FinCEN had received the
complaint. In response to questions, the agency said it doesn’t
confirm or deny the existence of whistleblower complaints. The
Justice and Homeland Security departments declined to comment. 
  
    Reuters could not determine what action, if any, the
agencies took in response to the complaint, which was filed
under FinCEN's anti-money laundering whistleblower program
launched in 2021. Under that program, complaints are
confidential and the identity of whistleblowers is protected.
However, Reuters reviewed the complaint, interviewed the
whistleblower on condition of anonymity, and corroborated his
identity and credentials. The complaint said he had extensive
expertise in fighting money laundering.
  
    In an interview, the whistleblower said the agencies never
contacted him to discuss his complaint. The card companies had
“the power to turn off the switch” to stop illicit material from
being monetized, he added. 
  
    Mastercard and Visa said they hadn’t heard of the 2023
whistleblower complaint until Reuters contacted them. They
disputed the complaint’s allegations and cited their efforts to
keep their networks free of illegal activity. 
  
    A Visa spokesperson said financial institutions and
merchants that don't comply with Visa’s “robust compliance
requirements” will be terminated from its network. The company
uses “best-in-class controls to deter, detect and remediate
illegal activity,” the spokesperson said. 
  
    Mastercard holds all users of its payments system to high
standards and, “if illegal activity is identified, we work with
partners to act,” its spokesperson said. The three government
agencies hadn’t “referred any specific illegal activity for us
to investigate or act on,” the spokesperson added.
     “No evidence of current illegal activity has been provided
to us,” despite the whistleblower’s claim, the spokesperson
said.
  
    The spokesperson denied that Mastercard had “failed” to
maintain effective anti-money laundering programs. The company
has “strong governance standards through a comprehensive
compliance program and strong internal controls,” he said.
  
    Since the whistleblower complaint was filed, Reuters
uncovered more 
    allegations of child sexual abuse and sex trafficking on
OnlyFans
    , a porn-driven site that generates money through
subscriptions and pay-per-view content. 
  
    In July, the news organization reported that
     
    hundreds of sexually explicit videos and images of minors
    , some as young as toddlers, have appeared on the site since
2019, according to allegations in police complaints. In
December, a child exploitation investigator told Reuters that he
reported 
    26 OnlyFans accounts to authorities
     that appeared to contain sexual content featuring underage
teen girls. The accounts were quickly taken down, said the
investigator. Another story focused on
     women who said they had been sexually enslaved
    , sometimes by a fiancé or boyfriend, to make money on the
platform. 
  
    The Mastercard spokesperson called Reuters’ findings on
child sexual abuse on OnlyFans “alarming” but said law
enforcement or certain child-protection groups would need to
provide evidence of illegal activity for the company to act or
investigate. Visa didn’t comment on whether the company was
investigating Reuters’ findings.
  
    UK-based OnlyFans didn’t respond to questions about the
whistleblower complaint. On its website, the company says it
enforces a “zero-tolerance policy” against any content related
to child abuse or trafficking, and blocks or takes down material
that violates its rules. It said it also reports illegal content
to law enforcement and child-protection groups. In a previous
statement, OnlyFans told Reuters it works to “aggressively
target, report, and support the investigations and prosecutions”
of anyone who abuses the platform.
  
    OnlyFans is one of the world’s fastest-growing and most
lucrative creator platforms. It relies heavily on payment cards
to process subscriptions, tips and other transactions between
its more than 300 million users and its four million content
creators. Its surging profits have made it a leader in the
creator economy. In September, OnlyFans reported $6.6 billion in
gross payments to creators, up 20% from the year before. It made
$1.3 billion in revenue. 
  
     
    ‘UNCOMFORTABLE IMAGES’
  
    Many porn websites are free and make money mostly from
advertising. OnlyFans, by contrast, takes a 20% cut of the
income its creators earn from selling content to subscribers,
who must enter their card details to pay for it.
  
    OnlyFans accepts cards by Mastercard, Visa, Discover and
some of their partners. In certain countries, it allows other
options such as online payments provider Paysafe, which didn’t
respond to a request for comment. 
    American Express can’t be used on OnlyFans under a
longstanding global policy that prohibits its cards from being
used for online adult content, a s
    pokesperson said. Payment services such as Apple Pay and
Google Pay also have similar policies against online porn
transactions.
  
    In the U.S., OnlyFans’ main market, Visa and Mastercard
account for the vast majority of all card purchases, according
to industry data. The complaint did not make any allegations
against Discover, saying its small market share meant it was
“unlikely to be one of the main payment methods used on
OnlyFans." 
    A spokesperson for Discover declined to comment.
  
    In 2020, Visa, Mastercard and Discover blocked customers
from using their cards to make purchases on Pornhub, another big
adults-only platform, after a public outcry over alleged child
sexual abuse material and other illegal content
    . This stopped card payments for Pornhub’s paid content and
forced it to rely more on ads and sales of user data.
  
    In May 2021, the BBC 
    detailed several cases of explicit videos of underage teens
on OnlyFans. Three months later,
     102 members of Congress 
    called for a Justice Department investigation into alleged
child sexual abuse material on OnlyFans. The department declined
to comment on the status of that request.
  
    In November 2021, senior executives at Mastercard held a
tense call with a group of anti-trafficking experts, some of
whom wanted the company to cut ties with OnlyFans, according to
a person who attended. 
  
    The site was hosting child sexual abuse material, the
experts told the Mastercard executives. And one expert – a U.S.
federal agent – said he could prove it. During the call, said
the attendee, the agent accessed an OnlyFans account with
sexually explicit images of what he said was a young girl. The
agent described the images to others on the call but didn’t
share them, which would have been illegal. 
  
    Mastercard told Reuters that its team had one call with a
group in which “explicit and uncomfortable images” were
discussed but said it couldn’t confirm when the call took place.
Afterward, the card company requested that all financial
institutions connecting OnlyFans to its payment network confirm
the site’s compliance with "our standards and applicable law,”
the Mastercard spokesperson said.
  
    “Each of them affirmed that status,” he said, without
identifying the institutions.
  
    In April 2022, the Anti-Human Trafficking Intelligence
Initiative (ATII), a U.S. nonprofit, published its study which
the whistleblower complaint drew upon. ATII, whose work includes
identifying illegal content online, reported that it had
discovered numerous OnlyFans accounts with indicators of child
sexual abuse material or sex trafficking. 
  
    The indicators included keywords and images found by
searching the publicly available profiles of OnlyFans creators,
said the ATII report. With these methods, researchers uncovered
a “tremendous amount of troubling material” on the platform, it
said. The whistleblower said he reviewed the report, which notes
the anti-money laundering duties of financial institutions,
before publication to ensure it reflected industry practice.
  
    ATII’s investigation was shared with Mastercard and Visa,
the whistleblower complaint said. The companies didn’t respond
to questions about the ATII report. ATII declined to comment.
  
     
    ‘BUSINESS AS USUAL’
  
    Both Mastercard and Visa have tightened their rules around
porn sites in recent years. In October 2021,
     
    Mastercard introduced stricter rules aimed at "preventing
illegal adult content on our network." They were prompted by the
ease with which people could now upload content to the internet,
said John Verdeschi, a senior vice president, in a 
    statement
     at the time.
  
    Under those rules, merchants of adult content – in this
case, OnlyFans – were required to verify the identity and age of
people featured and obtain written consent from everyone
depicted. The rules also required porn sites to produce monthly
reports that flag “potentially illegal” content and send those
to banks that process Mastercard payments.
  
    In an interview in August that year with the Financial
Times, OnlyFans founder and then-CEO Tim Stokely said his
platform was “already fully compliant” with the Mastercard
requirements. 
  
    In 2023, Visa also introduced stricter rules for its “high
integrity risk merchants.” This included adult-related
businesses, dating services, gambling and pharmacies. Under the
rules, banks were expected to more closely monitor merchants to
prevent illegal transactions.
  
    The whistleblower complaint said the card companies appeared
to be shifting the blame for processing payments related to
child sexual abuse material onto banks “while carrying on with
business as usual.” Visa and Mastercard did not comment on that
assertion. 
  

(Marshall reported from London. So reported from Washington.
Additional reporting by Nupur Anand in New York. Editing by
Julie Marquis and Jason Szep)