Iraq was a minor market for Visa and Mastercard a couple of years ago, generating just $50 million a month or less in cross-border transactions at the start of 2023. Then it exploded to around $1.5 billion in April that year, a 2900% increase almost overnight.
What changed? Iraqi militia groups figured out how to squeeze dollars on an industrial scale from Visa and Mastercard’s payment networks for themselves and for their allies in Iran, according to U.S. and Iraqi officials and documents reviewed by The Wall Street Journal.
The shift into cards came after the U.S. Treasury and the Federal Reserve Bank of New York in late 2022 shut down a gaping loophole being used for fraud— international wire transactions by Iraqi banks that lacked money-laundering safeguards. Flaws in that system, created by the U.S. during the occupation of Iraq, allowed Iran and the militia groups it supports to access billions of dollars over more than a decade.
After the U.S. finally closed that spigot, militias quickly found ways to profit from the card scheme.
The U.S. payment giants helped fuel the boom by signing up Iraqi partners to issue Mastercard and Visa-branded cash and debit cards, offering them financial incentives to boost transaction levels. In some cases, the Iraqi issuers had militia ties and inadequate fraud controls in a country known for rampant corruption, documents show.
Yet after being informed by Treasury of the armed groups’ involvement, the card companies took months to significantly rein in the transactions—which came down from their peak but still ranged from around $400 million to $1.1 billion a month until earlier this year. In an effort to get control of the card payments, the Central Bank of Iraq recently set a cap of $300 million a month, according to people familiar with the matter.
Iraq has both an official dollar exchange rate and a higher, unofficial rate. That means a person can buy prepaid cash and debit cards in Iraq, withdraw the money as dollars in other Middle East countries at Iraq’s official rate, and then return it to Iraq to convert it back into dinars at the unofficial rate. That generates gains that have reached as high as 21%.
The result has been a booming business for Iraq’s powerful militias, which arose with Iranian backing two decades or more ago and remain under U.S. sanctions because of attacks on American forces in Iraq and Syria. Mastercard and Visa have also profited, through charging 1% to 1.4% on cross-border transactions or more in some high-risk markets.
Iraqi cardholders engaging in the scheme are estimated to have made around $450 million in profit in 2023 alone, and the foreign card networks are estimated to have taken in nearly $120 million between them, a person familiar with the matter said. The revenues are estimated to have grown in 2024 since total transactions were up by around 60%.
The U.S. has waged a yearslong battle to block Iran and its proxies in Iraq from obtaining dollars , which violates sanctions levied over decades for its nuclear program, terrorism financing and other issues. Among others, Iran also supports Hamas in Gaza and Hezbollah in Lebanon, U.S.-designated terrorist groups.
The Iraqi militias acquired huge quantities of Mastercards and Visas loaded with funds, transported the cards to the United Arab Emirates and other neighboring countries and withdrew the money, Treasury officials informed the card companies last fall. The armed groups then transferred the cash back to Iraq, exchanged it for dinars and profited from the currency arbitrage, Treasury said.
The graft likely financed their operations, paid for weapons or just lined their pockets.
Other permutations of the currency-exchange scheme also take place, all making use of the difference between Iraq’s official and unofficial dollar-exchange rate.
In recent days, Treasury formally asked the Iraqi central bank to block the more than 200,000 cards used by militia members due to fraud concerns.
The Trump administration, which has been holding high-level nuclear talks with Tehran since April, has taken new steps to cut off Iran’s access to hard currency , including by targeting ships it uses to sell oil in violation of sanctions and by restricting its access to dollars from neighboring Iraq.
Iraq’s most potent Iran-backed militias, including the Badr Brigade, Kataib Hezbollah and Asaib Ahl al-Haq, have the clout within Iraq’s government and financial sectors to help Tehran circumvent sanctions, forming what Treasury Secretary Scott Bessent in April called a “clandestine network of financial facilitators.”
“In line with administration priorities and to preserve the strength of the U.S. dollar, Treasury will continue to be vigilant about threats to the U.S. financial system, including by Iran-aligned actors,” a department spokeswoman said about its efforts to rein in Iraqi cash- and debit-card activity.
U.S. and Iraqi officials said warnings to Visa and Mastercard about the militias’ role in the soaring cash- and debit-card payments went mostly unheeded for months.
Federal Reserve Bank of New York and Treasury officials began asking Visa and Mastercard to explain the rising transactions in May 2023, the U.S. and Iraqi officials said. They held regular meetings about the Iraqi market that also included Iraqi central bank officials in 2024 and early this year. The card companies began taking significant action in March.
The Iraqi card issuers that partnered with Visa and Mastercard weren’t under sanctions, and there is no public allegation that Visa or Mastercard violated any sanctions.
The companies, which have a roughly equal split of the Iraqi market, said they acted promptly to limit transactions after finding evidence of fraud.
“Ongoing government engagement is built into our programs so that we can quickly look into claims, identify the situation and take action as appropriate,” Mastercard spokesman Seth Eisen said. “That’s exactly what we have done with the U.S. government on this matter from a very early stage.” He said the Iraqi government is working to digitize its economy, which results in more electronic payment transactions.
Fletcher Cook, a Visa spokesman, said: “Central to our operations is a commitment to ensuring that transactions on our network do not violate the law…When we identify or are alerted to any suspicious or illegal activity, we take action.”
Lined up at ATMs
To keep money flowing through the economy after the international wire transactions crackdown, the Central Bank of Iraq in early 2023 permitted payments with cash and debit cards outside Iraq to be made at the official conversion rate—currently 1,320 Iraqi dinars to the dollar—a cheaper price for dollars than the rate available in Iraq’s currency markets. That supercharged the use of cards for currency arbitrage.
Militia couriers smuggled the cards into U.A.E., Turkey and Jordan. There they withdrew cash from ATMs—witnesses described Iraqis lined up day and night at ATMs in Dubai with stacks of prepaid cash cards, inserting one after another.
They moved the money back to Iraq, either through the informal Middle East money-transfer process known as hawalla or by electronic transfer between bank accounts. The funds were then exchanged for dinars in currency markets at the higher unofficial rate—close to 1,600 dinars to the dollar at its high point in 2023—resulting in a profit. The exchange-rate spread has fallen in recent months, to about 1,400 dinars to the dollar.
Regulators in Iraq and U.A.E. limited daily withdrawals and cracked down on the card smuggling. In one case, more than two dozen Iraqis carrying a total of around 1,200 cash cards loaded with more than $5 million were arrested at Iraqi airports and border crossings. An Iraqi traveler was arrested at the airport in the city of Najaf with 300 bank cards hidden in cigarette packs in his luggage. In another, multiple Iranians and Iraqis were caught by border guards while attempting to smuggle Mastercards to Iran.
The militias adjusted, and began persuading merchants in the other countries with access to Visa and Mastercard networks to run fake purchase transactions in return for a kickback.
In an example described by bankers familiar with the scheme, a luxury-goods store in the U.A.E. charges a Visa or Mastercard cash or debit card $5,000, even though no merchandise changes hands. In return for a 5% payment, the shop gives the cardholder the $5,000 in cash or the equivalent in U.A.E.’s currency, the dirham, which is pegged to the dollar. The card company debits the card at the official Iraqi dollar rate. The funds then move back to Iraq for the market exchange.
The militias often use the funds to repeat the process over and over, profiting at every cycle.
Eventually, the scammers acquired hand-held “point of sale” machines, commonly used by restaurants and retail merchants, for themselves, the Iraqi and U.S. officials said. At so-called POS farms, they processed fake transactions on dozens of the devices, using virtual private networks to disguise their locations, the officials said.
Iraqi officials said they didn’t have adequate controls in place to prevent what they called rampant fraud. U.S. authorities also didn’t immediately see the flaws in the system, in part because card settlements are much less scrutinized than regular wire transfers, they said. Iraq was especially vulnerable to the card schemes because of loose controls on card issuers and an economy that remains largely cash based.
Authorities have had success blunting the exchange-rate ploy in some areas.
Officials saw a similar spike in funds moving out of Iraq through fund-transfer companies Western Union and MoneyGram. Transfers using those companies exceeded $1 billion in March 2023, soon after the crackdown on bank-to-bank wire transfers, and rose to $1.7 billion in June. When Western Union announced its second-quarter financial results in July 2023, it raised its full-year revenue forecast “primarily to business performance in Iraq.”
The company also disclosed it was having “regular discussions with policymakers in both the U.S. and Iraq about the elevated remittance volumes flowing through its network in Iraq.”
Alarmed U.S. and Iraqi regulators imposed new limits on monthly transfers for the two U.S. money-transfer companies. At authorities’ urging, Western Union and MoneyGram closed accounts at numerous Iraqi banks. The moves drove down monthly outflows from Iraq to $110 million by October 2024.
Western Union declined to comment, and MoneyGram didn’t respond to requests for comment.
After Baghdad’s First Iraqi Bank began offering an instant money transfer service known as Visa Direct in early 2024, it prompted a torrent of cash transactions to accounts linked to other Visa cards. Over two months, the bank’s Visa cardholders sent $1.2 billion to Dubai, Turkey and other places, according to a person familiar with the matter. One cardholder repeatedly transferred more than $5 million a day to 11 accounts in Indonesia, the person said.
Treasury and the Fed raised concerns about the huge transfers, and Visa halted the bank’s use of the service after 10 weeks. Visa and First Iraqi Bank didn’t respond to questions about Visa Direct.
Clear picture of fraud
But stopping individual products did little to dent the overall fraud, and the card business grew. The number of Iraqi issuers licensed to offer prepaid or debit cards rose from five to 17 from 2017 to 2024, a person familiar with the matter said.
U.S. officials were especially concerned about one of Iraq’s most widely held debit cards, known as Qi Card, a partner with both Mastercard and Visa that covers around half the market. Transactions using the card went up from around $10 million a month in early 2023 to more than $500 million a month by the beginning of this year.
Under a contract with a state-owned Iraqi bank, the card has been used to distribute salaries to millions of pensioners and government employees, including militias. The Popular Mobilization Forces, an umbrella organization of militia groups, was put on the government payroll a decade ago when Islamic State fighters swept across large parts of northern and western Iraq in 2014. After its U.S.-trained army largely collapsed, the Baghdad government turned to private armed groups, mostly Iraqi Shiites, in an emergency move to fight along U.S. forces.
As part of the arbitrage scheme, militia commanders took possession of rank and file members’ cards, and also padded the rolls with nonexistent or no-show troops to obtain more cards, an Iraqi banker said.
Even though Islamic State was largely defeated in 2019, the Popular Mobilization Forces have grown steadily more powerful within government and financial sectors. More than 200,000 militia members were receiving salaries on Qi Card, a foothold that U.S. and Iraqi officials said the militias used to become major players in the illicit card activity. That spurred a request in recent days from Treasury to the Iraqi central bank to block Qi cards issued to militias.
Qi Card’s Iraqi parent company, International Smart Card, said it “no longer provides any services to the PMF.”
Bahaa Abdul Hadi, the company’s 55-year-old founder, said it has taken other steps to reassure Treasury and the Fed that no one who receives a Qi Card is under U.S. sanctions and that militia members hadn’t received Qi Cards that can be used outside Iraq. “The only service provided to PMF cardholders was the transfer of outbound salaries from their employer,” the company said.
U.S. and Iraqi officials said funds paid to the militias could easily be moved to other cards that do work outside of Iraq.
Data tracking Iraqi cross-border card use overall painted a clear picture of fraud, the officials said.
One out of every five transactions by foreign cardholders in U.A.E. in 2024 involved an Iraqi debit or cash card, even though only one out of every 250 travelers to the country was from Iraq, according to a person familiar with the matter.
Most of the Iraqi payments involved little-known businesses in foreign trade zones or high-end jewelers, instead of the hotels, restaurants and tourist attractions where foreigners who travel to Dubai and other U.A.E. cities typically spend money. More alarming was that vendors did almost all of their business only with Iraqi-issued cards, month after month.
Visa, Mastercard action
When a Mastercard Global Compliance Team conducted a virtual review in August 2023 of Yana Banking Services, a card provider based in Erbil, it found no evidence that customers were being screened to ensure they weren’t under U.S. sanctions, a requirement under its licensing agreement with Mastercard.
The review also found “ineffective suspicious activity monitoring and reporting” aimed at preventing fraud, as well as ineffective anti-money-laundering safeguards. “No customer risk rating is performed, and no risk ratings were reflected on eight cardholder and three merchant files tested during the review process,” according to Mastercard’s findings, which were reviewed by the Journal.
Yana was banned from issuing new Mastercard-branded cards until it corrected what the review described as “high priority” violations. The suspension was later lifted after the problems were addressed, according to a person familiar with the matter.
“The goal is to ensure they avoid further violations of Mastercard standards or regulatory requirements,” said Eisen, the Mastercard spokesman. “We reserve the right to revisit any allegation to ensure this compliance.”
Yana didn’t respond to requests for comment.
The enforcement accelerated this spring. In March, Mastercard blocked more than 100,000 Iraqi-issued cards and removed 4,000 merchants in U.A.E. from its payment network suspected of involvement in fraudulent Iraqi transactions. Half of the cards were issued by International Smart Card, U.S. and Iraqi officials said.
Information about Qi Card and International Smart Card that Mastercard received from government agencies “was compiled with existing information and actioned accordingly,” Eisen said.
In April, Visa sent alerts about potential fraud for 70,000 Iraqi cards and barred around 5,000 U.A.E. vendors, temporarily blocking their use.
Some of the cards were later reactivated after Mastercard and Visa concluded their charges were legitimate, according to a person familiar with the matter.
The companies and authorities have started blocking some of the 17 Iraqi card issuers, cutting the total by about half.
Along with the $300 million monthly cap on the country’s total cross-border transactions, the Central Bank of Iraq imposed a monthly $5,000 cap per cardholder. It also hired K2, a New York financial crimes advisory firm, to monitor card transactions and required every card issuer to shift to an Iraqi bank with a correspondent U.S. bank, officials said.
Treasury has taken sweeping action on its own, blacklisting three Iraqi card issuers suspected of ties to the militias. All three were Visa or Mastercard partners.
One of them, Al Saqi Electronic Payment Company, is affiliated with the Holy Shrine of Al Abbas, a golden-domed Shia mosque in Karbala, Iraq. Every year millions of pilgrims, many from Iran, visit the shrine. Al Saqi didn’t respond to requests for comment.
Visa has stopped processing Al Saqi cards on its payment network. The Iraqi company’s website, though, still features pictures of Visa cards, promising customers “all the advantages offered by Visa, including ease of use, global acceptance, and high-security standards.”
