How Iran-backed militias exploited Visa and Mastercard to siphon dollars out of Iraq

The card scheme emerged as the previous system—wire transfers lacking anti-money laundering controls—was dismantled. Flaws in that framework, originally set up by the US after the Iraq War, had enabled militias and Iran to access billions of dollars over a decade. The abrupt switch to card-based arbitrage came almost immediately after that spigot closed.

By mid-2023, Iraqi cross-border card transactions had surged nearly 3,000%, with much of the volume linked to the exploitation of the gap between Iraq’s official exchange rate and its higher black-market rate. Militias and their partners would load up cards in Iraq, use them to withdraw dollars in neighbouring countries, then return the cash to Iraq and exchange it for dinars at a profit that at times reached 21%.

The resulting windfall was enormous. In 2023 alone, militia-linked cardholders made an estimated $450 million in profit from the scheme. Visa and Mastercard, which earn fees on international transactions, collectively made around $120 million from these activities, according to officials.

Warnings ignored, action delayed

Despite repeated warnings from the US Treasury beginning in mid-2023, Visa and Mastercard took several months to act. Even after Treasury officials revealed that militia-linked individuals were flooding Dubai ATMs with stacks of prepaid Iraqi cards, the companies delayed significant enforcement until March 2024.

In the meantime, militia groups expanded their operations—using fake transactions with foreign merchants, point-of-sale devices run through VPNs, and smuggling networks to move funds. Some merchants accepted fabricated purchases in exchange for cash, a cut of which was returned to the vendor. Others helped launder the transactions through jewellery stores and free-trade zone shops across the UAE and Turkey.

Iraqi government-backed cards also played a role. The Qi Card, used to pay salaries to government employees and militia members, became a central part of the scheme. Militias hoarded the cards of rank-and-file fighters and padded payrolls with ghost employees to obtain more cards, which were then used in the arbitrage cycle.

Global action and a crackdown—at last

Amid mounting pressure, Mastercard and Visa finally took sweeping actions in early 2024. Mastercard blocked over 100,000 cards and removed 4,000 UAE merchants from its network. Visa followed by flagging 70,000 potentially fraudulent cards and temporarily blocking thousands of foreign vendors. Iraqi regulators introduced a $300 million monthly cap on cross-border transactions and imposed a $5,000 per-cardholder limit.

The Central Bank of Iraq also hired a New York financial crimes firm to monitor the system and mandated that all card issuers operate through banks with US correspondent relationships. Several Iraqi issuers were removed from the Visa and Mastercard networks.

Treasury also blacklisted three card companies suspected of militia ties—including one affiliated with the Al Abbas shrine in Karbala, a major destination for Iranian pilgrims.

A cautionary tale of financial vulnerability

This episode has exposed deep vulnerabilities in global payment systems, especially in fragile or poorly regulated markets. In Iraq, where the economy remains largely cash-based and oversight is weak, the shift to digital payments came without sufficient safeguards—allowing armed groups under US sanctions to use Western infrastructure to bypass restrictions.

Though Visa and Mastercard maintain they responded promptly and worked closely with authorities, US and Iraqi officials say their delays allowed the fraud to scale into the billions. As the US seeks to preserve the dollar’s global integrity and tighten sanctions enforcement, Iraq’s payment system—and the companies operating within it—have become a stark warning of what happens when financial innovation outruns oversight.