Characteristics of fraudulent Bitcoin transactions

Question

I have a few questions about Bitcoin fraud investigation.

1. What are the characteristics of fraudulent bitcoin transactions? For example, I've read some articles saying that a transaction that has only 1-2 inputs but comparatively too large number of output addresses (e.g. 60) can be considered suspicious because there's a chance that the transaction has been used for money laundering. I'd like to know which features I should look at in order to find fraudulent patterns in Bitcoin transaction data: transactions with the very small number of input counts but extremely large number of output counts, transactions with the extremely high number of input counts but small number of output counts, etc.

2. Which pattern would be more suspicious: a transaction that has 1 input count but 100 output counts OR a transaction that has 100 input counts but 1 output count?

3. Is there a way to extract geographic information of Bitcoin transactions? For example, there are some websites that show a world map that is color-scaled based on the number of transactions that have occurred in each country. I wonder how they get the geographic information of each transaction.

Answer 1

1 ... I've read some articles saying that a transaction that has only 1-2 inputs but comparatively too large number of output addresses (e.g. 60) can be considered suspicious

That doesn't seem right to me at all. There are many genuine and innocuous reasons for constructing such a transaction: an exchange batching withdrawals, paying dividends to shareholders, A football-pools consortium distributing winnings, a business paying employees, etc.

2. Which pattern would be more suspicious:

Neither

3. Is there a way to extract geographic information of Bitcoin transactions?

There is no geographic information in the transaction data.

With large scale forensic blockchain analysis, you might make some inferences but that would be unreliable guesswork.

An ISP could perhaps measure the number of TCP packets associated with port numbers typically used by Bitcoin's peer to peer protocols. E.g. TCP port 8333. Unless you are running Internet backbone infrastucture and interconnects, you won't have access to this. The results will be distorted by various factors such as use of TOR. This doesn't tell you the location of the person who constructed the transaction, only regions that are active in passing on Bitcoin data.

The notion is also a bit simplistic. If I have a business with offices in five countries and an employee in France connects to a computer in the USA to issue a payment from a Bitcoin node in Australia to the UK subsidiary of a business headquartered in Italy whose custodial wallet is run by an exchange based in the Seychelles, what country did that transaction, mined in China, take place in?