A discovery packet in Montana named the Border Patrol unit that screens financial activity for stops

The line a payments team gives a customer who asks is that transaction records leave the building only on a lawful request, one account at a time. What the Montana filing describes sits at the other end of that sentence. Border Patrol Agent Matthew Phelps wrote that his job on the Spokane Sector team is to review law enforcement-sensitive databases, including Americans' financial activity, and hand the result to local police ^[5]. His account of this stop is that he saw "information contained within law enforcement-sensitive systems suggesting financial activity patterns commonly associated with illicit narcotics activity" ^[6]. That sentence is the whole documented mechanism.

Documented: one agent, one sector, one team name, one stop ^[15]. Not documented: the input end, meaning no bank, no processor, no broker, no contract, no record volume ^[12]. Techdirt reads the practice as bulk financial records shoved into a system whose output is reasons to pull people over, and calls it a fresh route into civil asset forfeiture ^[8]. The document quoted in that piece does not say bulk. A payments team has to hold both readings, because it cannot plan against the second without knowing the first.

Here is what teams tell themselves about pattern detection: it is a compliance obligation aimed at a small population doing something wrong, and the worst customer outcome is a frozen account and an apology. Here is what this record shows the output can be: a stop on the stated pretext of an obstructed license plate, a DUI charge ^[3], and then an attempt to convert the stop into drug trafficking charges ^[14]. Techdirt argues that competent money laundering produces financial activity that looks entirely normal ^[10]. The corollary for anyone tuning a model on transaction data is that a system rewarded for finding abnormality will mostly find customers whose cash flow is lumpy for dull reasons.

Government access to financial records held by third parties was already broad under the third-party doctrine, as Techdirt notes ^[9]. What changed in this record is who consumes that access and what they produce with it, which is a stop of someone not suspected of a specific crime ^[1]. The parameters the targeting teams use are not published ^[11], so no internal risk review can test whether a given customer profile scores.

The sort worth doing has two axes. First, whether you can name every downstream system that receives or mirrors your transaction records. Second, whether a user behaving normally can generate the pattern you would flag. Yes and no puts you in decent shape. No and yes puts you in the quadrant where Friday's honest answer to a customer is that you do not know and cannot find out. Inside that quadrant the only lever is what you retain and how coarse you keep it, because the flag is not something you get to see.