The Ponzi Machine White-Collar Crime · Crime Lab 7 · Midwestern State University

A Ponzi scheme is a promise that cannot be kept, financed by the people who have not yet found that out. Charles Ponzi's 1920 notes paid 50 percent in 45 days; Bernard Madoff's statements paid about 10 percent a year for decades; Allen Stanford's certificates of deposit paid a premium over U.S. bank rates for twenty years; FTX promised nothing at all except that customer deposits were held in custody. All four ended the same way, when the money going out exceeded the money coming in. This lab gives you the machine itself, with the levers that set how fast it runs and how long it lasts, so you can see why collapse is arithmetic and why the arithmetic can take twenty years. Then it turns to the fraud that dwarfed all of these, the mortgage securitization industry of 2003 to 2008, where the firms were real, the products were real, and 32 of the 60 largest firms settled fraud claims anyway.

Four schemes, one mechanism

Each of these paid earlier investors with later investors' money, or with money that belonged to customers, and each ended when withdrawals outran deposits. The figures are what the courts, trustees, and prosecutors established.

Charles Ponzi, Boston, 1920
The promise: 50 percent in 90 days, then 50 percent in 45 days, supposedly from arbitrage in international postal reply coupons. The run: about $15 million from roughly 40,000 people in eight months. The end: a Boston Post exposé on July 24, 1920, a run on the office two days later, arrest on August 12. Note holders got back less than 30 cents on the dollar. Convicted of larceny, imprisoned, deported.
Bernard L. Madoff Investment Securities, New York, to December 2008
The promise: steady returns of roughly 10 to 12 percent a year, in every market. The size: the last statements showed $64.8 billion; the cash investors had actually put in and not taken out was about $17.5 billion. The end: redemption requests in the 2008 crisis exceeded the cash on hand, and Madoff confessed in December 2008. As of August 2026 the trustee had recovered $15.5 billion and distributed $14.8 billion to customers, measured by cash in minus cash out.
Stanford International Bank, Antigua, 1990s to 2009
The promise: certificates of deposit paying a premium over U.S. bank rates, backed by conservative investments. The size: about $7 billion from depositors. The use: billions diverted to Stanford's own money-losing businesses, a 112-foot yacht, six private planes, and gambling. The end: the SEC sued in February 2009; convicted on 13 of 14 counts and sentenced on June 14, 2012, to 110 years.
FTX and Alameda Research, 2019 to November 2022
The promise: customer deposits "kept safe" and "held in custody." The mechanism: code that let Alameda withdraw effectively unlimited amounts of customer cryptocurrency; more than $8 billion of customer money spent on investments, loans, real estate, and political donations. The end: a run on withdrawals in early November 2022 that the exchange could not meet. Bankman-Fried was convicted on seven counts and sentenced on March 28, 2024, to 25 years with $11 billion in forfeiture; the Second Circuit affirmed on June 12, 2026, calling the evidence "conservatively stated, robust."

Sources: Darby, M. (1998), In Ponzi we trust, Smithsonian, December 1998, and In re Ponzi, 268 F. 997 (D. Mass. 1920), as quoted in Baker and Faulkner (2003), pp. 1173-1174; Madoff trustee (madofftrustee.com), recovery and distribution figures as of August 21, 2026, and the trustee's net equity determination upheld in In re Bernard L. Madoff Investment Securities LLC, 654 F.3d 229 (2d Cir. 2011); FBI Houston, press release, June 14, 2012 (Stanford); U.S. Attorney's Office, Southern District of New York, press release, March 28, 2024, and United States v. Bankman-Fried, 2d Cir., June 12, 2026, as reported by Courthouse News Service.

Cash in, cash out

When a scheme collapses, the paper balances are fiction and the only real numbers are what each investor put in and took out. The Madoff trustee called this net equity, paid claims on that basis, and pursued investors whose withdrawals exceeded their deposits for the difference. Before you run the machine, guess one number.

Of the roughly $17.5 billion in principal that Madoff's customers lost, what share had the trustee recovered by 2026?

About 88 percent: $15.5 billion recovered against $17.5 billion lost. Most of it did not come from Madoff. It came from settlements with the people and funds who had taken out more than they put in, the net winners, and from the banks and feeder funds that had moved money into the scheme. This is the arithmetic of a Ponzi scheme seen from the other end: every dollar an early investor withdrew as profit was a later investor's principal, and the law can sometimes get it back. The $64.8 billion on the final statements never existed and is not part of any recovery.

What this means for the machine. On the next tab, the line for reported balances is the $64.8 billion; the line for cash on hand is what is actually there; the gap between them is the hole. The cohort chart at the bottom sorts investors by the year they came in and shows who ended up a net winner and who a net loser. Watch how the winners are always the earliest years.

The machine

Every month the machine takes in new money, keeps the operator's cut, pays whatever real return the assets earn, credits investors' statements with the promised return, and pays out the withdrawals investors request as a share of what their statements say they have. It runs until the month the withdrawals exceed the cash, or for fifty years. You set the promised return, what the money really earns, the size and growth of new money, the operator's cut, the withdrawal rate, and, optionally, a month in which confidence breaks: new money drops to a tenth and withdrawals spike for six months. Run the four named settings, then change one lever at a time. Each run is logged for your submission.

Promised return, percent per year

11

What the money really earns, percent per year

1

New money in the first month, $ millions

60

Growth of new money, percent per month

0.4

Operator's cut, percent of new money

1

Withdrawals, percent of balances per month

0.8

Month confidence breaks (0 for never)

216

Withdrawals during the break, percent per month

8
Setting: Madoff
0
month of collapse
$0
on investors' statements at the end
$0
cash investors put in over the life of the scheme
$0
the hole: statements minus cash on hand

What the statements say and what is in the account

Maroon: the total on investors' statements. Blue: cash actually on hand. The shaded gap is the hole. Years along the bottom.

Net winners and net losers, by the year they came in

Each bar is one year's entrants: what they took out minus what they put in, including the pro rata share of whatever cash was left at the end. Green above the line means that year's investors came out ahead; maroon below means they lost.

Run log

RunSettingPromisedRealNew moneyGrowthCutWithdrawalsBreakLastedStatementsHoleWinner years

The machine is the lab's own construction. The named settings are chosen to resemble the four schemes on the first tab in their promised returns, the pace of new money, withdrawal behavior, and the timing of the break in confidence, and nothing more; the dollar amounts they produce are not the historical amounts. Ponzi's 50 percent in 45 days is entered as 400 percent a year. The Madoff setting lets you see the same scheme with and without the 2008 break by setting the break month to 0.

Fraud without a Ponzi

Fligstein and Roehrkasse built a dataset of every regulatory settlement reached between January 2008 and January 2014 by the 60 largest firms in mortgage origination and mortgage-backed securities issuance and underwriting. The firms were real banks and lenders selling real loans and real securities. The fraud was in what they said about them: lenders deceived borrowers about terms and eligibility, and issuers and underwriters misrepresented the quality of the loans in the securities, bet against those securities while selling them, and lied to their own shareholders (p. 618). Before you see the count, predict it.

Of the 60 largest firms in the industry, how many reached at least one regulatory settlement over predatory lending or securities fraud?

Investment banks (9 firms)
9 of 9 settled
Commercial banks (11 firms)
9 of 11
Mortgage specialists (37 firms)
13 of 37
Savings and loan banks (3 firms)
1 of 3
All firms (60)
32 of 60

32 of 60, with 43 predatory lending settlements and 204 securities fraud settlements, totaling more than $79 billion (p. 618; Table 1, p. 629). Every investment bank in the sample settled. The fraud was not confined to fly-by-night lenders; it ran through the biggest and best-known firms, and 87 percent of the firms that settled for predatory lending also settled for securities fraud, which the authors read as fraud cascading upward from origination to the securities built on it (p. 629). The background numbers: mortgage fraud suspicious activity reports to the FBI went from 6,936 in 2003 to 63,713 in 2008, and the FBI estimated $60 billion in fraudulent loans originated between 2006 and 2008 (note 4, p. 638).

Which theory fits the pattern

The article tests three established accounts against its own. The law and economics view says stiff competition prevents fraud, because firms protect their reputations. The reputational view says small, marginal firms that do not care about their reputations will be the ones to commit fraud. The market failure view says the originate-to-distribute model was the problem: originators passed bad loans to securitizers who packaged them for unwitting buyers, so the disintegrated structure of the market drove the fraud (p. 618). Fligstein and Roehrkasse argue instead that as the supply of good mortgages ran out after 2003, firms that were vertically integrated, operating in origination and in securities issuance and underwriting at once, needed mortgages as raw material and lowered standards to get them, and then had to misrepresent the securities built on those loans (pp. 618, 623-625). Which account does the pattern of settlements support?

Given that all nine investment banks settled, that larger and more integrated firms settled more often, and that firms in more stages of the chain settled more, which account does the evidence support?

Vertical integration under scarcity. For each additional function a firm occupied in the chain, it reached more than two additional regulatory settlements, and the effect held after accounting for the firm's revenue and how long it survived to be sued (Table 4, p. 631). That is the opposite of what the reputational account predicts, since the biggest firms with the most to lose settled most, and the opposite of the market failure account, since integrated firms that kept the loans in-house committed more fraud, not less. Competition did not prevent fraud; scarcity of the raw material made it profitable. By 2003 real estate loans were 54 percent of commercial banks' loan assets, up from 32 percent in 1986, and fee income from securitizing and servicing mortgages had become the largest source of non-interest income (p. 620). A business built on the flow of mortgages could not let the flow stop.

Set this next to Baker and Faulkner. Fountain was one small intermediate fraud: a legitimate business that turned. Fligstein and Roehrkasse describe an industry of intermediate frauds, in which the largest firms turned together under the same competitive pressure and with the same products. Neither was a Ponzi scheme. Both ended when the flow of new money stopped.

Source: Fligstein, N., and Roehrkasse, A. F. (2016). The causes of fraud in the financial crisis of 2007 to 2009: Evidence from the mortgage-backed securities industry. American Sociological Review, 81(4), 617-643, at the pages cited.

The people who wrote the loans

Nguyen and Pontell interviewed 23 people who worked in subprime lending in Southern California in 2008 and 2009, mostly loan agents at large lenders and brokers, plus three borrowers. Their subjects described stated-income loans, inflated appraisals, changed job titles, and borrowed bank balances as ordinary skill. Code each statement with the scheme from Lab 5. The codes: 1 denial of responsibility, 2 denial of injury, 3 denial of the victim, 4 condemnation of the condemners, 5 appeal to higher loyalties, 6 claim of normality, 7 defense of necessity, 8 denial of the guilty mind.

0 of 3 coded.

The two articles fit together. Fligstein and Roehrkasse explain why the firms needed the loans. Nguyen and Pontell show what that need looked like at the desk where the application was filled in: a product designed not to be checked, a broker who said to state the income higher, a lender who did not ask, and an appraiser who took the picture from the outside. Between 2005 and 2007 a study of stated-income loans found 90 percent overstated income by at least 5 percent and almost 60 percent by more than half (Sharick et al. 2006, quoted at p. 595). The loan agents did not think of themselves as committing fraud, and the borrower who put down $14,000 a month was "happy."

Source: Nguyen, T. H., and Pontell, H. N. (2010). Mortgage origination fraud and the global economic crisis: A criminological analysis. Criminology and Public Policy, 9(3), 591-612 (method pp. 598-600; quotations at the pages cited).

Which kind of scheme is it

Ponzi has become the word for any investment fraud, which loses the differences that matter for explaining them and for catching them. Five kinds are defined below. Sort the seven cases, then read the reference on what the sorting misses.

Ponzi scheme
Returns to earlier investors are paid out of later investors' money. There may be a real business at the front, but the returns do not come from it. Collapses when withdrawals exceed new money.
Pyramid scheme
Participants are paid for recruiting new participants, who pay to join. Runs out of people rather than money; the geometry, not the returns, sets the limit.
Intermediate fraud
Clinard's category, used by Baker and Faulkner: a legitimate business that, after a period of operation, begins to commit fraud, usually to survive. Fraud and honest loss are mixed and hard to separate.
Misappropriation of custodial funds
Money held for customers, with no return promised, is used by the holder for its own purposes. Collapses like a Ponzi scheme, in a run, though nothing was ever promised but safekeeping.
Hybrid investment fraud (pig butchering)
Maras and Ives's term: a relationship built over weeks or months through unsolicited contact, a false persona, and a fake trading platform showing fake gains, then pressure to invest more, then silence. No later investor pays the earlier one; the platform simply does not exist.

0 of 7 sorted.

What the categories share, and what they do not. Four of the seven end in a run, and a run is the signature of any scheme whose liabilities are real and whose assets are not. Pig butchering never runs, because there is nothing to run on; the victim is alone with a website. That difference matters for detection: a Ponzi scheme leaves a trail of statements, transfers, and a growing gap that an auditor could find, and Madoff's was reported to the SEC repeatedly before it fell. A pig butchering operation leaves a trail only in the victim's bank records and in the laundering, which is why the prosecutions are for money laundering rather than for the fraud itself. Maras and Ives found 59 cases with U.S. victims in five years, losses from $22,000 to $9.6 million per person, most victims male, most single, most in their 20s to 60s.

Sources: Maras, M.-H., and Ives, E. R. (2024). Deconstructing a form of hybrid investment fraud: Examining "pig butchering" in the United States. Journal of Economic Criminology, 5, 100066 (open access), sample and typology; the other cases as cited on the first tab and under each item.

Lab 7 response sheet

Answer the four questions below in complete sentences. Then use the button at the bottom to assemble your answers, your run log, and your sorting record into one block of text, and paste that text into the Lab 7 submission in D2L before you leave class. Your answers stay on this page and are not sent anywhere until you paste them.

Your name
1. Your runs. Using the Madoff setting, say what happens to the month of collapse when you remove the break in confidence, when you halve the withdrawal rate, and when you set what the money really earns equal to the promised return. Which lever decides whether a scheme lasts a year or twenty, and why?
Three to five sentences. Use numbers from your run log.
2. The net winners. In every run the earliest cohorts come out ahead and the latest lose everything. Explain, using the trustee's net equity method, why the law treats an early investor's profit as a later investor's money, and what that implies about who the victims of a Ponzi scheme are.
Three to five sentences.
3. Fligstein and Roehrkasse reject three accounts of financial fraud and offer a fourth. State the fourth in your own words, say what evidence in the article supports it, and say what it predicts about where fraud will appear the next time a financial product's raw material runs short.
Three to five sentences. Cite the article by page.
4. Your case project. Where did the money come from in your case, where did it go, and what ended it: a run, an audit, a whistleblower, a market turn, or a regulator? Say which of the five kinds of scheme on the fourth tab your case is, or why it is none of them.
Four to six sentences. Give the document that shows the flow of money. This is material for Part 2 and Part 3.

About the machine and the sources

The machine on the second tab is the lab's own construction; it is a monthly cash-flow model with the levers described on that tab and no others, and its output should not be cited as a fact about any of the schemes it is named after. Historical figures for Ponzi, Madoff, Stanford, and FTX are from the sources cited on the first tab. The mortgage industry figures are from Fligstein and Roehrkasse (2016) and Nguyen and Pontell (2010) at the pages cited. The pig butchering case is from the Justice Department and contemporaneous reporting on the February 10, 2026 sentencing.