When an algorithm took $33,000: financial surveillance you didn't ask for
How Bank Secrecy Act reporting, card networks, Plaid, and payment apps build a permanent picture of your money — and what you can do about it
“She had never heard of the word structuring.” — Allen Pace
Carol Henders ran a small Mexican restaurant in Iowa for 33 years. In 2013 the IRS seized $33,000 from her account without charges, trial, or evidence of a separate crime — simply because a pattern of deposits matched what an algorithm flags as structuring. It took years of legal fights and national attention before she got that money back.
Why cash is not as private as you think
The Bank Secrecy Act requires banks to file a currency transaction report (CTR) for any cash transaction over $10,000 in a single business day. That regulatory plumbing produced more than 28.7 million reports in fiscal 2025 — roughly 78,000 a day. Most of those filings are not because someone is suspected of laundering; they exist because someone used cash above that threshold.
Banks also file suspicious activity reports (SARs) when a transaction looks odd. You will never be told a SAR was filed on you — the bank is legally prohibited from notifying you — and those reports are available to law enforcement without a warrant. Structuring, the federal crime of breaking transactions to avoid CTRs, can carry up to five years in prison. The offense is the pattern of deposits, not a separate underlying crime.
The commercial layer builds a permanent behavioral record
Card networks and banks sell transaction data. MasterCard and Visa operate multi-product data services that represent billions of purchases. Banks disclose data-sharing practices in privacy notices most customers never open, and many offer opt-outs buried in that mail.
Payment apps — Venmo, Cash App, PayPal — are not banks in the traditional sense. They keep social graphs: who you pay, when, how often, and sometimes with a memo that looks like a social feed. The IRS tax-reporting threshold shifted back to $20,000 and 200 transactions in 2025, but that change only affects tax forms, not what platforms retain about you.
Then there’s the middleware: Plaid. When you connect a fintech app to your bank, Plaid often receives your complete transaction history, balances, and identity details. Plaid settled a class-action in 2022 for $58 million for collecting more data than users knowingly provided. As of 2025 it’s integrated with Venmo, Robinhood, Coinbase, and hundreds more.
“Put it all together and the picture that exists about your financial life is more complete than most people's own recollection of any of it.” — Allen Pace
Practical moves that actually reduce exposure
Pick one category of spending this week and pay cash for it. Cash is the only common financial instrument that doesn’t create a persistent commercial record.
The other high-leverage, short tasks Allen recommends:
Audit your Plaid connections at plaid.com/connections and revoke apps you don’t use. (Five minutes with big effect.)
Read your bank’s annual privacy notice and exercise any opt-out for data sharing.
Use virtual cards for online purchases (Privacy.com was recommended): per-merchant numbers, spending limits, and instant card shutdown.
Keep sensitive transactions off payment apps; they create social-graph entries that are retained and reachable by legal process.
Separate financial identities: dedicated cards/accounts for subscriptions, business income, and discretionary cash.
The hard truth and what to keep in mind
Carol Henders eventually got her money back, but only after senators intervened and public scrutiny forced policy changes. The structural problem did not disappear: CTRs, SARs filed without notice, civil asset forfeiture authority, card-data markets, and middleware access are all still operating — and they've grown in scale and reach.
Your financial record isn't private because you did something wrong. It's private because no one has yet been motivated to look. That infrastructure to look exists and it is accessible — commercially and through legal channels.
Take ten minutes this week: audit Plaid, read your bank’s opt-out, and start paying cash for one category you’d prefer to keep off the record. Those small, concrete steps change the signal you present to the systems that can — and will — follow the money.
If you want the links Allen mentioned and the episode notes, they’re available on OPSecpodcast.com. — Allen Pace