Regulatory DDoS. Hint: if you see it, write your Congresspeople, and tell them you'd like the matter referred to DoJ/the proper regulator. Then, if you really want to make sure, submit something to the same regulator.

If the red flag never gets waved, nobody even bothers/knows to look, and with the way the justice system works, there is no crime until a DA has sufficient info to start building a case there is one.

Do this for both State, and Federal at a minimum. Local if such authorites exist and are not preempted.