281 Arrested in International BEC Takedown

A coordinated law enforcement operation targeting business email compromise (BEC) has led to the arrest of 281 individuals around the world, including 74 in the United States, 167 in Nigeria, 18 in Turkey, and 15 in Ghana, the Department of Justice reported this week. Alleged fraudsters were also arrested in France, Italy, Japan, Kenya, Malaysia, and the United Kingdom.

BEC scams are sophisticated schemes typically designed to target employees with access to company finances or organizations that work with suppliers and regularly send wire transfers. The same people who drive BEC fraud also target individuals, such as real estate purchasers or the elderly, convincing them to send money to criminal-owned accounts by impersonating a key employee, breaking into a target's email account, or launching a romance or lottery scam.

Many BEC scams are perpetrated by foreign nationals who are often members of transnational criminal organizations that originated in Nigeria and spread throughout the world. The DoJ has ramped up efforts to take down those targeting American citizens and businesses with BEC.

Operation reWired was a four-month effort by the US DoJ, Department of Homeland Security, Department of the Treasury, Postal Inspection Service, and Department of State. The operation resulted in the seizure of nearly $3.7 million, the DoJ reported this week. Law enforcement worked with domestic and international groups to complete this operation.

Starting in May 2019, officials went after hundreds of BEC scammers and executed over 214 domestic actions including arrests, money-mule warning letters, and asset seizures and repatriations amounting to nearly $3.7 million; however, it seems scammers were after greater monetary gain.

In addition to corporate and individual finances, fraudsters may target personally identifiable information (PII) or employee tax records so they can file fake returns or sell stolen data online. Such was the case here: In investigating this massive identity theft and tax fraud scheme, law enforcement discovered conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, attempting to generate more than $91 million in refunds.

"The investigation of these crimes crossed international borders," said director Todd Brown of the US Department of State's Diplomatic Security Service. "Today's charges are another successful example of our commitment to working together with both foreign colleagues abroad as well as local, state, and federal law enforcement partners here at home in the pursuit of those who commit cyber-related financial crimes."

Many of the cases targeted by Operation reWired involved international criminal organizations that reportedly defrauded businesses large and small; others allegedly targeted individual victims who transferred high volumes of money or sensitive data. BEC is a tremendous financial burden to the companies and people it affects, the FBI reports, and reported losses are growing.

In a disclosure published the same day as the Operation reWired announcement, the FBI reported a 100% increase in identified global exposed losses related to BEC between May 2018 and July 2019. Between June 2016 and July 2019, there were 166,349 domestic and international cases of BEC; these generated $26.2 billion in total exposed monetary losses.

This increase in the number of incidents is partly attributed to greater awareness and reporting of BEC scams, which have been reported in all 50 states and 177 countries. Fraudulent transfers have been sent to at least 140 countries, though most go to banks in China and Hong Kong. Still, the FBI points to an uptick in fraudulent transfers sent to the UK, Mexico, and Turkey. 

The FBI's Internet Crime Complaint Center has seen an increase in the number of BEC complaints related to the diversion of payroll funds, indicating human resources or payroll departments are receiving spoofed emails asking for a change in direct deposit accounts.

Some businesses say they have received phishing emails prior to requests for direct deposit changes. Employees may receive similar emails with a fake login page for the email host, which captures their login credentials and gives attackers a way to access their personal information. With a legitimate username and password, a scammer can make a request appear legitimate.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Security Pros' Painless Guide to Machine Intelligence, AI, ML & DL."