Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/11/2019
12:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

281 Arrested in International BEC Takedown

Conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, the Department of Justice reports.

A coordinated law enforcement operation targeting business email compromise (BEC) has led to the arrest of 281 individuals around the world, including 74 in the United States, 167 in Nigeria, 18 in Turkey, and 15 in Ghana, the Department of Justice reported this week. Alleged fraudsters were also arrested in France, Italy, Japan, Kenya, Malaysia, and the United Kingdom.

BEC scams are sophisticated schemes typically designed to target employees with access to company finances or organizations that work with suppliers and regularly send wire transfers. The same people who drive BEC fraud also target individuals, such as real estate purchasers or the elderly, convincing them to send money to criminal-owned accounts by impersonating a key employee, breaking into a target's email account, or launching a romance or lottery scam.

Many BEC scams are perpetrated by foreign nationals who are often members of transnational criminal organizations that originated in Nigeria and spread throughout the world. The DoJ has ramped up efforts to take down those targeting American citizens and businesses with BEC.

Operation reWired was a four-month effort by the US DoJ, Department of Homeland Security, Department of the Treasury, Postal Inspection Service, and Department of State. The operation resulted in the seizure of nearly $3.7 million, the DoJ reported this week. Law enforcement worked with domestic and international groups to complete this operation.

Starting in May 2019, officials went after hundreds of BEC scammers and executed over 214 domestic actions including arrests, money-mule warning letters, and asset seizures and repatriations amounting to nearly $3.7 million; however, it seems scammers were after greater monetary gain.

In addition to corporate and individual finances, fraudsters may target personally identifiable information (PII) or employee tax records so they can file fake returns or sell stolen data online. Such was the case here: In investigating this massive identity theft and tax fraud scheme, law enforcement discovered conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, attempting to generate more than $91 million in refunds.

"The investigation of these crimes crossed international borders," said director Todd Brown of the US Department of State's Diplomatic Security Service. "Today's charges are another successful example of our commitment to working together with both foreign colleagues abroad as well as local, state, and federal law enforcement partners here at home in the pursuit of those who commit cyber-related financial crimes."

Many of the cases targeted by Operation reWired involved international criminal organizations that reportedly defrauded businesses large and small; others allegedly targeted individual victims who transferred high volumes of money or sensitive data. BEC is a tremendous financial burden to the companies and people it affects, the FBI reports, and reported losses are growing.

In a disclosure published the same day as the Operation reWired announcement, the FBI reported a 100% increase in identified global exposed losses related to BEC between May 2018 and July 2019. Between June 2016 and July 2019, there were 166,349 domestic and international cases of BEC; these generated $26.2 billion in total exposed monetary losses.

This increase in the number of incidents is partly attributed to greater awareness and reporting of BEC scams, which have been reported in all 50 states and 177 countries. Fraudulent transfers have been sent to at least 140 countries, though most go to banks in China and Hong Kong. Still, the FBI points to an uptick in fraudulent transfers sent to the UK, Mexico, and Turkey. 

The FBI's Internet Crime Complaint Center has seen an increase in the number of BEC complaints related to the diversion of payroll funds, indicating human resources or payroll departments are receiving spoofed emails asking for a change in direct deposit accounts.

Some businesses say they have received phishing emails prior to requests for direct deposit changes. Employees may receive similar emails with a fake login page for the email host, which captures their login credentials and gives attackers a way to access their personal information. With a legitimate username and password, a scammer can make a request appear legitimate.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Security Pros' Painless Guide to Machine Intelligence, AI, ML & DL."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...