Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/11/2019
12:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

281 Arrested in International BEC Takedown

Conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, the Department of Justice reports.

A coordinated law enforcement operation targeting business email compromise (BEC) has led to the arrest of 281 individuals around the world, including 74 in the United States, 167 in Nigeria, 18 in Turkey, and 15 in Ghana, the Department of Justice reported this week. Alleged fraudsters were also arrested in France, Italy, Japan, Kenya, Malaysia, and the United Kingdom.

BEC scams are sophisticated schemes typically designed to target employees with access to company finances or organizations that work with suppliers and regularly send wire transfers. The same people who drive BEC fraud also target individuals, such as real estate purchasers or the elderly, convincing them to send money to criminal-owned accounts by impersonating a key employee, breaking into a target's email account, or launching a romance or lottery scam.

Many BEC scams are perpetrated by foreign nationals who are often members of transnational criminal organizations that originated in Nigeria and spread throughout the world. The DoJ has ramped up efforts to take down those targeting American citizens and businesses with BEC.

Operation reWired was a four-month effort by the US DoJ, Department of Homeland Security, Department of the Treasury, Postal Inspection Service, and Department of State. The operation resulted in the seizure of nearly $3.7 million, the DoJ reported this week. Law enforcement worked with domestic and international groups to complete this operation.

Starting in May 2019, officials went after hundreds of BEC scammers and executed over 214 domestic actions including arrests, money-mule warning letters, and asset seizures and repatriations amounting to nearly $3.7 million; however, it seems scammers were after greater monetary gain.

In addition to corporate and individual finances, fraudsters may target personally identifiable information (PII) or employee tax records so they can file fake returns or sell stolen data online. Such was the case here: In investigating this massive identity theft and tax fraud scheme, law enforcement discovered conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, attempting to generate more than $91 million in refunds.

"The investigation of these crimes crossed international borders," said director Todd Brown of the US Department of State's Diplomatic Security Service. "Today's charges are another successful example of our commitment to working together with both foreign colleagues abroad as well as local, state, and federal law enforcement partners here at home in the pursuit of those who commit cyber-related financial crimes."

Many of the cases targeted by Operation reWired involved international criminal organizations that reportedly defrauded businesses large and small; others allegedly targeted individual victims who transferred high volumes of money or sensitive data. BEC is a tremendous financial burden to the companies and people it affects, the FBI reports, and reported losses are growing.

In a disclosure published the same day as the Operation reWired announcement, the FBI reported a 100% increase in identified global exposed losses related to BEC between May 2018 and July 2019. Between June 2016 and July 2019, there were 166,349 domestic and international cases of BEC; these generated $26.2 billion in total exposed monetary losses.

This increase in the number of incidents is partly attributed to greater awareness and reporting of BEC scams, which have been reported in all 50 states and 177 countries. Fraudulent transfers have been sent to at least 140 countries, though most go to banks in China and Hong Kong. Still, the FBI points to an uptick in fraudulent transfers sent to the UK, Mexico, and Turkey. 

The FBI's Internet Crime Complaint Center has seen an increase in the number of BEC complaints related to the diversion of payroll funds, indicating human resources or payroll departments are receiving spoofed emails asking for a change in direct deposit accounts.

Some businesses say they have received phishing emails prior to requests for direct deposit changes. Employees may receive similar emails with a fake login page for the email host, which captures their login credentials and gives attackers a way to access their personal information. With a legitimate username and password, a scammer can make a request appear legitimate.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Security Pros' Painless Guide to Machine Intelligence, AI, ML & DL."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-6287
PUBLISHED: 2020-07-14
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create a...
CVE-2020-6289
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site.
CVE-2020-6290
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID.
CVE-2020-6291
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration
CVE-2020-6292
PUBLISHED: 2020-07-14
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.