Feds Indict 281 People for Involvement in Massive Email Fraud Scheme

Federal authorities have arrested 281 people and seized nearly $3.7 million in a coordinated effort between multiple agencies to disrupt a massive email-fraud scheme.

Perpetrators of a global business email compromise (BEC) scheme were the target of a four-month investigation that began in May called Operation reWired, a coordinated effort by the U.S. Departments of Justice (DoJ), Homeland Security, Treasury, State and the U.S. Postal Inspection Service, working with local and state law-enforcement agencies.

In addition to the arrests and millions in repatriations, officials also seized money-mule warning letters and assets for a total of 214 domestic actions in the investigation, according to a DoJ press release.

The news comes on the heels of an alert issued by the FBI that organizations have lost $26.2 billion in the last three years to BEC schemes, which defraud victims by using emails to deceive them into sending wire transfers or personal information so cybercriminals can realize financial gain.

Operation reWired spanned multiple countries, with 167 arrested in Nigeria, as well as dozens of others the United States, Turkey, Ghana, France, Italy, Japan, Kenya, Malaysia and the United Kingdom.

In a statement, FBI Director Christopher A. Wray said the indictments send a strong message to criminals who organize these schemes, who typically are foreigners and members of international criminal syndicates originating in Nigeria but with global connections.

“We’ll keep coming after you, no matter where you are,” Wray said.

The indictments also demonstrate to the public that the government is significantly invested in tracking down these types of cybercriminals and putting an end to their efforts whenever possible, he said. Wray also encouraged people to report incidents of BEC to the Internet Crime Complaint Center (IC3).

BEC, or what the feds also refer to as “cyber-enabled financial fraud,” specifically targets those with access to company finances as well as businesses working with foreign suppliers in sophisticated scams that involve having people make wire transfers—often recurring ones–to accounts where bad actors can access the money. Cybercriminals also use these scams to gain access to the means to make those transfers.

Scammers also target and attempt to exploit individual victims such as people buying real estate or the elderly by impersonating a business partner or someone else connected to them and sending an email requesting money. Because the person receiving the email believes the message is from someone they trust, they often are deceived into making a payout.

BECs also appear in the form of lottery or romance scams and also can involve bad actors asking for personal information so they themselves can access the victim’s financial accounts.

Indeed, BECs are widespread and numerous because they’re a rather low-investment way for cybercriminals to make quite a lot of money, said Kevin Epstein, vice president of threat operation at Proofpoint, in an email to Threatpost.

“Sending fraudulent email is cheap and the messages don’t require expensive malware or sophisticated command and control; yet the attacks themselves are highly effective, resulting in billions of dollars in reported losses,” he said.

Though efforts like Operation reWired are effective, law enforcement shouldn’t shoulder all of the responsibility to thwart BEC attacks, Epstein said. Enterprise and business leaders also have an obligation to help prevent these attacks from within their organizations, he said.

“Organizations need to take immediate steps to significantly reduce the chances that a BEC attack is successful by educating their employees and deploying solutions that place the individual at the center of their security strategy,” Epstein said.