Now on Demand Ransomware Resilience & Recovery Summit - All Sessions Available
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

FBI Steps Up Efforts Against ‘Money Mules’ Online Fraud

The email caught the executive at a small company by surprise one morning in 2016. The company’s owner, or so he thought, was requesting a money transfer to pay for supplies from a new vendor.

The email caught the executive at a small company by surprise one morning in 2016. The company’s owner, or so he thought, was requesting a money transfer to pay for supplies from a new vendor.

It wasn’t until that night when the executive, hours after the money had been transferred and still puzzled by the out-of-the-blue demand, texted the owner to make sure he’d heard the request correctly.

The befuddled reply was disheartening: “I just saw your message about a wire transfer today. What is that about?”

It was all part of a fraud scam that targeted companies, schools and nonprofits in Connecticut and elsewhere in the United States and that resulted this month in a 45-month prison sentence for one of the culprits. The case is part of a seemingly endless cycle of money laundering schemes that law enforcement officials say they’re scrambling to slow through a combination of prosecution and public awareness.

Beyond the run-of-the-mill plots, officials say, is a particularly concerning trend involving “money mules” — people who, unwittingly or not, use their own bank accounts to move money for criminals for purposes they think are legitimate or even noble.

The “mule” concept has attracted renewed attention with this month’s release of Clint Eastwood’s “The Mule,” a real-life tale of an elderly horticulturist who smuggled cocaine for a Mexican cartel. But the modern-day mules of most concern to the FBI are people who get themselves entangled in complicated, international money laundering schemes that cause huge economic losses and show no signs of stopping.

“They trial and error this stuff and they see what works and they see what doesn’t,” FBI supervisory special agent James Abbott said in an interview. “It’s a much higher success rate when you have a lot of money using somebody else’s account going through there instead of trying to cross the border with a physical transportation of cash.”

The FBI and international law enforcement agencies have stepped up efforts against the fraud and say they’re building bigger cases than before. Europol said this month it had identified 1,504 money mules, arresting 168, in a continent-wide bust. The FBI in June announced the arrests of 74 people, including 29 in Nigeria, for schemes targeting businesses and the elderly, and has launched a publicity campaign called “Don’t Be a Mule.”

Advertisement. Scroll to continue reading.

The money mule cases are an offshoot of more generic frauds encountered by the FBI, including schemes that dupe people into thinking they’ve won the lottery and can claim their prizes by wiring an advance payment, or that trick the unsuspecting into believing a relative has been arrested and needs urgent bail money or that a supposed paramour they’ve met online requires cash. In cases like the Connecticut one, fraudsters assume identities of executives and scam employees into wiring cash.

That’s what happened in 2016 at Beacon Systems, a Texas company where a new employee received emails from someone she thought was the chief executive officer instructing her to transfer nearly $100,000 for a vendor-related payment.

Several weeks later, Kerry Williams, the CEO whose identity was impersonated, was on her way to the airport when the FBI contacted her and explained how the company had been victimized as part of a much broader swindle. A dual Nigerian-U.S. citizen was ultimately sentenced to four years in prison in connection with the scheme.

“It makes you kind of paranoid,” Williams said, describing how the experience also made the SAP consulting firm more vigilant. “Even to this day, we’re overly cautious about everything. I think you kind of go to that extreme.”

As for money mules, they’re persuaded, sometimes with the incentive of keeping a cut of the funds, into allowing money transfers into their own bank accounts at the direction of a fraudster they may mistake for an online friend or romantic partner, a military officer overseas or an employer. They’re then instructed to transfer those funds elsewhere, into accounts controlled by criminals.

In one example, the FBI says, a fraudster posing as an Army captain stationed overseas recruited a man he met online to be a money mule, saying he was making arrangements to travel home and needed the man’s help receiving and sending some funds. The FBI says $10,000 was wired into the man’s account. He was then instructed to withdraw it in small increments and send it to a woman in Texas.

The mules are sometimes witting conspirators. Other times, they’re elderly, lonely or just confused. The ones the FBI concludes are merely unwitting are given stern warnings but generally avoid prosecution.

“When we approach them and talk to them and explain to them what they’ve been doing, a lot of times, the horror is there, said Steven D’Antuono, an FBI section chief specializing in financial crimes. “It’s all walks of life, all educational levels. Anyone can fall victim to this.”

In the Connecticut case, the executive recounted those horrors in a letter to the judge before the sentencing of one of the defendants earlier this year.

The executive, whose name and company are redacted in the letter, described feeling initially apprehensive about the money transfer instructions and advising the company owner that it was a “lot of money for supplies.”

That night, he described the interactions to his wife, who asked if he was really certain the emails were legitimate. He suddenly wasn’t so sure, realizing for the first time he may have been duped.

“Because of crimes like these,” he wrote, “our society is losing much of the trust and openness that we once experienced.”

Related: 168 Arrested in Money Mule Crackdown

RelatedTwo Scammers, Five Mules Arrested in BEC Bust

RelatedEurope Cracks Down on Money Mules: 178 Arrested in Global Operation

view counter
Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

MSSP Dataprise has appointed Nima Khamooshi as Vice President of Cybersecurity.

Backup and recovery firm Keepit has hired Kim Larsen as CISO.

Professional services company Slalom has appointed Christopher Burger as its first CISO.

More People On The Move

Expert Insights

Related Content

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.