A coordinated operation conducted by the FBI and international law enforcement partners resulted in the disruption of several groups carrying out business email compromise (BEC) scams.
See also: FBI: Warns of phishing attacks in the 2022 elections
The operation, called “Eagle Sweep,” lasted three months, starting in September 2021, and resulted in the arrest of 65 suspects in the United States, Nigeria, South Africa, Cambodia, and Canada.
BEC is a sophisticated scam that typically targets employees of businesses that make payments via wire transfers. These sophisticated fraudsters typically gain access to a company’s email accounts or spoof their email addresses to send legitimate and timely requests for wire transfers. The bank accounts intended for the transfers, however, are controlled by the criminals. The same criminal organizations that carry out BEC scams also prey on individuals, often home buyers and the elderly.
Those who commit BEC fraud are high-level fraudsters who deceive employees by pretending to be a business partner or company submitting a legitimate payment order.
Often, these threat actors monitor their targets' communications, compromising their corporate network, to identify weak, exploitable points in the financial transaction process.
They usually strike at just the right time by hacking email threads or using fake accounts to request the diversion of a real invoice payment to a new bank account.
See also: Shutterfly: Data breach after Conti ransomware attack
According to the FBI's Internet Crime Complaint Center (IC3) 2021 Crime Report, the financial damage attributed to BEC last year reached $2.4 billion, just for reported incidents.
Arrests were made
The FBI statement states that the fraudsters they arrested are considered responsible for targeting more than 500 companies in the United States, causing financial losses of $51,000,000.
Among those arrested are the following:
· Oluwasegun Baiyewu, 36, of Houston, Texas, and Leo Omorogieva Eghaghe, 39, of Lagos, Nigeria, who laundered approximately $4,500,000.
· Ashley Crespo, 27; David Alvarado, 21; Wendy Elizabeth Ramos Lopez, 29; Dayana Zaila Ramos, 32; Alvaro Umanzor, 23; Luis Lopez, 39; Jerome Crawford, 25; and Jamal Moore, 25, all of Houston, Texas. The group has laundered (along with others) $4.5 million over two years and $900,000 in a single BEC fraud case.
· Bright Osaghni, 41, and Osatohanmwen Oriakhi, 41, both of Toronto, Canada, who attempted to extort over $16,000,000 from hundreds of victims in the United States and Canada.
In parallel with Operation Eagle Sweep, law enforcement agencies in Australia, Japan, and Nigeria conducted local operations targeting BEC fraud threat actors.
See also: Hackers stole $625 million in crypto from the Ronin network
How to spot BEC scams
The surefire way to avoid sending money to a BEC scammer is to always call your business partner when you receive a request to send payments to a new bank account via email.
Use the phone number you have previously confirmed to be genuine and not any numbers that may be provided in the suspicious email.
Additionally, enable multi-factor authentication on your email account and use a strong and unique password to protect yourself.
Information source: bleepingcomputer.com
