If the banking industry did a media campaign along the lines of “work at home jobs involving money showing up in your account that you have to send somewhere else are criminal scams” then prosecutors would have an easier job (and fewer people would sign up for them).

Like or Dislike: 0  1

So if computers inside First Sentry were compromised, was First Sentry also the originating bank of the transaction to the mules, or was it another bank since sometimes small banks use larger banks as correspondent banks?

Like or Dislike: 0  0

Congratulations on your new venture, and I look forward to your continuing excellent work.

Apparently our cyber paths continue to cross in the cesspools of organized cybercrime. As an avid reader of your outstanding series on “Cyber Gangs Fleece Small Businesses”. I can’t help but note some of the similarities between the Clampi / Zeus / Zbot bank looting operations, and that of the multi million dollar annual card fraud laundering operation which has operated within the global financial system unfettered for over half a decade.

The published reports of the actual cash transfer drop instructions given to these mules, is what highlighted some of the similarities. In both cases, I believe that the named Western Union drops are also picked up by mules at the other end, and that it is one of several steps in the laundering process. It is my opinion that there is an organized Eastern European crminal version of a sort of “Hawala”, which specifically services cyber criminals and their ongoing global crimes, is untracable, and utilizes Western Union and Money Gram.

If you look at some of the published reports given to the mules in the small business bank account fleecing, such as:

================================================
Dear (MY NAME),

We are glad to inform you about the new task! Please review transfer details:

Date: 02.02.2009 12:07:57
Reference: 217077PB-21
Amount: USD 9350
Commission: USD 748 (8 %)
FROM: Company: L S Starrett Nashvl

IMPORTANT: THE TRANSACTION MUST BE COMPLETED VIA WESTERN UNION ONLY (NOT MONEY GRAM).

Funds should be on your bank account already. Please contact your bank urgently and confirm that money is available for withdrawal.

The next thing you have to do is to inform your personnel supervisor about the task status and execute three basic actions:

1. LEARN MORE.
Make sure you’ve already read our detailed manual: >http://mmt-group.cc/member/admin/job_instructions.php

2. WITHDRAW THE FUNDS.
Please visit your bank as soon as possible and withdraw the received funds. Usually this procedure doesn’t take more than 30 minutes.

3. TRANSFER MONEY VIA WESTERN UNION.
After cash withdrawal you are to make transfer(s) in local Western Union location(s). Commission (8 %) should be deducted from the received money. WU fees along with all other costs, such as bank fees, transportation costs and so on are paid by you and are deducted from your commission.

* According to the contract should your expenditures are greater than 3% of the transferred sum, we’ll compensate the difference. To get more detailed info, please read the EXHIBIT A part of the contract.

You have to make the following transfer(s):

Type: Western Union
Amount: 2870 USD
Receiver’s First Name: VICTOR
Receiver’s Last Name: GALUSCA
Receiver’s City: Chisinau
Receiver’s Country: Moldova

Type: Western Union
Amount: 2800 USD
Receiver’s First Name: CONSTANTIN
Receiver’s Last Name: ROIBU
Receiver’s City: Chisinau
Receiver’s Country: Moldova

Type: Western Union
Amount: 2931 USD
Receiver’s First Name: LEONID
Receiver’s Last Name: RYCHKOV
Receiver’s City: Moscow
Receiver’s Country: Russia

IMPORTANT: Before leaving for bank or WU you must read the detailed FAQ available HERE: http://mmt-group.cc/member/admin/job_instructions.php

*We kindly ask you to specify purpose of WU transfer: family (if required). It will allow us to avoid the delays connected to Western Union policy concerning business transfers.

Sincerely,

Support Team
MMT Group Inc.
support@mmt-group.cc
================================================
Ref: http://scamfraudalert.wordpress.com/2009/10/10/criscom-group-inc-criscomgroupco-cncriscom-groupinc-cccriscom-group-cc/

Chisinau, Moldova repeatedly shows up as the origination point of hundreds of spam forum posts which were used to seed search engines by the organized crime syndicate card fraud laundering operation. The posts were used to create references and ranking for the fake business names used on Careerbuilder.com for recruiting cyber mules. Over 150 job adds for cyber mules were placed on Careerbuilder for the fake recruiting company Skydexsoft.com. (Warning: Skydex Soft was infected with iframe malware exploits). That was preceeded by numerous forum posts from supposed customers praising the company. Those postings originated from Chisnau Moldova, IP Address: 91.214.201.92 static-91-214-201-92.roxnet.md, and also from starnet.md in Chisinau. Those IPs were also the source of several hundreds of forum posts which used various card fraud laundering domain names with telephone numbers as their forum aliases. http://www.dslreports.com/forum/r19620593-Ebook-websites-fraud-charges-DevbillDigitalAgePluto?hifilter=Moldova The purpose of the latter was to demote search engine rankings of subsequent victim card fraud reports from the various fraud websites.

In one of your “Cyber Gangs Fleece Small Businesses” reports, you listed these mule instructions:

================================================
(WU commission included in $9221.40USD ). But remember everything must be complete in an two hours since you withdraw the money.)

MONEY TRANSFER SYSTEM (WWW.WESTERNUNION.COM, LOOK FOR THE NEAREST BRANCHES ON THE WEBSITE)

*Please send money via Western union branches,because it much more faster*

!!!Do not send money via Bank,because it slower!!!

You should choose option “Send in one minute”

YOU NEED TO FIND 3 BRANCHES of Western Union AND SEND ONE EQUAL PIECE FOR THE FIRST RECEIVER FROM 1 BRANCH,SECOND EQUAL PIECE FOR THE SECOND RECEIVER FROM 2 BRANCH
AND THIRD EQUAL PIECE FOR THE THIRD RECEIVER FROM 3 BRANCH .

!!Details of our 1 client:

*NOTE* (!!!PLEASE PAY WESTERN UNION TRANSACTION FEES FROM $3073 USD!!!!!)
FIRST NAME: Valeriy
SURNAME: Zobnin
CITY: Poltava
COUNTRY: Ukraine

!!Details of our 2 client:

*NOTE* (!!!PLEASE PAY WESTERN UNION TRANSACTION FEES FROM $3073 USD!!!!!)
FIRST NAME: Andrey
SURNAME: Kostin
CITY: Rovno
COUNTRY: Ukraine

!!Details of our 3 client:

*NOTE* (!!!PLEASE PAY WESTERN UNION TRANSACTION FEES FROM $3073 USD!!!!!)
FIRST NAME: Boris
SURNAME: Valinurov
CITY: Kiev
COUNTRY: Ukraine
================================================

Ref: http://voices.washingtonpost.com/securityfix/Merian%20S.%20Terry.txt

Ref: http://voices.washingtonpost.com/securityfix/2009/09/more_business_banking_victims.html

For three years the Ukraine has been the originating point of several similar Western Union transfers, which were sent to the US to cover the US Bank fees, Authorize.net merchant account setup fees, and LLC registration costs, for the card fraud laundering website facilities.

Circa December 2007, the following email was sent to a duped cyber mule to cover the set up costs for BestTech solutions (www.bst-design.com):

================================================
From: Marek Shulcovicz Shulcovicz2002@gmail.com

Sent: Monday, December 24, 2007

Subject: sales representative

Hello,

First of all, I would like to wish you a merry Christmas!

Let’s get back to work now. I got a confirmation that the amount of money needed for the company registration was sent to you about an hour ago. You can get it via Western Union. Below you can find all the information you will need to receive this transfer :

SENDER : grigoriy gorvat
CITY, COUNTRY : Dnipropetrovsk, Ukraine
MTCN : 41263XXXXX
AMOUNT : $XXX

SENDER : vadim zagray
CITY, COUNTRY : Kyiv, Ukraine
MTCN : 19610XXXXX
AMOUNT : $XXX

After receiving the Western Union transfer please send me an e-mail message to confirm the fact that you are in possession of the amount of money needed and you have started the company registration process. After that please read the following step-by-step instructions to set up your work.

o Recommendations for company legalization via LegalZoom.com
1. It is highly recommended that the company name would include the word Solutions, Technologies and Design.
2. If it is required to indicate the scope of activity of the company, please indicate software sales / website development
3. Get a Tax ID*

* There are two ways of getting a Tax ID

a. You can find a special form in your Express Gold package, that will be delivered to you along with your new company documents. After filling out this form and sending it to IRS, you will get your Tax ID for free in two weeks.

b. LegalZoom.com gives you an opportunity to get a Tax ID while you are registering your company. You are going to need extra $49 to do so.

….
…
..

The moment when you sign the contract will be the start of your first working day.

Should you have questions, I am always ready to answer them.

Best Regards,
Marek Shulcovicz
EffectiveSoft Ltd.
================================================

The recruiting of that cyber-mule began with this introduction:

================================================

From: personal_manager@effectivesoft.biz
Sent: Tuesday, December 11, 2007 6:07 AM
To: REDACTED

Subject: Career advancement opportunity. Apply now.

Hello,

We came to know about your CV while we were browsing on monster.com.
After perusal of your experience, we came to a decision that you might be
a good candidate for a position we have open now.

Position outlines:

EffectiveSoft is looking to fulfill vacancies for Sales Representatives who would
be responsible for developing a new sale approach for our software products

Company Data:
EffectiveSoft Ltd. was based in 2003.
….
..
.
================================================

Circa January 2008 another duped cyber-mule who was recruited by fellowsolutions.com, and was subsequently assigned a card fraud laundering website of IPD-TECHNOLOGIES.COM, was sent funds to cover the LLC, business bank account, and Authorize.net set up fees:

=====================================
From: Aleksandr Kostanda aleksandrkostanda@yahoo.com

To: XXXXXXXXXXXXXXX

Subject: Aleksandr Kostanda

We sent $500 through the Western Union. You can pick up the money.

The datas to get the money:

Sender:
The first name: NATALYA
The second name: MITROFANOVA
MTCN: 814-678-XXXX
Address: Nikolaev, Ukraine
Sum: $XXX

We sent it from Ukraine because it’s the cheapest way to send the
money for us.

Best regards,
Aleksandr Kostanda.
Fellow Solutions, Inc.
36 Dragan Tsankov Blvd.,
Sophia, 1057
Bulgaria,
Phone/Fax for US: (606) 764-1922
fellowsolutions.com
=====================================

Just a few months ago, in an unexpected turn of events, the Ukraine once again showed up as the source of a $2,000 Western Union in bound transfer to the US, to support the organized crime syndicate’s card fraud laundering operation. In this case the unwitting cyber-mule who had set up an LLC and three FBNs to support three of the crime syndicate’s card fraud laundering websites, was tracked down and finally reached after about two months in operation. By that time the syndicate had processed around $100,000 in fraudulent charges to hijacked card data. At the time of initial contact the mule reported having made foreign wire transfers of some of the fraud proceeds a day earlier. After instructing the mule to lock out the authorize.net account and place it in test mode, they were then instructed to contact the bank the following morning and to try and revoke wire transfers made in the previous day or two. Around $80,000 of the fraud proceeds had already been sent out of the country.

In this case the inbound Western Union cash from the Ukraine was a surprise ending to a ruse which was created to stall the cyber criminals, while attempts were made to freeze the foreign bank account where the card fraud proceeds were going to. Though it is typical for the fraud proceeds to be withdrawn in cash upon receipt at the foreign bank accounts, numerous fraud entities would have been wiring funds there, so there may have been a chance to freeze fresh wires. Unfortunately the process of revocation was handled as a typical recall and not as a fraud event, so the criminals were alerted to the attempted revocation. In order to deflect the criminals attention, a ruse was created to explain what they were seeing from their end, and the Western Union surprise was the unexpected result. That scenario can best be seen from these edited communication transcripts:

After first phone call:

==========================
Subject: Follow up to telephone conversation

Please forward me copies of the emails that worldcreativestudio.com
sent you which contain instructions to wire the money.
==========================
==========================

Hi MGD,

Needless to say, I am speechless and in a complete state of shock. I went
ahead and placed all 3 accounts on test mode and changed all the passwords.
These people do not have access to the bank accounts. How long would you say
it takes for the sales to stop going through once the accounts are in test
mode?

==========================
==========================
Hi,

As soon as you place it in test mode then no more charges will be processed.
The criminals may be still processing charges into the system, as it will
take them a while to realize that the system once set to test mode will
accept the entries, however, it will discard and not process them. For
ethical and other reasons, you can now no longer contest the disputed
charges from the card victims. Depending on the available current funds in
the account it is best to issue credits to as many of the current pending
disputes as possible.

Also, I need the wiring details ASAP, so I can try and have the Latvian bank
account frozen. Based on the limited information that you gave me over the
phone regarding the beneficiary name of “DIMEFIELD MANAGEMENT LTD.” in the
British Virgin Islands, I have came up with this as a possible address:

PO Box 3469,
Geneva Place,
Waterfront Drive,
Road Town,
Tortola,
British Virgin Islands.

The BVI is a known haven of offshore shell company registrations for Russian and
other money laundering criminals.
==========================
==========================
Hi MGD,

Here is the bank info you need:

———- Forwarded message ———-
From: adrian_nowak@worldcreativestudio.com
Date: 2009

Subject: Adrian Nowak. World Creative Studio, Inc.

Hello,

Please do the transfer to our bank account today.

Here it’s the bank info:

Beneficiary’s Bank Name: Aizkraukles banka
Beneficiary’s Bank SWIFT code: AIZKLV22
Beneficiary’s Bank Address: Elizabetes 23, LV-1010, Riga, Latvia.
Beneficiary Account: LV29AIZK0001140110388
Beneficiary Name: DIMELFIELD MANAGEMENT LTD
Beneficiary address: Geneva place Waterfront Drive Road, Town Tortola,
British Virgin Islands
Detail of the payment: For law consulting invoice 29072009/1 dated
30/07/2009

Please be sure that you write down exact Detail of Payment. It’s very
important for us.

The transfer must be from your company name Remote Access Group, Inc.,

from the bank business account.
When you do the transfer please tell me the sum of it.

Best regards,

Adrian Nowak.
Chief manager of World Creative Studio, Inc.
adrian_nowak@worldcreativestudio.com
Phone/Fax for the USA: (954) 208-7279

———- Forwarded message ———-

From: adrian_nowak@worldcreativestudio.com
Date: XXXXXX 2009

Subject: Adrian Nowak. World Creative Studio, Inc

Hello,

Yes please do the transfers tomorrow.

Detail of payments:
1 account: For law consulting invoice 19082009/1 dated 20/08/2009
2 account: For law consulting invoice 19082009/2 dated 20/08/2009
3 account: For law consulting invoice 19082009/3 dated 20/08/2009

Best regards,

Adrian Nowak.
Chief manager of World Creative Studio, Inc.
>adrian_nowak@worldcreativestudio.com
Phone/Fax for the USA: (954) 208-7279

==========================
==========================
From: MGD

To Cyber-Mule:

Thanks, I do not need exact, just a guess as to the approximate total
transfers.
==========================

==========================

From Cyber-Mule:

13 transfers totaling $87,592. I did the math earlier. Are you already in
touch with that bank?

Thanks for your help…
==========================
==========================
To Cyber-Mule:

Go to Wachovia ASAP and try and initiate a revocation on the last wire
transfers that just left. Foreign transfers take a few days, and they may be
able to recall it if it has not reached the account at the Latvian bank
==========================
==========================
XXXXX@ab.lv XXXX@ab.lv

XXX@fktk.lv

Subject: ALERT: Criminal Money Laundering report (AML) at Aizkraukles Banka

FRAUD ALERT: Criminal Money Laundering report

==========================
==========================

From: MGD

To: XXXX at jordans-international.com

Subject: DIMELFIELD MANAGEMENT LTD

The above company appears to be using your address:

DIMELFIELD MANAGEMENT LTD
Geneva place,
Waterfront Drive Road,
Town Tortola,
British Virgin Islands.

I was wondering if you can confirm if they are a legitimate company at your
address. Or maybe they were registered through your service and are allowed
to use your mailing address.

==========================
==========================

From: XXXXX at jordans-bvi.com

Subject: RE: DIMELFIELD MANAGEMENT LTD

Dear MGD,

I confirm that the above company is a legitimately registered BVI Business
Company (company number 1498731). We provide the registered office and agent
to this company.

Best regards
==========================
==========================

Dear XXXX,

Thank you very much for your confirmation and prompt reply.

I have an additional question, are the registered details for DIMELFIELD
MANAGEMENT LTD a public record?. For example, the owner name or registration
contact details.

==========================
==========================

Dear MGD,

A company search of the public record will reveal the Company Name, Company
number, registered office, registered agent, authorised share capital, the
last licence fee paid, whether the company is in good standing, and whether
the company is in liquidation or has any litigation proceedings, or charges
filed.

Directors and shareholders details are not on public record.

A charge for a company search as above is $150.

Please let me know if I can assist you further.

Best regards

==========================
==========================

The Cyber criminals are now aware of the Wachovia bank request to Aizkraukles Banka
for the return of the funds. Normal procedures require that the recipient sign off and
authorize the return of wires. Obviously even if the funds were still there that is not going to happen. In order to stall for time and for other events to take place the cyber mule initially responded to the crime syndicate’s inquiry on the authorize.net merchant processing account lockout as may being related to excessive chargebacks, and said they would find out what was going on.

==========================

From Cyber-mule:

This was the last message I got from them…

———- Forwarded message ———-
From: >adrian_nowak@worldcreativestudio.com

Subject: Adrian Nowak. World Creative Studio, Inc.

Hello,

Will we be able to start to sell on September 1st? Then we would limit
our sales up to $40,000 for each account. And there will be always
enough funds to cover all chargebacks. Or will we not be able to start to sell again?

It’s impossible to return the transfers because they were directed to
pay our other services already.

Best regards,
Adrian Nowak.
Chief manager of World Creative Studio, Inc.
adrian_nowak@worldcreativestudio.com
Phone/Fax for the USA: (954) 208-7279
==========================
==========================
To: cyber-mule

Excellent, got it.

I see they are asking about if they will be able to continue billing. I
suggest you tell them this:

——
“Due to the growing number of charge backs the merchant account underwriter
told me that they require me to give them an additional $2,000 to be held in
reserve to cover any pending charge backs and the associated fees. This
reserve is above and beyond any pending or actual receipts. They require
this reserve to be on deposit before they will allow the accounts to be
released for additional card processing. Since that $2,000 is above and
beyond the funds that are in the bank account, I am not willing to fund this
out of my pocket.

If you wish to continue processing sales then you need to wire this $2,000
back to business bank account, or send it in some form. That is why I tried
to recall the last transfer in order to cover this new requirement”. If you
do not wish to cover this reserve requirement I will be unable to have the
processing account released. The underwriter at Transfirst said that they
are experiencing an increased amount of chargebacks in general from
ecommerce, and are increasing the reserve requirements on certain designated
accounts to protect themselves.”
——

They may be too smart and knowledgeable to believe this, however, it is
close enough to reality that they may go for it. Especially if they think
that they will be able to continue processing fraud charges. The amount is
small enough that they might consider it worth the risk.
==========================

==========================
Hey MGD,

This is what they had to say to that:

———- Forwarded message ———-
From: >adrian_nowak@worldcreativestudio.com

Subject: Adrian Nowak. World Creative Studio, Inc.

Hello,

Why can they no take this reserve from the hold funds on third
website? They hold aprox. $7,000. So they can take all these money for
all 3 websites for reserve.
Or we can sell for each website for $2,000 and they take these funds
for the reserve.

What you sent to us we spent all funds for advertising.

Best regards,
Adrian Nowak.
Chief manager of World Creative Studio, Inc.
adrian_nowak@worldcreativestudio.com
Phone/Fax for the USA: (954) 208-7279
=========================

=========================

To Cyber-Mule:

LOL !! “We spent it on advertising” the lying scum. That is right up there
with “the dog ate my homework”

How ironic, not only do the criminals not spend even a penny advertising the sites,
they block every one of the hundreds of them from even being found by search
engines.

Take your time in answering, but we will put the ball back in their court by
saying

“They told me that the $2,000 is the balance needed to meet the total
required reserve. As I told you, I do not have that additional money, nor
should I have to use my personal money to support the business. The merchant
account underwriter’s risk department said that those additional funds will
have to be on deposit before they will release the accounts for further
processing. So it will be impossible to generate that balance from
additional sales. Let me know what you wish to do, as I will need to look
for other employment quickly if you are not going to continue the business.”

=======================================
=======================================

Check this out MGD!!

—————————————–
From: adrian_nowak@worldcreativestudio.com
Date:

Subject: Adrian Nowak. World Creative Studio, Inc.

Hello,

We sent you $2,000 trough the Western Union.
Please pick up the money and inform me when you get them.
The money was sent to these datas:

Sender’s first name: Lisova
Sender’s second name: VIKTORIYA
MTCN: 294-693-XXXX
City: NIKOLAEV
Country: Ukraine
Sum: $1000

Sender’s first name: VALERIY
Sender’s second name: CHUNIHIN
MTCN: 466-675-XXXX
City: NIKOLAEV
Country: Ukraine
Sum: $1000

We sent the money from Ukraine branch because it’s more cheaper than here.
You can pick up the money in any time now.

Please deposit these funds to cover the balances as they require. Also
please tell at your bank to refuse from their inquiry to return the
last wire transfers. The transfers will not come back in any case
because there are not funds on this bank account. Only our bank
manager ask us what to do with your inquiry. Just tell at the bank
that you did the inquiry by mistake.

Best regards,
Adrian Nowak.
Chief manager of World Creative Studio, Inc.
adrian_nowak@worldcreativestudio.com
Phone/Fax for the USA: (954) 208-7279
===================================================

Though over the years the millions in fraud proceeds have gone from various US banks to assorted foreign banks, inbound support funds have primarily come via Western Union from the Ukraine. More recently they have also used Russian PayPal accounts for set up costs. The connections at this stage between the two fraud operations may be anecdotal. You have reported that several of the lootings from business accounts were made via direct transfers to foreign bank accounts. Though none of those details have been published so far, It would be interesting to see if they have anything in common with the other multi year ongoing fraud operation. Organized cyber crime is way ahead of any efforts by the finanical system to impede their operations. As for Western Union and Money Gram, they are the holy grail of fraudulent money laundering. If cash transfers via those systems were halted for a week, it would have the same effect on cyber crime as the combined results of pulling the plug on Atrivo, McColo, and 3FN / Pricewert.

Like or Dislike: 2  0

Brian:
“Ignorance of the law is not a legal defense, but sadly it is often a sufficient one.”
Sadly, no truer words have been spoken.

Like or Dislike: 1  0

Anyone who comes across any similar money mule or reshipping fraud recruiting scam, please do let me know about it, along with any spam copy via my webform on http://bobbear.com/ or http://bobbear.co.uk/

Like or Dislike: 1  0