Threats Without Borders - Issue 96
Matt's Newsletter, Week ending September 18, 2022
I was asked to consult on the victimization of a couple in their 70s to the tune of nearly $500,000. The initial exploit was a tech support scam in which the couple allowed remote access software installed onto their computer. The software allowed the bad guys to identify the victims' financial institutions and other personal information. Within a few days, the victim received a phone call from a male pretending to be a fraud investigator from their largest investment brokerage. The scam went worse from there. Over the next few weeks the couple made the following wire transfers:
July 20 - $27,500 from Bank A to XX Bank in Hong Kong
July 26 - $29,000 from Bank A to XX Bank in Hong Kong
August 4 - $85,000 from Bank A to XX Bank in Hong Kong
August 9 - $100,500 from Bank B to XX Bank in Hong Kong
August 25 - $168,500 from Bank C to X Cryptocurrency Exchange
August 30 - $79,900 from Bank A to X Cryptocurrency Exchange
Half-of-a-million dollars wired out of the country in one month.
I can’t be more specific about the mechanics of the scam because it is still an active investigation.
My first thought was, who has access to that much cash? Wow.
My second thought, and more importantly, how does this happen? Better yet, why do we continue to allow this to happen?
The easy thing to do would be to blame the bank workers that initiated the wire transfers but that’s not fair. They have internal regulations to follow and legal counsel that never misses an opportunity to do the wrong thing. The county Agency on Aging initiated this investigation based on a report from a bank, so at least one did due diligence.
Too little too late.
Why is there no national mandatory reporting laws for the financial exploitation of the elderly? Only 28 of the 50 states have laws mandating elder financial abuse reporting. This is a national issue and should be engaged by the federal government. The fraudulent wire transfers are flowing nationally and eventually internationally. Make the financial institutions do the right thing and give them legal protections when they do.
Reporting suspected abuse to social workers with no law enforcement authority to investigate is insufficient. Filing a SAR that won’t be reviewed for a month, if ever, is equally inadequate.
How about any FDIC or NCUA-insured Financial Institution must report suspected fraud or abuse to a designated call center within 24 hours and local law enforcement must respond within another 24 hours? What qualifies as suspected fraud? I think anyone over the age of 65 who sends more than $20,000 to a foreign entity via wire transfer would be a good start.
The banker will respond, "We can't keep people from doing what they want with their own money!". Law enforcement will respond, "We are so understaffed there's no way we can respond within 24 hours".
Go find new jobs. Both of you.
On queue
The Better Business Bureau (BBB) issued a warning that fraudster are already crafting attacks around the Biden administrations plan to forgive college debt. The bureau warns of vishing attacks but I’m sure they’ll be coming in all the ‘ishing forms. https://www.bbb.org/article/scams/27499-bbb-scam-alert-this-new-impostor-scam-targets-student-loan-holders
Better late than never…?
Once again the Department of Justice is last to the party and I feel like we keep justifying it with “better late than never”. The DOJ announced that three new “Strike Force” teams have been created to handle the scourge of Covid-19 pandemic relief fraud. Ahhh… law enforcement at all levels and financial industry fraud investigators have been combating this scourge for about 18 months. And this is no criticism of the law enforcement arms of the DOJ who have been doing their best to tackle the issue and have been racking up arrests. And I’m not knocking the idea either as it’s the correct thing to do. But why aren’t these teams already fully functioning? Better late than never. I guess. https://www.justice.gov/opa/pr/justice-department-announces-covid-19-fraud-strike-force-teams
Even later…
The U.S. Department of Justice has announced a “national network of prosecutors” charged with cracking down on cryptocurrency crimes. Better late than never. I guess. https://www.wsj.com/articles/justice-department-forms-national-network-of-prosecutors-focused-on-crypto-crime-11663322407
Edge browser is pushing tech support scams
Malvertising is a method used by threat actors (TA) to get soon-to-be victims to click their malicious links. The TA’s serve up false advertisements that take the user to a malicious website or serve a payload when clicked upon. Malwarebytes researchers have detailed how a vulnerability within the Microsoft Edge browser allows TA’s to serve those bad ads directly to users resulting in a pop-up notification declaring the device is infected. You know the rest (and if you don’t - read the opening editorial of the newsletter). https://www.malwarebytes.com/blog/threat-intelligence/2022/09/microsoft-edges-news-feed-pushes-tech-support-scam
The Rest…
A Michigan man who claimed he lost the use of his legs and left hand to obtain benefits from the U.S. Department of Veterans Affairs to the tune of $264,631 has been sentenced to five years in prison on fraud charges. https://www.pennlive.com/nation-world/2022/09/man-goes-prison-for-faking-injuries-to-get-265k-in-veterans-benefits.html
The Securities and Exchange Commission (SEC) announces it charged VMWare with fraud, which should be a huge deal, but apparently it’s not based on the assessed fine. https://techcrunch.com/2022/09/12/the-sec-revealed-today-that-it-charged-vmware-with-fraud-then-settled-for-next-to-nothing/
Cool Tools
A search engine for RSS feeds. https://datorss.com/
A search engine for business news. https://yup.is/
Cool Jobs
AVP - Financial Crimes Compliance. LPL Financial.
Irrelevant
“Policing with less and less policing”
A review of Michelle Wilde Anderson, “The Fight to Save the Town: Reimagining Discarded America” (Simon & Schuster, 2022).
https://www.lawfareblog.com/policing-less-and-less-policing
Thank you for opening the email and allowing me to pontificate another week. I had so much to cover I couldn’t get it all in one issue. I’m considering two issues per week. That would really anger some attorneys.
See you next Tuesday.
Matt
“OPPORTUNITY IS MISSED BY MOST PEOPLE BECAUSE IT IS DRESSED IN OVERALLS AND LOOKS LIKE WORK.”
We had a similar case with an elderly customer wanting to wire funds to a foreign country. The best way to try and prevent it is to have a thorough conversation with the customer regarding the purpose of the wire and the person they are sending it to. Most will say its an investment or they are helping a family member or friend.....these answers should raise Red Flags and more questions need to be answered before sending the wire. The bank does not have to allow a wire to go through if they suspect fraud or a scam may be taking place. Educating our staff and our customers is the best way to prevent this from happening.