|
It all started with a mail from George Ndu, who claimed that he was the
accountant with the Federal ministry of works and housing in Nigeria.
| What
CNS also did |
| n |
Informed
and handed over all documents to the investigating agencies in India
with a request to issue international alerts about the culprits. |
| n |
Called
up and alerted victims and those negotiating with the culprits about
the fraud, asking them to send us copies of the mails exchanged with
the scamsters to probe for more proof—active email ids, the front
companies and the banks where they have accounts. |
| n |
Educated
them about the nature of fraud and guided them on how and why one
should report the matter to their local police. |
| n |
Sent
mails to those responding with contact details of possible victims
in their region with request to alert them. |
| n |
After
we informed her, a lady in China made one such formal complaint with
the local police. Subsequently, the Hong Kong Monetary Authority
issued an alert about Banquedenationale Bank. |
| *
Cyber News Service |
|
"I am mandated by a senior colleague to seek and solicit the assistance
of a trustworthy person outside the shores of my country to enable us claim a
long lying funds amounting to $15.5 million (fifteen million five hundred
thousand US dollars).
These funds originated from contracts we awarded and supervised for the
ministry on behalf of the Federal government," the mail said.
According to Ndu, these contracts had already been executed and payments had
been made.
The benevolent contractors who executed these contracts, however, left behind
$15.5 million as an over-invoiced amount for committee members to share amongst
themselves.
The mail also claimed that the said monies were already earmarked for payment
via an offshore payment office but this had been pending due to lack of relevant
papers and officials to back the claim. "In view of this, my colleague has
mandated me to look for a foreign partner abroad who will receive the money on
our behalf, since, as civil servants—with restrictions on financial matters—we
cannot put up claims for the money in our names, neither are we allowed to own
or operate foreign accounts," the mail said. Ndu also promised 25% of the
total amount as commission to the "partner" for ‘lending’ them his
bank account.
| How
the 419 Scam Works |
| 1.
An individual or company receives an email from an alleged
"official" representing a foreign government or agency |
| 2.
An offer is made to transfer millions of dollars in "over-invoiced
contract" funds into your personal bank account |
| 3.
You are encouraged to travel overseas to complete the transaction |
| 4.
You are requested to provide blank company letterhead forms, banking
account information, telephone, fax numbers |
| 5.
You receive numerous documents with official looking stamps, seals and
logo testifying to the authenticity of the proposal |
| 6.
Eventually you must provide up-front or advance fees for various taxes,
attorney fees, transaction fees or bribes |
| 7.
Finally, you have to travel to Nigeria—either directly or via a
bordering country—to meet Nigerian government ‘officials’ |
| 8.
Fake documents are made by the perpetrators to smuggle you into Nigeria |
| 9.
Once there, you have no option but to ‘cooperate’ by paying money or
ransom |
If this sounds familiar, it certainly is. Such mails must have reached you,
and if you’re sensible, or lucky, or suspicious, you’ve ignored or deleted
them, wondering who could be naïve enough to fall prey to hoaxes. But across
the world, and now in India, people continue to buy the story—daily.
A quick survey across our own office revealed that as many as 65% of all
staffers have been receiving similar mails on a regular basis. The statistics
are alarming and raise many questions. Who on the earth has the time to send
such mails to so many people, and do they really mean business? How many foreign
businessmen, royals, dictators, opposition party members die in Nigeria annually
and how many government contracts are over-billed? Above all, has anybody really
managed to help these ‘distressed souls’ or ‘lucky officials’—and got
their booty?
While I was drafting a reply to the mail, our reporter from Chennai flashed a
message that she was filing a report on the Nigeria 419 scheme (or the
"advance fee fraud" [AFF]). She was also in touch with someone
negotiating with—and tracking—them. Soon, this author got on the line with
‘Jai’—M Jayashankar—CEO of Chennai-based Caliber Plus, and we began
working together, investigating the scam that seemed to have found its way to
Indian shores. To begin with, we decided to continue negotiating with the
scamsters through Jai, tracking them using their contact details.
As for who we were after, it was Peter Esemusa, who claimed to be the
chairman of the ‘Contract Award Committee’ for Nigeria’s Petroleum Trust
Fund. Jai was already in touch with him on his phone [#234-803-7145080] in
Nigeria. Peter wanted Jai to come either to Nigeria or the Netherlands to sign
the agreement. Jai refused. Soon after the refusal, we received a mail from Bode
Thomas, supposedly the head of the Foreign Payment Department in Nigeria from
his personal account—bthomas_bank@yahoo.com. We smelt this one out for what it
was—a common scamster trick—claiming that mails from their official IDs had
been bouncing.
"Pursuant to your fund release order and our mutual phone conversations
on the above subject matter, be informed that the audit unit has completed
verifications, reconciliation and re-validation of your project file: FGN/PTF/PED/WR-KD/2002,
the foreign exchange allocation to the tune of $15,000,000 granted to be
remitted without deduction in your favor. Therefore, it is expedient as the bona
fide beneficiary to pay the mandatory signing fees, bank legal cost, and High
Court charges of affidavit-notarization, stamp duty and registration of the
affidavit in order for it to be valid. The amount required is $5,750.89 (US
Dollars Five Thousand Seven Hundred and Fifty Eighty-Nine Cents
only)," Thomas wrote in. The amount was supposed to be deposited in favor
of Audit Co Ltd in their account with the Hua Nan Commercial Bank in Taipei,
Taiwan.
| IT-Enabled
Scamming |
| Our
investigation also shows that some of the culprits—at least the kingpins—are
well-versed with technology, creating websites and tele-banking
infrastructure. Most of the gang’s front organizations have actually
been created only in the virtual world—the main objective being to
create websites similar to that of real banks and convince victims that
the company actually exists. There’s another objective too. All victims
are asked to register themselves online through the websites of one of
these companies. As soon as one registers on the site, and personal
details are updated in a database file, with "victims" being
sent mails from the so-called bank informing them about their account as
well as the pin number. |
| However,
a closer look into some of these sites made us realize that most of the
pages were static Web pages that get displayed at the click of the link.
Also, the source code of the html file used for these sites did not have
any encryption or security features. Most of the servers used by the
scamsters were found to be PHP servers, and a users’ account number and
password was being used to redirected them to an html page that merely
displayed the funds balance record from the same database. The scamsters
have also set up ‘tele-banking’ by connecting their telephone lines to
the computer, with CTI (computer-telephony interface) and IVR software.
The computer is updated with the users’ record on a regular basis.
Again, victims in most of the recent cases have been asked to use this
facility. |
| They
were also found to be using e-fax facilities through service providers in
the US and Europe. These numbers are being used as contact numbers for the
companies floated by them to deal with the public at large. The electronic
fax facility helps the perpetrators receive faxes and voicemail in their
e-mail inbox, and also store them on their computers. A fax sent to any of
these numbers is automatically processesed by the service provider and is
sent to the subscriber as an as an image file via e-mail. Similarly, the
scamsters also use it to ‘e-mail’ a fax to their victims. |
This was a vital lead and we started working using the same technology—e-mail
and chat, among others—that had helped the 419-ers realize their business
across the globe. Investigations and interaction with people in Taiwan in Yahoo!
chat rooms led us to others in India, China and Pakistan—all either in the
negotiations or already having coughed up the upfront fee. The chat sessions
also helped us compile a list of 38 active accounts that scamsters were using...
Next step, we set about gathering information on the many fronts being used by
them.
419—and its many faces
Our investigation revealed that many of those behind the racket were using
banking facilities in Hong Kong to run their ‘business’ seamlessly. The
modus operandi was simple—while "funds in Nigeria" remained the
primary bait, the objective was to deal through fronts based in Hong Kong, the
USA and the UK. The so-called ‘iron hand’ image of these countries was being
used to make the victims believe that it could be a real offer after all.
Further probes revealed seven such fronts (there could be more, of course)—Origin
Merchant Bank (www.originmerbank.com),
Banquedenationale Bank (www.banqedenationale.com),
Global Banking Corp (www.globalbankingcorp.com),
Citi Express Banks Inc (www.citiexpressbank.com),
Swiss Corps Inc (www.swisscorps.com),
Eurocentral Union (http://eurocentralunion.com)
and Transglobe express Co—specifically created for this purpose.
In most cases that we looked into, victims were asked to deposit money in
favor of either of these companies in a ‘corresponding bank’.
Knowing that we had as much of a social obligation as a journalistic one, we
contacted the Indian authorities and monitoring agencies, as well as forieign
victims. Subsequently, the Hong Kong Monetary Authority issued a press release
on June 19, 2003 warning people against any dealings with Banquedenationale
Bank.
"The public should be aware that Banquedenationale Bank is not
authorized under the Banking Ordinance to carry on banking business or the
business of taking deposits in Hong Kong, nor does it have a representative
office in Hong Kong. The address of its Hong Kong office stated in the website
is incomplete and cannot be traced. The HKMA has verified with relevant US
financial authorities that Banquedenationale Bank does not have a banking
license in the US, nor does the Federal Deposit Insurance Corporation of the US
insure it. Moreover, the UK financial regulator has confirmed that
Banquedenationale Bank is not authorized to carry on the regulated activities of
accepting deposits in the UK," the press release said [www.info.gov.hk/hkma/eng/press/2003/20030619e3_index.htm].
HKMA also referred the website to the Hong Kong Police Force for further
investigations. It has since been liaising with financial authorities in the US
and UK to take appropriate action in cases related to the website.
Our investigations also show that the perpetrators were transferring money
from one of their current accounts in a leading bank in Hong Kong to a savings
account in the same bank. Information from the sources revels that a total of HK
$7.3 million [or Rs 4.3 crore] was withdrawn from the bank using different modes—cash
withdrawals using ATM and electronic transfer, all this in less that ten months
between August 2002 and June 2003.
Going by the average transaction amounts for all seven fronts, it is
estimated that this one group has managed to wangle people out of nearly Rs 30
crore in a year’s time.
| 419 is
the Nigerian penal code section relating to fraud, under which such
scamsters are booked—hence the ‘Nigeria 419’ name for this scam. In
india, the equialent penal code section is 420 |
So who paid all this money?
Not many Indians whom we managed to speak with were forthcoming about their
negotiations—or their losses. Some turned hostile and threatened us with dire
consequences when we tried to alert them about the nature of the scam.
Nevertheless, we managed to gather information about several negotiations and
trace a case where an Indian had actually lost money.
This Mumbai-based businessman admitted that he had paid up Rs 232,095
($4,987) and shot a question right back to us—Why had we not alerted him
before he sent the amount. Another Indian who was in negotiations with the
scamsters—an ex-armyman from Patiala—said he wasn’t convinced about the
offer, or the credentials of the the people he was dealing with.
| Tracing
the ‘419’ Scamsters |
In
Chennai, 29-year-old M Jayshankar got a similar ‘spam scam’ mail on
May 30 this year, and has since been working nearly full-time to unravel
the mystery of the decade-old scam. One of the first things he did was to
send a mail about the scam to many who mattered in India. What made it
relatively quick to expose this scam was the 29-year-old aeronautical
engineer’s ability to traverse the Internet, moving from server to
server—whether they were running Windows, Mac, Unix, Linux or Sun
Solaris—as also his expertise in networking and IT security. Our story
would have been very difficult without his work—and it’s unlikely that
we would have tracked the imposters and their victims. Says Jayshankar:
"I haven’t invented anything new, but I’ve managed to find many
security holes in present-day computer networking, which lets me capture
and control a distant computer." These were also the skills that
helped us get contact details of some of the victims who gave us vital
clues that helped unravel the mystery of the scam, which the FBI believes
is a thriving multi-billion-dollar business... and helped us alert those
victims, and various police forces and agencies. Jayshankar runs Caliber
Plus (www.CaliberPlus.com), a company that sells domain names, with
features like free e-mail, free hosting space and free e-mail forwarding—"the
cheapest domain name registrar in the country". Next in line—a jobs
site for India, BrainBankIndia.com, with online job interviews. |
But there were others, who, despite their doubts, were still negotiating.
What was disquieting was the fact that the racket—given its e-nature—has not
been restricted to metro and bigger cities only. The list includes a small-time
film producer from Sahibabad in Uttar Pradesh, another working in a Bangalore-based
animation company, businessmen in Mumbai and Rohtak, plus another working class
person in Nowshehra, Srinagar.
And there are hordes of others across the globe willing to listed—and
perhaps fall for the scam. Some pleaded with us to help get back their money. A
lady from China disclosed to us that she had sent $131,016 to one of the
accounts, while a gentleman from Kagawa, Japan had sent $15,040. Another victim,
Shaari Mohammad, had already paid a stamp duty of $3,200, and a further $1,100
as endorsement charges. All of them said they had decided not to send any more
money. The lady in China has since reported the matter to the local police and
unconfirmed reports from sources suggest that the HKMA action might have been
the outcome of this.
Meanwhile, we have handed over the findings of our investigation to the
investigation and law-enforcement agencies in India, who have also contacted
their international and foreign counterparts. Watch this space for further
developments.
SHUBHENDU PARTH Inputs from Nisha
Kurien
|