Online shopping fraud – Police arrest 59 people in cross-border operation

Online shopping fraud (also known as e-commerce fraud) is a rising threat. To counter this a coordinated crackdown has seen 59 scammers arrested and new investigative leads triggered all across Europe as part of Europol’s 2022 e-Commerce Action (eComm 2022). 19 countries took part in the successful action, which was coordinated by Europol’s European Cybercrime Centre (EC3) and the Merchant Risk Council (MRC). Direct assistance was received from merchants, logistic companies, banks, and payment card schemes.  Investigations are still ongoing in various countries, with more arrests expected in the coming weeks.

Online Payment Security

Online payments in Europe are generally very secure, mainly due to the wide implementation of Secure Customer Authentication (SCA).  SCA is a European regulatory requirement aimed at reducing fraud and making online and contactless offline payments more secure.  Broadly speaking customers shopping online may be asked to verify their identity with two factors during the checkout process.

To counter this criminals are continuously altering their techniques to unlock new ways of stealing money. eComm22 has identified the following threats to the e-commerce sector:

  • Phishing, vishing (Voice phishing) and smishing (SMS phishing) fraud:  These are techniques for fraudulently obtaining private information.  The criminals contact people by phone, text messages, messaging apps or email and attempt to convince them to hand over their credit card information. Sometimes these attacks promise a reward, other times they impersonate a trusted business or a government agency.
  • Account Takeover (ATO) Fraud: This is a form of identity theft in which the fraudster gets access to a victim’s bank or credit card accounts and uses them to make unauthorised transactions.
  • Fake websites (also referred to as Triangulation Fraud): These are websites that are not  legitimate venues designed to entice the visitor into revealing sensitive information, to download some form of malware, or to purchase products that never arrive.  eComm22 highlighted their use to entice buyers with cheap goods. Sometimes these fake websites appeared in ads, or links were sent to a user’s email directing them to the website through a phishing attempt. The catch is that these goods don’t actually exist, or are never shipped.

How to Protect Against Online Shopping Fraud

Online Shopping FraudEuropol, in conjunction with European Law Enforcement and the MRC, has today launched an awareness campaign that will be promoted through the hashtag #SellSafe.  This shares practical advice on how to outwit criminals trying to abuse the online shopping experience.  The aim  is to make e-commerce more secure by promoting safe online purchasing methods and by helping new merchants to open online shops without the risk of cyberattacks.

Some key tips for online shoppers are:

  • Never send your card number, PIN or any other card information to anyone by e-mail.
  • Never send money to anyone you don’t know.
  • Always save all documents related to your online purchases.
  • If you are not buying anything, don’t submit your card details.
  • Check your online banking service regularly. Notify your bank immediately if you see payments or withdrawals that you have not made yourself.
  • For more information read Europol’s Tips And Advice To Avoid Becoming A Fraud Victim

Some key tips for e-business owners are:

  • Ensure all your employees are aware of the fraud issues affecting online stores.
  • Stay up to date on the types of payment fraud affecting businesses and have the tools in place to prevent them. Your national payments organisation will have details on payment fraud types.
  • Get to know your customers in order to be able to verify their payments.
  • For more information read Europol’s advice on Safe Sales, Safe Revenue

The EAST Expert Group on Payment and Transaction Fraud (EPTF), which meets three times each year, focuses on the prevention of payment and transaction fraud, online shopping fraud. The 14th EAST EPTF meeting took place on 9 November 2022.

Phishing gang busted by cross-border Police operation

A cross-border operation, supported by Europol and involving the Belgian Police (Federale Politie) and the Dutch Police (Politie), resulted in the dismantling today of an organised crime group (OCG) involved in phishing, fraud, scams, and money laundering.

  • The OCG used email, text messages and mobile messaging applications to contact their victims.
  • These messages contained a phishing link leading to a bogus banking website.
  • Thinking they were viewing their own bank accounts through this website, the victims were duped into providing their banking credentials to the suspects. The investigative leads suggest that the criminal network managed to steal several million euros from their victims with this fraudulent activity.
  • The OCG used money mules to transfer these funds from the victim’s accounts and to cash out the fraudulently obtained money.
  • Members of the OCG have also been connected with cases of drugs trafficking and possible firearms trafficking.

Police Action

On 21 June 2022 the coordinated Police action led to:

  • 9 arrests in the Netherlands
  • 24 house searches in the Netherlands
  • Seizures including firearms, ammunition, jewellery, electronic devices, cash and cryptocurrency

Europol facilitated the information exchange, the operational coordination and provided analytical support for investigation. During the operation, Europol deployed three experts to the Netherlands to provide real-time analytical support to investigators on the ground, forensics and technical expertise.

The EAST Expert Group on Payment and Transaction Fraud (EPTF), which meets three times each year, focuses on the prevention of payment and transaction fraud, including phishing. The 12th EAST EPTF meeting took place on 13 April 2022.

National & Global Fraud Intelligence sharing – 1st EAST Global Congress

The 1st EAST Global Congress took place on Thursday 16th June 2022 at Europol’s HQ in the Hague as a hybrid meeting, with some delegates participating online. This was the first in-person meeting of EAST Global and National Members since February 2020.  Six virtual interim meetings were held between that meeting and the Global Congress.

The meeting was chaired by Graham Mott from the LINK Scheme and the key focus was on the sharing of payment and terminal fraud intelligence (global, regional, national).  A special welcome was given to Olesya Danylchenko from the Ukrainian Interbank Payment Systems Member Association (EMA).

Law enforcement overviews were provided by Europol, the Gulf Cooperation Council Police (GCCPOL), and the United States Secret Service (USSS).  An update was provided from Europol’s European Cybercrime Centre (EC3) on various fraud types and an updated version of the document Guidance and Recommendations Regarding Logical Attacks Against ATMs‘  was officially launched.  A presentation from Europol’s Organised Property Crime Unit covered recent Physical ATM attacks across Europe. The USSS update covered recent reports from the FBI’s Internet Crime Complaint Centre (IC3), as well the latest fraud trends seen.

Private sector fraud intelligence updates were received from 25 countries, either directly or via regional/global updates by HSBC and Worldline.  Regional Updates were also provided for ASP, and MENA.  Each update covered Fraud Types, Fraud Origin, Due Diligence and Physical Attacks (ATM, ATS and CIT).  The importance of raising consumer awareness to counter the rising threats related to social engineering remains a key issue.

Updates were also given by the Chairs of the three EAST Expert Groups:

EAST Fraud Update 2-2022 will be produced early next month, based on the country updates provided at the EAST Global Congress.  EAST Fraud, Payment, and Physical Attack Alerts are available on the EAST Intranet to EAST Members.

The 2nd EAST Global Congress, scheduled for 5th October 2022, will also be held as a Hybrid Meeting.

National & Global Fraud Intelligence sharing – 6th Interim EAST Meeting

The sixth Interim Meeting of EAST National and Global Members took place on Wednesday 9th February 2022 as a virtual meeting. The meeting was chaired by Thomas Von der Gathen from Payment Services Austria (PSA).  The key focus was on the sharing of global, regional, and national, payment and terminal fraud intelligence.

Law enforcement overviews were provided by Europol, the Gulf Cooperation Council Police (GCCPOL), and the United States Secret Service (USSS).  An update was provided from Europol’s European Cybercrime Centre (EC3) on various fraud types and a presentation from Europol’s Organised Property Crime Unit covered recent Physical ATM attacks across Europe.  The GCCPOL presentation covered payment and fraud issues seen by their 6 member countries focussing on Technological Fraud (crimes committed using different forms/types of machines and technology) and Non-Technological Fraud (conducted directly against the victim). The USSS update covered card fraud and recent man-in-the-middle black box attacks.

Private sector fraud intelligence updates were received from 28 countries, either directly or via regional/global updates by Citi, HSBC and Worldline.  Regional Updates were also provided for ASP, MENA and LATAM. Each update covered Fraud Types, Fraud Origin, Due Diligence and Physical Attacks (ATM, ATS and CIT).  The importance of raising consumer awareness to counter the rising threats related to social engineering remains a key issue, particularly for elderly people.

EAST Fraud Update 1-2022 will be produced early next month, based on the country updates provided at the Interim EAST Meeting.  EAST Fraud, Payment and Physical Attack Alerts are available on the EAST Intranet to EAST Members.

The next meeting of this group, scheduled for 16th June 2022, will hopefully be the 1st EAST Global Congress, which is planned as Hybrid Meeting.  This is dependant on the prevailing travel situation at that time, and the meeting will revert to a virtual Interim Meeting if required.

European Money Mule Action leads to 1803 arrests

Money Mule ActionThe anti-money mule operation EMMA 7 concluded today.  This is an international action coordinated by Europol in cooperation with 27 countries, Eurojust, INTERPOL, the European Banking Federation (EBF) and the FinTech FinCrime Exchange.

The operation resulted in 1,803 arrests and the identification of over 18,000 money mules.  It also revealed that money mules were being used to launder money for a wide array of online scams such as SIM-swapping, man in the middle attacks, e-commerce fraud, and phishing.

During  EMMA 7 law enforcement, financial institutions and the private sector, including Western Union, Microsoft, and Fourthline, cooperated in a concerted effort against money laundering in Europe, Asia, North America, Colombia, and Australia.

As well as targeting the laundering of profits through money muling networks, investigators also sought intelligence on the sources of these illicit profits, shedding more light on the size and nature of the criminal economies that money mules serve.

The European Money Mule Action ‘EMMA’, was established in 2016 on the initiative of Europol, Eurojust and the European Banking Federation.  It is the largest international operation of its kind, built around the idea that public-private information sharing is key to fighting complex modern crimes.  Around 400 banks and financial institutions supported the action, reporting 7,000 fraudulent transactions and preventing a total loss estimated at nearly €70 million.

Participating countries in EMMA 7 were: Australia, Austria, Belgium, Bulgaria, Colombia, Czech Republic, Estonia, Finland, Greece, Germany, Hong Kong-China, Hungary, Ireland, Italy, Moldova, Netherlands, Poland, Portugal, Romania, Singapore, Slovak Republic, Slovenia, Sweden, Switzerland, Spain, United Kingdom, United States.

Public Awareness is key for the Prevention of Money Muling

Unlike many financial crimes, money mules can be recruited unknowingly into criminal operations.  The organised crime groups do this by preying on groups such as students, immigrants, and those in economic distress, offering easy money through legitimate-looking job adverts and social media posts.  Ignorance is not an excuse and money mules break the law by laundering the illicit proceeds of crime.

To counter this Europol coordinated the ‘#DontBeAMule’ awareness campaign with all participant countries, law enforcement and the EBF (on behalf of the European banks), as a means to prevent more innocent bystanders being exploited by criminals and putting themselves at risk.

National & Global Fraud Intelligence sharing – 5th Interim EAST Meeting

The fifth Interim Meeting of EAST National and Global Members took place on Wednesday 6th October 2021. Due to the Covid-19 situation, it was conducted as a virtual meeting. The meeting was chaired by Veronica Borgogna from AXEPTA BNP Paribas.  The key focus was on the sharing of global, regional, and national, payment and terminal fraud intelligence.

Law enforcement overviews were provided by Europol, the Gulf Cooperation Council Police (GCCPOL), the United States Secret Service (USSS) and INTERPOL.  Two presentations were made by Europol: one from the European Cybercrime Centre (EC3) covered recent successful cross-border operations; the other covered Physical ATM attacks across Europe.  The GCCPOL presentation covered payment and fraud issues seen by their 6 member countries focussing on Technological Fraud (crimes committed using different forms/types of machines and technology) and Non-Technological Fraud (conducted directly against the victim). The USSS presentation covered Covid-19 pandemic relief fraud and the INTERPOL presentation covered recent issues relating to financial crimes in the LATAM region.

Private sector fraud intelligence updates were received from 28 countries, either directly or via regional/global updates by Citi, HSBC and Worldline.  Regional Updates were also provided for ASP, MENA and LATAM. Each update covered Fraud Types, Fraud Origin, Due Diligence and Physical Attacks (ATM, ATS and CIT).  The importance of raising consumer awareness to counter the rising threats related to social engineering remains a key issue.

EAST Fraud Update 3-2021 will be produced early next month, based on the country updates provided at the Interim EAST Meeting.  EAST Fraud, Payment and Physical Attack Updates are available on the EAST Intranet to EAST Members.

The next meeting of this group, scheduled for 9th February 2022, will hopefully be the 1st EAST Global Congress, which is planned as Hybrid Meeting.  This is dependant on the prevailing status of the Covid-19 pandemic and the meeting will revert to a virtual Interim Meeting if required.

Online Fraud Group taken down in coordinated Police Action

An organised crime group (OCG) specialising in online fraud has been taken down by the Spanish National Police (Policía Nacional), supported by the Italian National Police (Polizia di Stato), Europol and Eurojust.

The OCG, linked to the Italian Mafia, was engaged in a wide range of online fraud activities such as phishing, SIM swapping and business email compromise (also known as CEO Fraud).  Hundreds of victims were defrauded and the illegal gains were laundered through a wide network of money mules and shell companies.  In just one year of operation the illegal profit is estimated at around €10 million.  The OCG was also involved in drug trafficking and property crime.

The successful combined police operation lasted over a year.

Overall results:

  • 106 arrests, mostly in Spain and some in Italy
  • 16 house searches
  • 118 bank accounts frozen
  • Seizures include many electronic devices, 224 credit cards, SIM cards and point-of-sale terminals, a marihuana plantation and equipment for its cultivation and distribution.

Criminal Network

The OCG was very well organised in a pyramid structure, which included different specialised areas and roles. Among the members of the criminal group were:

  • computer experts, who created the phishing domains and carried out the cyber fraud;
  • recruiters and organisers of the money muling;
  • and money laundering experts, including experts in cryptocurrencies.

Most of the suspected OCG members are Italian nationals, some of whom have links to Mafia organisations. The suspects, located in Tenerife in the Spanish Canary Islands, tricked their victims, mainly Italian nationals, into sending large sums to bank accounts controlled by the criminal network.

EFECCCross Border Cooperation

Europol facilitated the information exchange, the operational coordination and provided analytical support for the investigation. Two analysts and one forensic expert were deployed to Tenerife, and one analyst to Italy.  Europol also funded the deployment of three Italian investigators to Tenerife to support the Spanish authorities during the action day.

Europol’s Joint Cybercrime Action Taskforce (J-CAT) supported the operation. J-CAT is made up of cyber liaison officers from different countries who work from the same office on high profile cybercrime investigations.

EAST EPTF

The EAST Expert Group on Payment and Transaction Fraud (EPTF), which meets three times each year, focuses on the prevention of payment and transaction fraud, including SIM swapping and business email compromise, as well as related social engineering such as phishing.

To date the EAST EPTF has produced 20 Payment Alerts for EAST members, and has also published Fraud Terminology and Fraud Definitions to help standardise how fraud is categorised and reported.  The aim is for the terminology and definitions to be adopted globally when describing or reporting payment and terminal fraud.

Moroccan police arrest suspected cybercriminal after INTERPOL probe

An alleged prolific cybercriminal has been apprehended in Morocco following a joint two-year investigation by INTERPOL, the Moroccan police and Group-IB.  Acting under the signature name of ‘Dr Hex’, the suspect is believed to have targeted thousands of unsuspecting victims over several years through global phishing, fraud, and carding activities involving credit card fraud.  He is also accused of defacing numerous websites by modifying their appearance and content, and targeting French-speaking communications companies, multiple banks and multinational companies with malware campaigns, and is alleged to have helped develop carding and phishing kits, which were then sold to other individuals through online forums to allow them to facilitate similar malicious campaigns against victims.  These were then used to impersonate online banking facilities, allowing the suspect and others to steal sensitive information and defraud trusting individuals for financial gain – the losses of individuals and companies were then published online in order to advertise these malicious services.

Under Operation Lyrebird, INTERPOL’s Cybercrime Directorate worked closely with Group-IB and with Moroccan Police, via the INTERPOL National Central Bureau, in Rabat to eventually locate and apprehend the individual, who remains under investigation.  INTERPOL Executive Director of Police Services Stephen Kavanagh said: “This is a significant success against a suspect who is accused of targeting unsuspecting individuals and companies across multiple regions for years, and the case highlights the threat posed by cybercrime worldwide. The arrest of this suspect is down to outstanding international investigative work and new ways of collaboration both with Moroccan police and our vital private sector partners such as Group-IB.”

Group-IB determined that the suspect was involved in attacks on 134 websites from 2009-2018, leaving behind his signature name on web pages.  Its participation in the operation came under Project Gateway, an initiative which facilitates cooperation and information sharing between INTERPOL and private sector partners.

In May 2021 INTERPOL launched a new cyber operations desk to boost the capacity of 49 African countries to fight cybercrime. The Africa desk will help shape a regional strategy to drive intelligence-led coordinated actions against cybercriminals and support joint operations such as Lyrebird.

At a time of increasing cyber threats, members of the public, businesses and organisations are reminded to protect themselves from phishing attempts by following the advice showcased in INTERPOL’s #WashYourCyberHands and #OnlineCrimeIsRealCrime campaigns.

The EAST Payments Task Force (EPTF), which meets three times each year, focuses on the prevention of payment and transaction fraud.

National & Global Fraud Intelligence sharing – 4th Interim EAST Meeting

A fourth Interim Meeting of EAST National and Global Members took place on Wednesday 9th June 2021. Due to the Covid-19 situation, it was conducted as a virtual meeting. The meeting was chaired by Graham Mott from the LINK Scheme.  The key focus was on the sharing of global, regional, and national, payment and terminal fraud intelligence.

Law enforcement overviews were provided by Europol, the Gulf Cooperation Council Police (GCCPOL), the United States Secret Service (USSS) and INTERPOL.  Two presentations were made by Europol: one from the European Cybercrime Centre (EC3) covered recent successful cross-border operations; the other covered Physical ATM attacks across Europe.  The GCCPOL presentation covered payment and fraud issues seen by their 6 member countries focussing on Technological Fraud (crimes committed using different forms/types of machines and technology) and Non-Technological Fraud (conducted directly against the victim. The USSS presentation covered US Fraud Trends (2020/2021), along with prevention/detection techniques, and the INTERPOL presentation covered recent issues relating to financial crimes, money laundering, and asset tracing.

Private sector fraud intelligence updates were received from 31 countries, either directly or via regional/global updates by Citi, HSBC and Worldline.  Each update covered Fraud Types, Fraud Origin, Due Diligence and Physical Attacks (ATM, ATS and CIT).  A key issue, highlighted by most of the countries, continues to be the importance of raising consumer awareness to counter the rising threats related to social engineering.

EAST Fraud Update 2-2021 will be produced during July, based on the country updates provided at the Interim EAST Meeting.  EAST Fraud, Payment and Physical Attack Updates are available on the EAST Intranet to EAST Members.

The next meeting of this group, scheduled for 6th October 2021, will also be a virtual Interim meeting.  The 1st EAST Global Congress is now scheduled to be held in February 2022, dependant on the prevailing status of the Covid-19 pandemic.

3rd Interim EAST Meeting – National and Global Members

A third Interim Meeting of EAST National and Global Members took place on Wednesday 10th February 2021. Due to the Covid-19 situation, it was conducted as a virtual meeting. The meeting was chaired by Martine Hemmerijckx from Worldline.

Law enforcement overviews were provided by Europol and the Gulf Cooperation Council Police (GCCPOL).  Two presentations were made by Europol: one from the European Cybercrime Centre (EC3) covered recent successful cross-border operations; the other covered Physical ATM attacks across Europe.  The GCCPOL presentation covered payment and fraud issues seen by their 6 member countries – it focussed on Technological Fraud (crimes committed using different forms/types of machines and technology) and Non-Technological Fraud (conducted directly against the victim).

Updates were received from 26 countries, either directly or via a global update by Worldline.  Each update covered Fraud Types, Fraud Origin, Due Diligence and Physical Attacks (ATM, ATS and CIT).  A key issue, highlighted by most of the countries, is the importance of raising consumer awareness to counter the rising threats related to social engineering.

EAST Fraud Update 1-2021 will be produced during March, based on the country updates provided at the Interim EAST Meeting.  EAST Fraud, Payment and Physical Attack Updates are available on the EAST Intranet to EAST Members.

The next meeting of this group, scheduled for 9th June 2021, will also be a virtual Interim meeting.  The 1st EAST Global Congress is now scheduled to be held in October 2021, dependant on the prevailing status of the Covid-19 pandemic.