Massive scams with a global scope referred to as "the
forged international bank transfer order scams" have been
targeting for approximately the last two years, the subsidiaries of
large French companies located within the European Union or the
foreign subsidiaries of companies based in France.
From a French perspective, this phenomenon represents, over such
period, more than 400 attempted or committed offences, for which
the damages are estimated to exceed 200 million Euros.
According to the Serious Financial Crime Office of the French
Judicial Police (Office Central pour la Répression de la
Grande Délinquance Financière de la Direction
Centrale de la Police Judiciaire) (the "OCRGDF"),
which has identified with great precision the modus
operandi of these crooks, the authors of these offences all
operate by telephone. The tracing of the fraudulent transfers has
in particular enabled to determine that the funds identified to
China for final destination and more particularly banks in the
Zhejiang province.
To organize their "forged international bank transfer order
scams," the criminal organizations have broken down their
actions into several steps:
The Preparatory Acts For The Scams
Firstly, the criminal organization proceeds with the
"social engineering" of the targeted companies. To this
effect, the criminal organization purchases via the Internet, from
organizations such as "Infogreffe," the relevant
information on the company, i.e. trade and companies registry
extract ("K-bis extract"), indebtedness
situation, by-laws, articles of association, files of the last
instruments, minutes of the general meetings, annual accounts,
background of the amendments, etc. The complete company files, with
the names of all senior managers, their duties, telephone numbers,
signatures... It only costs approximately sixty Euros to obtain
such documents! A simple search on the Internet enables these
groups to establish the "social engineering" file:
company codes, logos, workforce, and even the "message from
the Director" ... and provides them with an overall vision of
the company, its language and trademarks.
The criminal organization then obtains the email addresses, fax and
telephone numbers to communicate with the future victim without the
latter being able to find out where the crooks are located.
All necessary elements for a targeted attack on a company are then
in the hands of the criminal organization. It is furthermore
indisputable that proceeding with "social engineering"
has been made easier through the advent of new technologies.
The Danger of the New Technologies
The use of prepaid payment cards, which are rechargeable for
purchasing information from Infogreffe, was identified by the
investigators. This type of card presents the advantage for its
incumbent of remaining anonymous and untraceable. However, the
subterfuge being revealed, crooks now frequently obtain the numbers
of bank cards pirated on the Internet to make their purchases on
Infogreffe.
The telephone resources rely on the same principle: purchasing
telephone numbers from dematerialized platforms with rechargeable
prepaid payment cards or pirated bank cards.
This simple process relies on the acquisition of telephone numbers
for a small amount (approximately ten Euros per month), provided
with the dialing code of the country requested. If the targeted
company is a foreign subsidiary of a French company, the telephone
and fax numbers purchased will begin with the French dialing code,
which will prevent the contact from becoming suspicious.
The Operating Mode
With the essential information of the targeted company and by
using an apparently French telephone number, a crook will call, for
example, a foreign subsidiary of the targeted company. He then
pretends to be the senior manager of the company and tries to
persuade his/her contact (generally the financial officer of the
subsidiary) to perform a bank transfer on a foreign account. The
crook justifies this unusual and urgent request through the
occurrence of an imminent tax audit, the performance of a stock
exchange transaction or differently, depending on his/her
imagination. While using varied and diverse psychological
stratagems such as threats or flattery, the crook will convince the
employee empowered to sign to perform the bank transfer.
The money will then be compensated, through an elaborate financial
system, between the different criminal organizations operating in
Israel, China, and France. These three countries were identified in
this scam according to the following scheme:
-
Israel as the rear base from where the crooks operate by telephone,
-
France as the country where the targeted companies are located, and
-
China (Beijing, Wenzhou (Zhejiang province) and Hong Kong) as the place of payment for the bank transfers.
Two groups of wrongdoers operating according to this modus
operandi have already been arrested in France in 2011 and 2012
thanks to the intervention of the OCRGDF. However, the phenomenon
is continuing. Furthermore, these criminal networks have now
understood that they have to train their teams in the English
language to extend the scam to a larger number of countries.
The fight against this organized criminality requires the
deployment of preventative actions by French companies, the banks,
and the specialized economic press to impact the largest possible
number of managers.
Therefore, when faced with this very efficient modus
operandi that is particularly damaging for the French national
economy, a reinforced attention from all companies is necessary at
all levels of their hierarchy.
In this field, a national and international
"public-private" cooperation is fundamental to act as
fast as possible with respect to the blocking of accounts, as the
money can circulate in more than three countries in less than 24
hours. The OCRGDF is in charge of centralizing the information on a
French scale for this type of fraud.
Several tools enabling companies to confront this type of fraud
exist:
Regularly Raising Awareness on Fraud
Internally. All associates in the company must be
warned and in particular the financial and accounting departments,
as well as those in foreign subsidiaries to reinforce the level of
attention.
Informing the Employees of the Dangers of the New
Technologies. Crooks can easily obtain very precise
data on the operations of the victim companies through social
networks in particular. It is recommended to remind employees of
the company of the importance of not providing information on
social networks that could be used at the expense of the company
(such as some personal data, the contact details or even the
schedule of the senior managers, any instrument bearing the
signature of a member of the senior management, the company
stamp...).
Auditing the Internal Bank Transfer
Procedures. It is also recommended to perform an
upstream identification of the potential weaknesses of the internal
bank transfer authorization and performance procedures as well as
compliance therewith by the financial and accounting
departments.
Establishing Efficient Internal Procedures to Secure
the Authorization and Performance of Bank Transfers.
In particular, the following can be contemplated: a strict multiple
signature system for all international bank transfers (some
software enables the blocking of any transaction that has not
obtained a counter-approval), a regularly modified electronic or
coded signature system, an intra-group verification procedure
enabling to recoup any payment request or even the use of the
intranet network of the company. It is important to exclude any
oral request from these procedures.
Implementing a Partnership With Banks.
Establishing procedures for a securitization of bank transfers with
banks can be particularly efficient.
The company that is the victim of forged international transfer
orders must by order of priority and urgently:
Block the bank transfers within the concerned banking
institution to stop the fund transfers. The reaction
time is indeed decisive in this type of fraud.
- Urgently appoint a law firm in the location where the fraudulently made bank transfers are credited (generally China) to block the transfer of funds on the bank account of the addressee of the bank transfers, through a procedure of preventive seizure of the concerned bank account.
- Lodge a complaint with the Public Prosecutor (Procureur de la République) having jurisdiction over the location where the offence was committed, inform the OCRGDF, and perform an internal investigation to prepare an extensive file on the fraud enabling to identify its stages.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.