A French national and a Belgian national ended up arrested late last month for their part in large scale CEO fraud.
The accused belonged to an organized crime group involved in at least 24 cases of CEO fraud causing $5.7 million (€4.6 million) worth of damage, according to a report from Europol.
The investigation was launched when French law enforcement — French National Gendarmerie — was informed two companies had fallen victim to CEO or business email compromise (BEC) fraud, with an estimated cost of $1.5 million (€1.2 million).
Since then, the investigation identified 15 Romanian company managers living in France and Belgian involved in orchestrating BEC fraud and Forex scams, Europol said. Money obtained from the BEC scams was sent via the Romanian company accounts to Hong Kong, according to Europol.
The two suspects arrested in France are thought to be recruiters and facilitators for the criminal gang; but not the masterminds. “The suspects arrested in Paris and Lille seem to be closely linked to the ring leader(s) most probably hiding in Israel, where computers and mobile phones have also been seized,” Europol said in a release.
Five house searches were carried out in different locations across Belgium resulting in the arrests of five suspects acting as money mules for the organized crime group, Europol said. A computer and nine mobile phones were also seized during the searches. The data extracted from the mobile phones will be analyzed by French law enforcement and cross-checked against Europol databases.
BEC fraud has become a major issue over the last few years. According to the FBI, worldwide BEC fraud netted $2.3 billion from 17,642 victims in at least 79 countries from October 2013 through February 2016.
The two people arrested in France helped people to establish firms with Romanian bank accounts. According to Europol these included law firms and notaries. An apparent email from the CEO asking for funds to be sent to a law firm in France acting on behalf of a known or fictitious supplier could appear both safe and compelling.
Unlike phishing, BEC carries no payload in the form of a malicious link or weaponized attachment. Without such a payload to detect, BEC emails are very difficult to flag with technology.