» This Story:Read +|Talk +| Comments

'Money Mules' Help Haul Cyber Criminals' Loot

Network News

X Profile
View More Activity
By Brian Krebs
washingtonpost.com Staff Writer
Friday, January 25, 2008; 10:51 AM

The e-mail offer of a work-at-home job was a godsend to Deena Monroe, a Statesville, N.C., single mom who had just been laid off from her position as a warehouse supervisor. The prospective employer said Monroe's resume had been spotted on job search site Careerbuilder.com and offered her the chance to make a few hundred dollars a week completing sales for a marketing company based in Australia.

This Story
View All Items in This Story
View Only Top Items in This Story

Monroe said she researched the company named in the solicitation -- Adamant Global Pty Ltd. -- and concluded it was a legitimate firm. In mid-September, she decided to take the offer. She was asked to add an e-mail address to her account at PayPal, which the Adamant rep explained that she needed to transfer money on the company's behalf.

Soon after, Monroe received a deposit of $2,601 into her PayPal account, with instructions to transfer the money to her checking account, withdraw it and wire the bulk of the amount via Western Union to two separate addresses in India. She was told to keep 10 percent as her commission.

Less than two weeks later, Monroe received a terse e-mail from an eBay user who was curious when he might receive the new computer he'd won at auction, the one for which he'd sent precisely $2,601 to her PayPal account.

EBay investigated, concluding that Monroe's phantom employer had tied her PayPal account to a fraudulent auction. The auction site's verdict: She was responsible for repaying the full amount to the blameless auction winner. Monroe is now working two part-time jobs to pay the bills and to make the other victim whole.

"At first, the [buyer] was really mad and understandably so," Monroe said. "But I was just as irate because I had gotten taken, and there was nothing anyone could do about it."

Monroe was the victim of a "money mule" scam, in which criminals make use of third parties (often unsuspecting victims like Monroe) to launder stolen funds. Mule recruitment is an integral part of many cyber crime operations because money transferred directly from a victim to an account controlled by criminals is easily traced by banks and law enforcement. The mules, therefore, serve as a vital buffer, making it easier for criminals to hide their tracks.

According to Bob Harrison, a U.K. resident who has tracked thousands of money mule operations on his Web site (www.bobbear.co.uk) for the past five years, several new mule sites are popping up every day.

"I've seen a tenfold increase in these sites since 2003, and the back-end operations behind them are becoming more sophisticated and automated," Harrison said.

Harrison said he receives e-mails from at least three money mule victims per week, and many more from would-be money mules thanking him for identifying the latest recruitment scam sites. The retired communications engineer said he uses various search engine optimization techniques in an attempt to ensure his site is returned higher in the rankings before any given money mule site, with the aim that potential money mules researching an innocent company whose good name is being used by mule sites will turn up his profile pages before landing at the imposter's site.

One factor making it easy for criminals to recruit mules is the emergence of easy money transfer services like PayPal. Sensitive data like bank account numbers and bank routing numbers aren't needed for mules to move money. Instead, many mule operations simply ask recruits for the e-mail address tied to a PayPal account, or to add a second e-mail address to it.

The mule recruiters also have perfected the art of impersonating established online businesses. In nearly every money mule scam, the fraudsters build fake store fronts by copying the names, trademarks and Web content of legitimate online companies. In Monroe's case, the scammers had stolen all of the content (save for the contact information) from the Web site of the real Adamant Global Pty (adamantglobal.com.au) and copied it over to the counterfeit site at globaladamant.com, the domain advertised in recruiting e-mails.


CONTINUED     1        >

» This Story:Read +|Talk +| Comments
© 2008 The Washington Post Company

Network News

X My Profile
View More Activity