Europol reported Friday that eight suspects were detained and that the criminal network, comprised of French and Israeli nationals, targeted France-based companies. This kind of large-scale CEO fraud is also known as a Business Email Compromise scam or a “man-in-the-email” attack.
It is a scam in which the fraudster obtains the personal identifying information of an individual the victim knows and persuades them into transferring funds to an account thought to be trusted, when in reality it is controlled by the fraudster.
In most scenarios, the person whom the scammer contacts will be someone with authorization to access their company’s finances.
Such was the case in December 2021 with a French metallurgy company, whose accountants were fooled into thinking that their CEO had ordered the urgent transfer of 300,000 euros ($320,000) to a bank in Hungary.
As scammers almost always “return to the well”, i.e. target people they’ve successfully scammed earlier, the group attempted to request the transfer of an additional 500,000 euros ($534,000) a few days later. This time, however, the call was flagged by company investigators, who discovered that the call from their alleged CEO was actually made in Israel.
Around the same time, a Paris-based real estate developer was similarly targeted, but for much more. This time, the fraudsters impersonated the lawyers of a well-known French accounting company, Europol said.
Using their fake credentials as a shield, they persuaded the developer’s Chief Financial Officer to transfer roughly 38 million euros over a period of just a few days. The funds were subsequently laundered through bank accounts across Europe, before being funneled into China and then finally to the fraudsters in Israel.
French authorities became aware of the link between the two cases in January 2022, after discovering that the two scams had an identical modus operandi.
The investigation went international, with Croatian authorities uncovering the identity of those behind the group’s money laundering efforts.
Law enforcement across Croatia, Portugal, and Hungary subsequently managed to freeze over 10 million euros ($10.7 million) that were still being laundered through their respective banking systems.
The operation came to a head last month when police in France and Israel raided eight locations of interest and took the suspects into custody, as well as the equipment used in the criminal scheme.
The total value of all seizures made, however, amounted to only 5.5 million euros ($5.9 million), or roughly 14 percent of what was stolen.
