Representative scam summary

[joewein]

Related Link: http://www.joewein.de/sw/419representative.htm
URL Title: The company representative scam (by Joe Wein)

1. Introduction

When you receive an unsolicited email from a company looking for representatives to establish a business presence in other countries and more importantly, for transferring payments from customers, promising you 5-10% of those payments then you're dealing with a scam. No legitimate business will pay that much money for transferring legitimate payments because in all cases there are far cheaper and safer alternatives.

Offers that promise around 10% tend to be from Nigerian gangs, even though in many cases the companies claim to be Chinese (other countries where the companies are supposed to be based are Japan, Taiwan, Thailand, the UK, France, Australia and New Zealand). A similar scam run by Eastern European gangs usually involves ficticious European companies and promises around 5% of turnover.

The "representative scam" is a check fraud scam. It can work on a massive scale, causing damages from thousands to hundreds of thousands of dollars. Losses of several tens of thousands of dollars are very common. Most of the victims are from the USA and Canada because these are the countries where use of checks as a means of payment is most widely spread (Europeans and Japanese tend to make more use of wire transfers). The scam takes advantage of a misconception that many if not most people have that a check has been verified as genuine if it "clears" and money shows up in their bank account. In fact a check can bounce even after that. Not the bank but the person depositing the check is fully liable for any resulting losses.

In some cases, names of legitimate companies are abused when recruiting "reprsentatives". The criminals may even list the legitimate websites. They may register web addresses that are similar to the real companies' addresses. In other cases no real company by that name exists.

Any postal address listed in a representative scam is either fake or is the address of an legitimate company unconnected to the scammers. Most phone numbers used in the scams are either mobile phone numbers or "special service" numbers that redirect incoming calls to other phone numbers, such as the +44 70 numbers in the UK. All personal names used in the scams are either made up or are names of innocent people.


2. How the scam operates

The scammers are not Chinese (or even Asian) but Nigerian. They mail their "representatives" fake checks from "customers" to deposit in their personal or business accounts. The victims believe they are forwarding payments from customers in a sale by their employer but really they are sending their own money and neither a buyer or seller exists.

Often the checks are written on blank check forms stolen from legitimate businesses. Provided the business whose check is abused has sufficient funds in its account, the check will initially clear. The bank will make funds available in the account of the person who deposited the check. However, these funds are provisional. They are in effect lent by the bank against the promise that the deposited check is valid. You as the customer make that promise when you endorse a check during deposit. You and not the bank bear the full liability if the check is fraudulent! That is why you should never transfer funds on behalf of third parties, especially if you only know them via the internet.

When the check clears, the "representative" wires 90% of the amount to a bank account in another country, such as Japan, Taiwan, China, the Netherlands or the UK. Meanwhile the check gets forwarded to the holder of the account from which it is drawn, who will also see the money being debited from the account for the check they never wrote. This can take a month, but when it happens the check will bounce. Checks can bounce up to six months after they were written.

By that time the money is already out of the country and the representative is left to pick up the losses. The bank will debit the full amount of the check. For example, if a victim has cashed a $50,000 check and wired $45,000 to Japan, he or she will be left owing $45,000 to the bank even if they didn't touch one cent of the $5000 commission promised by the criminals.

3. The infrastructure of "representative" scams

"Representative" spams get sent from numerous sources at dozends of internet providers (ISP), mostly in Nigeria or satellite uplink providers. If an ISP is a major 419 spam source it probably is also a representative spam source. Replies to the spams are collected in reply maildrops and processed. The victims are asked for personal data and often are sent a contract to sign. After a week or two they may be notified of a "customer" who wants a payment. Often the criminals contact them posing as the customer: The emails come from the same sources as the signup emails, though the email addresses are different. Then the victims receive checks, which usually are mailed from Canada, the UK or Nigeria. The UK fake checks usually originate in Nigeria. The Canadian checks come from Nigerian gangs based in Ontario.

Once funds are made available by the bank, the criminals email the victims details of a bank account to wire 90% of the money to, their own money in effect. In some cases this may be a domestic account of another victim in the same country, or it may be a foreign account handled by a gang member in that country.

The receiving accounts are normally in the name of an individual or a different company name. The accounts may have been opened with fake ID or purchased from third parties who created them. The cash can be withdrawn using an ATM card, leaving little evidence where it went. The reason Far Eastern company identities are often used is that many countries in that region have weak banking oversight / strong banking privacy laws that make it easy to obscure the real account user. For example, Japan has a black market for established bank accounts and banks there do not normally send regular statements to a registered home address of the account holder. The Japanese police is reluctant to get involved when an account is used for international fraud that doesn't involves Japanese victims.

[full auto]

Excellent write up Joe, but I may have some related information on the representative end of the scam involving becoming a money mule for scammers in Eastern Europe (you can read more about it here if you want the IT Security version of the write up I'm about to water down).

What is a money mule? By definition it's someone who moves illegal goods or funds for fraud artists. A lot of Eastern Europeans are turning to this route as it provides a clean way to launder stolen funds. They pick up their money mules by offering them a "payroll job" to move funds (usually by Western Union or Money Gram), for which the mule keeps a small percentage of the money moved. For the people who have read this far, I suggest you look at the definition for the term "fall guy or scapegoat." You are basically helping the scammer launder stolen funds right to them via Western Union (or Money Gram), which is a hard form of payment to trace (which is why scammers love getting their money this way).

Now, I mentioned that this is becoming popular with Eastern European scammers... and there's a reason why. This is mainly because a majority of the scams coming out of that area of the world are highly technical in nature. Most of the time, they involve malware (trojans, viruses, spyware, etc). When you read this far, you might think "what do those pesky things have to do with fraud?" A LOT!!! Any infected computer has essentially had its data compromised. That includes stuff such as banking, paypal, credit card, email, identity, and any other information you've put in that computer. Having an antivirus and firewall is very important, but above that is playing it smart on the net. I'm seeing malware that is undetectable by the major antivirus companies, and believe it or not this is more common than you think. This is where the money mule for these scammers come in handy. You have banking or other fund information the scammers have pulled from a machine they've infected, how do they get it out? Do they send a wire transfer to their personal bank account? NO!!! That's to traceable. Instead, they use the money mule's bank account to wire them the money. The mule sends these scammers the money via Western Union (again hard to trace payment style), and wham! That mule is now a fall guy for money laundering.

It gets even better from here. If you read my IT Security blog post about this (granted... it's long and technical but worth a read for those in the antifraud movement), you'll notice I mentioned that the scammers were having their mules take "psychiatric tests" to see if they're fit for employment. That's utter bull, as that psychiatric test the mule downloads and runs actually unpacks a trojan on the machine. These scammers don't care if they set their mule up as a fall guy for money laundering, why should they care if they steal the mule's identity and financial information off of their computers?

The game is changing, and it's getting highly technical when it comes to representative scams. Be on your guard. If the job sounds too good to be true, it probably is.