Mules. Villains or Victims?

Mule recruitment is an essential part of today’s fraud supply chain. Mules are used to launder money or ship stolen goods out of the country. So what are mules? Villains or Victims?

There’s a heated debate. The FBI’s acting chief of Cybercrime division recently said the agency considers prosecuting mules. Brian Krebs suggests mules are either not too bright or not too ethical.

I agree with Brian that you have many mules that follow one of these categories… But not all of them.

I’d like you all to meet Mary Long from Texas.

Mary, a 50-year-old former executive training coordinator for AT&T, fell victim to one of the most elaborate, deceptive mule recruitment operation I came across. She already shared many aspects of her story with the Wall Street Journal. In this special post I want to shed more light on what Mary went through, because it can be a lesson to many of us.

I personally got interested in talking to someone like Mary after the RSA FraudAction Lab exposed Air Parcel Express, a sophisticated mule recruitment operation that within a few weeks managed to have 1,925 US citizens applying to become logistics officers in a non existent company. Following is a fascinating interview, which will be a bit long, but bear with me – it is a journey into the mind tricks that criminals play on their victims.

***

Uri: The first thing I want to ask is - how did you end up contacting a non-existent company? Didn’t you check them out first?

Mary: You simply don’t understand. At the time I was unemployed for half a year; I subscribed to multiple job websites and they all sent me openings to my inbox. I was basically reading the synopsis and ended up replying ‘yes’ to every offer that made sense – the biggest economic crisis since the 30s isn’t a time to be picky! My CV was then sent by the job websites to the potential employers. So when an international logistics company called Advanta Transportation Network headquartered in Denmark emailed me back, I was thrilled.

Uri: What did the email say?

Mary: It was a great offer from. $65,000 a year, plus performance based bonuses, plus all the benefits, plus a company car, a blackberry, and all for a logistic project supervisor job in an international company that is actually recruiting in these troubled times.

Uri: Was there anything suspicious?

Mary: The offer itself seemed too good to be true. I remember showing it to Graham, my boyfriend; we just couldn’t believe it. We thought it might be a hoax, but on the other hand it might be absolutely real. But one thing we didn’t think about is that it’s an attempt to recruit me to a fraud operation. We simply didn’t think about the possibility that criminals are behind it. So we went to the website, it looked real. Too flashy perhaps, but that’s a matter of taste.

Uri: So did you accept the offer?

Mary: Not so fast. The original email described a hiring path that started with a 4 week from-home training. Training was done in the form of receiving emails with reading materials about the logistics business, international shipping laws, hazardous materials, taxes and tariffs. Every Friday I would receive a test that I need to pass. After this time I’ll be given a $3,000 check. If I pass the initial phase, I’ll be flown over to New York or London for a week of final interview and tests, expenses fully covered.

Uri: Sounds like a serious company.

Mary: Right. Many of these terms are unheard of in the US, but I figured out it’s a foreign company and they have their own standards. And although I was worried that it can all be some kind of sick joke, the level of details in the email was significant. It said for example that Texas is an important focus for Advanta because of their relationships with several utilities and gas pipeline operators. It mentioned facts, company names, detailed expansion plans in both Texas and the entire US. How many people are planned to be hired, what the priorities are, everything. So at the same day I emailed back, saying I accept the offer. A week later I received a confirmation email, including a contract I had to sign. It was already pre-signed by Advanta and carried the signature of an executive vice president.

Uri: What happened after you signed the contract?

Mary: I gave references, including their contact details. I was told the last step before training is an interview with a psychologist from Copenhagen; I was to wait for her to call.

Uri: You’re kidding me. How did that go?

Mary: At first the call didn’t connect, and then it did but the sound quality was horrible and I was stressed – after all, it’s a job interview. She had a thick, heavy accent, but I thought it’s only natural, after all the company is from Denmark. She asked lots of questions about previous experience and employment. When the interview ended I felt I had no chance to get the job.

Uri: But miraculously you passed with flying colors. Did you talk to anyone else?

Mary: In fact I did. After the initial exchange of emails and contract with the HR department, I was transferred to the capable hands of David A. Maeweather, the Special Projects supervisor based in New York. I talked to him over the phone to settle a couple of issues, and exchanged dozens of emails throughout my training. He said he was a NY Giants fan and always talked about them. Anyway, David and his assistant Danielle sent me daily study materials on shipment rules and customer relationships. Then I had my first weekly exam.

Uri: Was it very tough?

Mary: Not at all. I was quite surprised, actually. It was basically a task of figuring out where the answer was in the study materials, and then cutting and pasting it into the right place. I passed two more tests before Advanta approached me with a special project.

Uri: What sort of special project?

Mary: David didn’t say. He just explained that there are 4 more trainees in Texas that did just as well as I did, so excelling in the project can improve my chances and get me a better assignment once I’m hired. To do the project I’ll get an iPhone that will enable me to access the logistic application of the company; I’ll also get special security lessons to avoid information leakage.

Uri: this must be the mule operations application, where instructions are sent by the fraudsters to the mules. No wonder they wanted extra security measures.

Mary: The iPhone would be an end-of-training gift; I’m to buy it myself with a $500 transfer the company will make to my credit card account. But here there was a problem. David told me the transfer will be made to my card ending xx24. But I have no card ending xx24. I told David there was a mistake… And was utterly shattered when after ten back-and-forth emails in which we tried to resolve the issue and satisfy the requirements of the finance department, he returned saying he had to remove me from the project because without a valid card I cannot get the funds to purchase the iPhone;  and without the iPhone I can’t access the application and participate in the project.

Uri: This must have been really disappointing for you.

Mary: It was a huge let-down. I told David I can provide any number of cards or bank accounts so that the finance department can transfer whatever funds they want. And finally the finance department caved in and allowed me to send a card number for the transfer. I was so relieved. And it was a timely thing too, because the project turned out to be very important and urgent. You see, Advanta planned to open a new office in Europe, but got stuck without computers needed for the operation. The equipment department couldn’t find local suppliers that can ship reasonably priced computers in less than a month… Which is where I would come in.

Uri: Let me guess. You’ll get a transfer into your card account, buy the computers for Advanta, and ship it urgently to Europe.

Mary: Precisely. David reminded me it’s not a required part of my training, but let us think about it: a really easy task, which will improve my hiring chances and future assignments. It was a no brainer. So I said yes, and within three days the special project was in full gear… I received a purchase order for 2 Apple laptops, $5000 were deposited in my Capital One account through a transfer from Bank of America, and I got USPS pre-paid labels to use for ship the computers to the Advanta facility in the Ukraine.

And so everything was ready; but when I tried to use the card in an Apple store, my card company declined the transaction.

Uri: What did you do?

Mary: I called them to complain. They explained that the deposit was flagged as potentially fraudulent for some reason – I figured out it’s because that was the first time I receive such deposit – and although I confirmed to them it’s not, the best they offered was for them to send me a check in 2 weeks.

Uri: But this would be way too late for the poor guys stuck in Europe without computers!

Mary: Spot on. I was furious and frustrated. I’m going to fail in my first project, and maybe lose my chance for employment in an international company! So my boyfriend, Graham, bless his heart, had a brilliant solution. He paid with his OWN credit card, and we went home with the laptops, planning to call the courier the next day, so they can be shipped.

Uri: So after weeks of mind tricks and intricate social engineering, the fraudsters made you pay with your own credit card and ship $5000 worth of laptops to the Ukraine.

Mary: Yes… But thank god for Graham’s prudency. Hours before the courier came to collect the laptops he calls me and says: “Mary, stop everything. It’s all a scam”. The destination in the Ukraine rang an alarm bell so Graham spent time searching in the Internet. He found Advanta in www.bobbear.com, an online database of money laundering and mule recruitment scams. Which was just in time: I came close to committing a crime of accepting fraudulent balance transfer and liquidating it for the fraudsters.

Uri: This is worth explaining: Originally you were not supposed to be the victim. The real victim was a Bank of America cardholder whose account was compromised. The fraudsters entered his account and requested an unauthorized $5000 balance transfer to your Capital One account. After the balance transfer, the victim owed $5000 more to their bank; you got $5000 deposited in your card account. It was an effective way to funnel money from the victim’s account without any traces to the fraudsters: with the money you were supposed to buy laptops and ship them to the Ukraine. But when your issuer flagged the transfer as suspicious, you simply used your own money to buy the laptops.

Mary: Eventually I realized Graham is right, and it’s all a scam. I cancelled the shipment. I called Capital One and asked them to return the balance transfer. I went to the shop and returned the laptop. I filed a complaint to ic3.gov who handles Internet crime. I told Advanta the money was frozen by the issuer. And I wanted to tell my story to the world, so people will be more aware of what con artists and fraudsters can pull off.

***

Fascinating tale, isn’t it? And quite brave of Mary to tell her story to the world.

Had I asked you how many people will use their own credit card to buy $5000 worth of laptops and ship them to the Ukraine, you would have laughed. But the level of social engineering here was staggering. These particular mule herders are expert con men.

So, where do I personally stand on the FBI plan to prosecute mules? I definitely support it. I believe that with enough noise, this initiative can turn the tables on mule recruiters, who are having a golden age fueled by the bad economy. It will help folks like Mary understand the threat of accepting the wrong work-from-home job. That’s why she agreed to the Wall Street Journal interview to begin with: so other job seekers will be cautioned.

I do think that from an ethical perspective, the initiative should target the RIGHT type of mules, the ones who are willingly turning a blind eye to collaborating with a fraudster. These are easy to spot: they’re the ones who didn’t stop to ask questions after the first money laundering incident. There are mules who’ve sent hundreds of thousands of dollars abroad; these are the ones who should be put in front of a judge, to see if they are villains… or victims.