The web seminar has not yet started: A sound check will be...

The Rise of Organized Financial Crime: The New Mafia

www2.acams.org/webinars

The web seminar has not yet started:A sound check will be performed 5 minutes before the start time.

COPYRIGHT NOTICE – USE OF WEBEX LOGIN/PASSWORD FOR ACAMS WEB SEMINARS

Each site license entitles registrant to one login: one phone connection (if accessing audio via teleconference) and one Internet connection for simultaneous Webcast, in one room where an unlimited number of listeners may participate.

Providing your login instructions and password to another for their use, using your login ID/password more than once, or any simultaneous or delayed transmission, broadcast, re-transmission or re-broadcast of this event to additional sites/rooms by any means (including but not limited to the use of telephone conferencing services or a conference bridge, whether external or owned by the registrant) or recording is a violation of U.S. copyright law and is strictly prohibited.


• Can you hear the sound check? • It has begun




Q & ATo send a question:Locate the Q & A box on the bottom right hand corner of the WebEx platform.

Type in your question and click send!


Welcome to the ACAMS Web Seminar

The Rise of Organized Financial Crime: The New MafiaApril 30, 2013

12:00 PM– 1:00 PM ET

The web seminar has not yet started.



Welcome to the ACAMS Web Seminar

The Rise of Organized Financial Crime: The New MafiaApril 30, 2013

12:00 PM– 1:00 PM ET




Chris SweckerAttorney/Consultant

Brendan BrothersVerafin Co-Founder


Co-founded Verafin (BSA/AML Compliance & Fraud Detection software company) in 2003

Computer Engineer with background in analytics

Anti-financial crime subject matter expert with comprehensive technical expertise

Frequent speaker at industry conferences

Principal presenter for Verafin’s thought leadership webinar series

Verafin has more then 1000 financial institution customers across North America

BRENDAN BROTHERSCo-FounderVerafin



Assistant Director, FBI, (Retired) - 24 years with FBI

As head of Criminal Division - led all investigations including public corruption, money laundering, organized crime/drug trafficking and financial crime matters.

Served as On Scene Commander in Iraq in 2003 - led team of Agents conducting counter-intelligence and terrorism investigations.

Led national task forces on corporate fraud, violent gangs, financial crimes, crimes against children, public corruption and organized crime and established the MS-13 National Gang Task Force and the National Gang Intelligence Center.

Global Security Director, Bank of America (2006-2009) - led investigations; physical security; international security, employment screening and executive protection.

Has testified before Congressional Committees on identity theft, crimes against children, mortgage fraud, human trafficking, financial crimes, information privacy and data compromise, crimes on the internet, drug trafficking and gangs.

Chris Swecker, Esq.



The Rise of Financial CrimeEnterprises: The New Mafia


Individuals and businesses depend more and more heavily on data and systems in the virtual world.


Some Statistics…

2.4 billion Internet users worldwide

2.2 billion email users worldwide

144 billion emails per day

68.8% of those emails are spam

634 million websites

51 million websites added in 2012


Every new technology opens the doors to new criminal approaches.


Cyberspace = Growing Opportunities for Organized Crime

The Internet, unfortunately, was not conceived with security in mind.


556 million victims of cyber crime

1.5 million victims per day

18 victims on average per second

83% of data breaches attributed to organized crime

Cybercrime 2012 Stats…


Cyberspace has proven to be a gold mine for criminals, who have moved more deeply into the domain as opportunities to profit continue to multiply.


It’s not LIKE the Mafia, it IS a Mafia running these operations.

The day money became the focus of malware is the day the Internet changed.


structured group

three or more persons

exists for a period of time

acts in concert

commits serious crime(s) to obtain direct or indirect financial or other material benefit

Organized Criminal Group (OCG)


acted either out of curiosity or the glory of spreading a virus they'd written

handled all aspects of an operation from phishing to building fake websites to cashing in on the fraud

Just a few years ago, most hackers…


Because of the Internet…there’s a radical distribution of labor and a radically fast ability to recruit skills

Cybercriminals Today

Specialize

Create markets

Entrepreneurial


…estimated 3600 OCGs (organized crime groups) active in the EU

some economies in FSU&CEE are known as cybercrime hotspots…


Why has Cybercrime become so pervasive…


Extremely profitable

Very low infrastructure cost and readily available attack tools

Hides under the cloak of anonymity, which in turn is protected by many governments across the globe

As it becomes a more profitable industry it is attracting an increasing number of individuals

Separation between the physical and virtual world

Off-the-shelf hacking

OCGs can conduct operations without ever making physical contact with each other


increasingly operating on network-style basis

70% composed of members of multiple nationalities

more than 30% are poly-crime groups

entrepreneurial in approach and business management

Organized Criminal Groups


High rates of unemployment make it easy for criminal organizations to recruit young masterminds

Cybercrime during the Recession


Râmnicu Vâlcea (only ~120,000 residents)

Law enforcement around the world have nicknamed it “Hackerville”

Internet scammers and their ‘co-workers’have turned it into a hub of international organized crime

Center of e-commerce scams and malware attacks on businesses

Cybercrime Central - the Silicon Valley of online thievery

Example: “Hackerville” – a Remote Town in Romania


July 2012 - local law enforcement and FBI apprehended 23 hackers who were later imprisoned for stealing $20 million from a thousand Americans.

“But here what else can you do? There is no work. The government speaks only of crisis and reduction of salaries. I am 24 and during University I have done nothing but sacrifice.”

(George, a citizen of ‘Hackerville’)

An Example is “Hackerville” in Romania


The Classic Business Model…

…has been adopted by criminal enterprises


LEGITIMATE ENTERPRISES


CRIMINALENTERPRISES

LEGITIMATE ENTERPRISES


Criminal Enterprise Model…


Profitability (or Retribution)

Corporate Mission

Organized crime is a multi-billion dollarbusiness and is growing in scale.


Executive Suite

Recruiters

Infantry

Help Wanted

Money Mules

Organizational Structure of Crime-as-a-Service (CaaS)


set up original business model and infrastructure

once get operation off the ground - move to business development role

make decisions, oversee operations, ensure everything runs smoothly

hand off ‘dirty work’ to others

not involved with launching attacks

Executive


larger organizations have affiliates who recruit and manage the infantry to infect the machines for them

set up recruitment programs (a.k.a. affiliate programs)

funded by the cyber criminal network executive

Middle Management Recruiters


bottom of chain of command - ground-level forces

initiate infection on a user’s machine

prolific cybercriminals can net up to $5 million per yearby controlling large botnet of malware infected PCs

many ways they infect computers - email links, SEO attacks, poisoned PDFs, compromised websites

leverage social networking links, malicious Websites, and poisoned media (e.g. Flash, QuickTime)

Infantry


people knowingly or unknowingly employed to launder OCG’s illicit gains

often recruited via ads (e.g. accounts receivable positions) on career sites

move money from one country or bank account to another

money shuffling typically done through anonymous wire transfer services (e.g. Western Union, Liberty Reserve, U Kash, WebMoney)

proxied or anonymous wire transfers important to avoid detection - often broken into smaller transactions to avoid triggering AML alerts

using several mules, anonymous services and various bank accounts -harder for authorities to trace funds - legal responsibility on the mules

Money Mules


Established to recruit infantry, recruiters and affiliate programs

Many originate in Russia (“Partnerkas”) – closed communities accessible by invite only

Others open to the public – to protect themselves include disclaimers on the site – e.g. “We do not allow spam or other illicit methods for machine infection”

In place to put the legal responsibility on infantry

provide infantry all necessary information to begin infection campaign.

illicit software, support forums, payment rates and tracking, method to receive payments after completing infections

Help Wanted Web Portals


Broad range of deliverables - consulting, services, advertising, large selection of programs (i.e. “product”)

Richer product features and more complex services command a higher price

Fundamental Laws of Economics


Non-Infected Computer


Infected ComputerNon-Infected Computer


1 hour - $10 USD

1 day - $30-70 USD

1 week - $150 USD

1 month - $1200 USD

Distributed Denial of Service (DDoS)


closing old sites and opening new ones like a game of “Whac-a-Mole”

for every malicious domain taken down – two more often pop up in its place

Domains


crucial to success - cyber criminals need locations to store attack content (e.g. exploit code, malware, stolen data)

may be official hosting providers or services posing as hosting providers that offer compromised systems for storage

typically offshore (often political safe havens – Russia, China) - turn blind eye to people purchasing space and illicit content stored

have been instances of US hosting providers linked to malware (e.g. CA based McColo before taken offline)

Hosting Providers


layered communication infrastructure

infected machines do not directly speak to operators of OCG

go through intermediate machines before reaching criminal operator

usually done through other compromised machines using technologysuch as a virtual private network (VPN)

goal is to complicate tracing efforts

main server typically exists for botnets that receives commands through intermediate (anonymous) servers

main server referred to as the “Mothership”

Anonymous Layers


OCGs keep track of key metrics how many infected machines they control how many bank accounts have infiltrated how much money have transferred from hijacked accounts

use commercial business process management tools, financial systems, databases and Web portals

manage everything from software development to accounts payable

Money Management


backend systems are varied and complex

extensive R&D groups create whatever the syndicate needs to attack and infect systems

custom-ordered code, private botnets, fake antivirus software, ransomware, deployment systems…

code is put through a QA process to ensure it functions and potentially evades security detection

Research & Development


OCGs connect with other organizations and distributors to grow their operation

Merger and acquisitions occur due to competition

Example - Zeus & SpyEy

Business Development


Protecting A Financial Institution Against Cyber Fraud


In 2013, organized gangs will perpetrate at least half of the cybercrimes againstfinancial services…as offshore gangs thrive and foreign governments look the other way.

Deploy layered fraud prevention… In particular, fraud prevention systems that provide user or account behavioral profiling and entity link analysis are useful in these cases.

(Source: Gartner)”

“


A layered security system affords the best protection, since no single layer is sufficientto stop determined bad actors from penetrating enterprise systems. ROBUST

LAYERED SECURITY

(Source: Gartner)”

“


EndpointCentric

Endpoint device identification, mobile location services

Secure browsing, OOB authentication and transaction verification


Navigation CentricEndpoint

Centric

Analyzes session behavior and compares it to what is expected


Navigation Centric

User and Account

Centric for Specific Channel

EndpointCentric

Monitors and analyzes user and account behavior, and identifies anomalous behavior


Navigation Centric

User and Account


User and Account

Centric Across Multiple

Channels and Products

EndpointCentric

Monitors and analyzes user and account behavior across channels, and correlates alerts for each entity across channels and products


Navigation Centric

User and Account


User and Account



Pattern Based Intelligence (Entity Link

Analysis)EndpointCentric

Enables the analysis of relationships among internal and/or external entities and their attributes (e.g., users, accounts, machines)


Navigation Centric

User and Account


User and Account



Pattern Based Intelligence (Entity Link

Analysis)EndpointCentric

Most effective way to protect a financial institution is from the inside out.


Cybercrime scheme involving computer intrusion techniques and malware

unauthorized transfer of funds from small business accounts to “temporary accounts” created for this purpose

accounts closed or abandoned after illicit activity conducted

more than 50 attempted transfers over 4 month period

more than two dozen transfers resulting in theft of ~$850,000

suspects used multiple banks and accounts

FIs filed more than 40 SARs and 20 CTRs detailing illicit activity and movement of funds

FinCEN able to identify network of individuals with connections to Russia and Eastern Europe

BSA Reports Can Play Key Role in Cybercrime Investigation


[email protected]



The Rise of Eurasian Financial Criminal Enterprises: The New MafiaFinancial Crimes Networks Far Surpass Traditional “Bricks and Mortar” Criminal Enterprises as Most Profitable Crime Model


Financial Crimes and Money Laundering Go Together Like: “Peas and Carrots”

Transactions involving criminal proceeds from financial crimes SUAs equals money laundering

Charles Intriago: ”It is the Atomic Bomb of the US in its arsenal against financial crime and other offense.”

Money laundering is a separate crime for each transaction

Criminal indictments in most cases include one or more money laundering counts


Sun Tzu

Know Your Enemy, Know Yourself

If you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you do not know your enemies but do know yourself, you will win one and lose one; if you do not know your enemies nor yourself, you will be imperiled in every single battle.


Traditional Organized Crime

“Fat Tony” SalernoJohn Gotti:

The Teflon Don


Drug Cartels: Bricks and Mortar Criminal Enterprise


Catalyst for a New Crime Paradigm: November 1989

The Wall Comes DownRussian Mob and KGB Run The Black Market


“Yaponchik” Top Thief in Law

Paid 15,000 for marriage to gain US Green Card

Arrested by the FBI in 1995 for extortion of $2.7 million from an investment advisory firm known as Summit run by two Russian businessmen

Established Russian mafia presence in US in Brighton Beach (“Little Odessa”) in 1992

Established “Daisy Chain” fraud schemes

BRIGHTON BEACH FOOTHOLD

Vyacheslav Kirillovich Ivankov


Simeon Mogilevich: Mob Boss Hiding in Plain Sight in Russia


Financial Crime Focus


The New Mafia: Crime as a Business

Viral

Global

Institutions and governments are prime targets

Developed fraud as an industry

Bad guy numbers increasing

Fraud opportunities increasing

Minimal risk of prosecution

Network vs. well defined hierarchy


FBI Director Mueller

International Organized Crime

The playing field has changed. We have seen a shift from regional families with a clear structure, to flat, fluid networks with global reach.

These international enterprises are more anonymous and more sophisticated.

Rather than running discrete operations, on their own turf, they are running multi-national, multi-billion dollar schemes from start to finish.

The Playing Field Has Changed


Chris SweckerFBI Assistant Director (Ret.)

To be effective (and compliant), AML and anti-fraud professionals must keep astride of an ever changing global landscape of adversaries and the threats they present, while constantly assessing their own strategies and capabilities to meet the threats.

New Paradigm


Mulay Hamid El Raisuli, Lord of the Riff, Sultan to the Berbers, Last of the Barbary Pirates.

You are like the Wind and I like the Lion. You form the tempest. The sand stings my eyes and the ground is parched. I roar in defiance but you do not hear. But between us there is a difference. I, like the lion, must remain in my place. While you like the wind will never know yours.

The Wind and The Lion: No Boundaries


Risk Management Perspective

Low Reward-High RiskLow Risk-High Reward


Fraud and Organized

Crime Intersect


Professional Criminals

Work in organized gangs

Multiple fraudulent identities

Target multiple organizations/brands

Detailed fraud systems knowledge

Continually test thresholds

Place and/or groom insiders

Use many products/brands concurrently

Operate multiple fraud modes & evolve continuously

Patiently operate below the radar

Work alone

Single identity

Target one organization

Limited understanding of systems

Little knowledge of thresholds

May know an insider

Focus on one product/brand

Focus on one mode of fraud at a time

Impatient & often greedy

Opportunistic Individuals

THE PROFESSIONALS

TREND

Enhanced focus on networking fraud data will detect and prevent both opportunistic and professional organized fraud

Traditional systems and software products using scorecards and profiling alone focus on only preventing opportunistic fraud


Evolution of the Eurasian Crime Wave

Staged Accidents and PIP Insurance Fraud


Staged Accidents Headlines

Eight Floridians Arrested for Staged Crashes

Canadian Police Arrest 43 from “Project Sideswipe”

Eleven More Including a Chiro Indicted in Florida Staged Crash Ring

Clinic Manager Gets 5.5 Year Sentence for Role in Staged Accident Ring

FL Staged Accident Ring Uses Food Trucks, Leads to 15Arrests Michael Zemlyansky

$400 Million in Claims

https://www.nicb.org/theft_and_fraud_awareness/multimedia?media=542aba81-9b0c-4cae-a454-d20600346829




InnovativeHealthcare Fraud


William Corr, Deputy Secretary HHS

The Health Care Fraud Threat

Criminals who commit health care fraud are becoming more sophisticated and are often organized crime enterprises.

They are preying on both providers and beneficiaries by illegally obtaining their provider or enrollment information and using it to submit fraudulent billings to Medicare and Medicaid.


Reported his attorneys prosecuted $638 million in healthcare fraud last year - indicting 197 individuals in 120 cases

Bank SARs played a “valuable role” in helping prosecutors identify fraudulent medical billings and payments allowing his office to return $40 million to Medicare

Miami HEAT Investigators advise over 90% of their healthcare fraud case initiations come from bank SARs

Most of these indictments include a money laundering count

Source: Florida International Bankers Association Anti-Money Laundering Conference

Miami U.S. Attorney Alex Acosta


Ouch! One Patient/85 Procedures/20 Months


Ringleader - “Thief-in-Law”member of select group of high level criminals from Russian and former Soviet nations

$163 million

Oct. 2010

Health Care Fraud Takedowns

73 defendants including Armenian-American organized crime enterprise


$200 million


$163 million

Oct. 2010 Feb. 2011

20 individuals including 3 doctors charged in fraud scheme




$200 million $295 million


$163 million

Oct. 2010 Sept. 2011Feb. 2011

Nationwide takedown charges 91 defendants







$163 million

Oct. 2010

$430 million

Oct. 2012Sept. 2011Feb. 2011

91 individuals charged with health care fraud-related crimes and MONEY LAUNDERING






Law Enforcement Too Far From the Action



$163 million

Oct. 2010

$430 million

Oct. 2012Sept. 2011Feb. 2011

91 individuals charged with health care fraud-related crimes and MONEY LAUNDERING



Health Care Fraud Takedowns - The Tally: > $1.1 Billion




EscalatingInternet Fraud


InnovativeHealthcare Fraud


Russian Business Network


Homeland Security Cyber Project

Network Scan Results All companies had what appeared to be fully compromised computers (remote desktop connections, backdoors, etc.)

All companies had some sort of nefarious activities - even ones with industrial grade enterprise security suites Most common threat appears to originate from Russian Business Network actors No APT detected over 4 week-long scans (Scanned 7 of 9 participants) Most/all vulnerabilities could have been avoided through common security practices

General Threat Findings Owners who outsource assume security rolled into service they are buying (it is not) Largely - very little to no formal security or IT policies exist No application of “defense in depth” Lack of security trained personnel on-site No active patch management performed


Eskola$130,000

Patco Construction $588,000

Sign Designs$99,000

Lifestyle Forms & Displays$1,200,000

Village View Escrow$465,000

Family Smile Zone$205,000

Genlabs$437,000

Ferma Corp$447,000

DKG Enterprises$100,000

Golden State Bridge$125,000

McFadden Law$250,000

http://krebsonsecurity.com/category/smallbizvictims/

What is it like to have $100K+ stolen? (and not have your losses covered)


* 2011 Javelin ID Fraud Survey, ** Use 25% of ACFE and FBI Average Reported Acct Takeover Fraud Loss of $200K

33

84

169

253

338

Impact .1% .25% .5% .75% 1%Victims 676 1.7K 3.4K 5.1K 6.8K

Business Bank Account Takeover676,000 Records

Avg. Loss = $50,000**

400

350

300

250

200

150

100

50

25

110

220

331

22

Impact 1% 5% 10% 15%Victims 35K 175K 350K 525K

Individual ID Theft3.5MM Records

Avg. Clean Up = $631*

Millions

S.C.Potential Exposure

400

350

300

250

200

150

100

50

25

Millions


Biggest ID Scam in US History Results in 111 Arrests

111 people made bogus credit cards as part of a Queens-based scam that cost consumers, banks and retailers $13 million

Scammers - members of 5 organized forged credit card and identity theft rings – had ties to Europe, Asia, Africa and the Middle East

New York Post, October 7, 2011


Good Guys Two Steps Behind

Law Enforcement Coordination Lacking

Limited jurisdictional reach and resources

Spotty forensic capabilities

High investigative/prosecution thresholds


Bad Guys Go Phishing!

Malware-infected phishing and spearphishing e-mails

Zeus virus installed itself and gathered usernames, passwords and financial account numbers typed by the victims on their own computers


Specializations

Coders or programmers

Distributors or vendors

Techies

Hackers

Hosters

Cashers

Tellers

Money Mules

Leaders


Operation Trident Breach: The Critical Role of “Money Mules”

FOCUS ON THE MULE AND HIS EFFORTS TO “MONETIZE”

Student or temporary work Visas

April to late September

Mules open multiple bank accounts

Mules share addresses

Common accounts

Frequent International money wires

Personal accounts with high velocity transfers business account

Eastern European Passports

INDICATORS

MONEY MULES: THE VULNERABLE LINK


ANTI FRAUD PROGRAMSDETECTION WITHOUT CONTEXT


The Whac-a-Mole Strategy


2 degrees

1 degree

Malignant Social Networks

How are they connected? Address Employment Phone numbers ID elements Accounts Financial transactions

Who knows whom? What people do these people have contact with? Do they have direct or indirect interaction?


WHY IS THIS IMPORTANT?MAKE LINKS AND IDENTITY GROUP ACTIVITY


Banks asleep at the switch need to wake up. . . [The] Bank Secrecy Act applies to more than just drug and terrorist financing.

Anne Tompkins - U.S. Attorney, Western District of North Carolina

Now that’s a warning!


18 U.S.C. 1956 outlaws four kinds of money laundering -promotional, concealment, structuring, and laundering of the proceeds generated by designated federal, state, and foreign underlying crimes known as “Specified Unlawful Activities”

AML PROGRAM UNDERPINNINGS

SUAs are predicate offenses committed or attempted under one or more of three jurisdictional conditions

certain financial transactions

laundering involving international transfers

stings


18 USC §1956(a)(1): Required Elements

a financial transaction

knowing that the property involved in the transaction represented the proceeds of some form of unlawful activity

which in fact involved the proceeds of SUA


230 “SUAs” Encompassed by 18 USC 1956

Bank Fraud Wire Fraud

Identity Fraud Health Care Fraud

Securities Fraud FCPA

Theft RICO/CCE/ITAR

Food Stamp Fraud State violations

Conspiracy & Attempts Aiding & abetting

1956 (h) has no overt act requirement


SIGNIFICANCE TO AML & FRAUD PROFESSIONALS

Criminal networks engage in serial group actions

Important to make links to discover the scope of the malignant social network

Most fraud and AML systems focused on singular behavior which enables perpetuation of criminal conspiracy

Thresholds hinder making associations

Practice of filing singular SAR and moving on is risky

Quality detections

Need for a “transaction” hinders prevention of losses

Detection of group activity leads to fewer false positives


CONCLUSIONS Financial crime violations are often organized, systemic activities

Detection of FCs will reveal money laundering and/or terror financing

Distinction between fraud and money laundering is a false one

Programs that don’t detect “group” activities will be at risk even if they are “compliant”

Quality detections plus link analysis will prioritize case work

Due to electronic filing and new data fields it’s a new day as FinCen’ s use of sophisticated analytical tools raises the bar

Effective use of real time detection and new analytic technologies to link disparate activities will become routine and expected

Type of business activity is relevant in detection of suspicious activity

Proactive strategies will become the norm


REVERSE THE ROLES!THE HUNTERSTHE PREY


[email protected] Swecker, Attorney/Consultant



If you have additional questions for today’s expertsor

suggestions for future web seminars

please send those to:

[email protected]

Thank you for joining us today!


Future Web Seminars


MAY 01 – AML Essentials: Examining the Key Components of anEffective AML Risk Assessment Model (Part III)Level: BasicNoon to 2:00pm EDT

MAY 15 – Focus on AML Audit: Improving Practices and ProceduresLevel: Intermediate/AdvancedNoon to 2:00pm EDT

JUNE 05 – Emerging Crime Trends in Digital Wallets and Mobile BankingLevel: Intermediate/AdvancedNoon to 2:00pm EDT

The web seminar has not yet started: A sound check will be...

Documents

Transcript of The web seminar has not yet started: A sound check will be...