Los Angeles: Stories of the BEC Victims (part 2)

In my last blog post, Los Angeles Court charges 80 Nigerians with BEC and Romance Scam Crimes, we laid out the background of a major BEC investigation and telling the stories of six victims, but the court documents shared the details from thirty cases.

Footage from CBS Los Angeles of the arrests

In our previous post about this Los Angeles-based BEC Fraud Ring, we shared that the primary defendants, Valentine IRO and Chukwudi IGBOKWE had their phones seized in a search warrant.  The forensics evidence from their phones helped to identify their army of co-defendants who ran the scams using bank accounts established by IRO and IGBOKWE to launder the money.

Victim Company 3 - December 2016 BEC Fraud 

VC3 is a small landscaping services company in Oklahoma.  On 19DEC2016, they wired $18,457.13 from their Chase bank account to a US Bank account (2982). They received an email with wiring instructions for purchasing some equipment.  The next day, a fraudster sent NEW wiring instructions, claiming to be a correction to the previous day's communications.  The receiving US Bank account had a balance of -$408.51 when the transfer arrived.  Two ATM withdrawals were made the following day for $300 and $500, and a cash withdrawal of $8,500 was made from a teller at a bank branch the same day.  On December 27, 2016, US Bank sent the remaining funds back to the originating Chase bank account after the fraud was discovered.

In chats between MANSBANGURA and IGBOKWE the two reviewed which of their receiving accounts were "strong" and which were "under review."  The US Bank account was discussed, with IGBOKWE saying "Pls do not used XXX's us bank for any transaction. If u put money there It will get stuck. Never come out ... There is a restriction on d account."

The same US Bank account (2982) was also provided to several other romance scammers and BEC co-conspirators between November 21, 2016 and March 1, 2017.

Personal Victim B.Z. - Elder Fraud Victim

B.Z. is an 86-year old man with dementia and Alzheimer's who was repeatedly a victim of financial scams.  His son met with the FBI and explained the range of scams he had fallen for.  In 2013, his father joined a dating site and was scammed by a 37-year old Ghanaian woman who convinced him to invest $100,000 to purchase an apartment complex.  Later the woman was kidnapped and shot at the airport as she was bringing him a gold bar to repay him.  The man insisted on flying to Ghana to help her, but the family intervened.  In the current scam, Federal Reserve Chairman Ben Bernake and US Treasury Secretary Steven Mnuchin had let him know he was about to receive $107 Million.  He sent $11,900 to a Chase account (7605) that belonged to "T and F Enterprises."

March 14, 2017 - ONUWA told IGBOKWE that he wanted to use the Chase 7605 account for this scam.  He replied "OK"

March 16, 2017 - B.Z. transfers $11,900 from his Chemical Bank account in Michigan to the Chase 7605 account.

March 16, 2017 - ONUWA sends a photo of the application and agreement for wire transfer to IGBOKWE.

March 22, 2017 - ONUWA and IGBOKWE discuss how defendants IGBOKWE and MANSBANGURA would withdraw the funds from B.Z.'s wire transfer.

March 24, 2017 - IGBOKWE tells ONUWA the funds are "out" and ONUWA provides IGBOKWE his Nigerian bank account number.

March 27, 2017 - MANSBANGURA cashes a check for $4,000 from the Chase (7605) account. Memo: Rent

April 4, 2017 - IGBOKWE provides ONUWA his Nigerian bank account number with instructions to pay 3,123,000 naira (about $8500 current value).

April 6, 2017 - IGBOKWE provides ONUWA's name and Nigerian bank account number to IRO, with the request to pay 1,000,000 naira to the account (from IGBOKWE's telephone number: +1.213.425.8827).

April 6, 2017 - IRO provides ONUWA's name and Nigerian bank account to another unindicted co-conspirator with directions to pay the 1,000,000 naira.

Victim Company 4  - March 2017 BEC Fraud

Victim Company 4 was a dry food products company in Michigan that imports grains for resale.  Employees of VC4 believed they were communicating with another Michigan Company, when in fact they were communicating with fraudsters who had hacked Michigan Company's email accounts, implementing forwarding rules that caused their emails to be sent to the fraudsters.  FBI agents interviewed personnel at both companies and learned that on March 29, 2017, VC4 was tricked into wiring $29,679.17 to a Wells Fargo bank account (7245) believing it was the Michigan Company, when in fact it was a company opened in Whittier, California, under the name "Danisha Beauty Sales" on January 5, 2017.

The day the wire was made, the starting balance on Wells (7245) was $3.60.  After the funds arrived, they were used to make a $1,419.73 purchase at a Best Buy in Hawthorne, California, and a $300 cash withdrawal.  On March 31, 2017, the Wells (7245) account received an additional wire of $27,464.89, this time from a South American tour company (likely also a BEC victim).  Two checks were paid out from the account that day.

March 21, 2017 - VC4 receives fake email requesting $29,679.17 payment.

March 22, 2017 - $29,679.17 - VC4 wired to Wells (7245) from a BBVA account in Colombia  belonging to VC4.

March 22, 2017 - Best Buy shopping ($1,419)

March 27, 2017 - IGBOKWE sends to UMEJESI the Wells (7245) account info with text "Prefer make u use this one becaue the money wey dey enter too much)

March 29, 2017 - IGBOKWE sends UMEJESI a screenshit of the VC4 Wire Transfer confirmation.

March 29, 2017 - IGBOKWE sends the wire receipt to UMEJESI.  UMEJESI forwards it to IRO's Samsung phone.  IRO replies "Who gave you this slip.  Tell me his name."  UMEJESI replies "Kudon" (a nickname for IGBOKWE). "Because I gave him this ulo ako 4months ago and I'm surprised him sending me this."  IRO then reaches out to UMEJESI.  He responds "Mine is 29175 and 26." Apparently there was confusion over which scammers were to be using this account.

March 31, 2017 - $27,464.89 - SouthAmericanTourCo wired to Wells (7245)

March 31, 2017 - $11,160 check to UMEJESI 

March 31, 2017 - $16,520 check to OJIMBA (Ojimba Collins) 

(those checks deposited by the defendants into two separate Chase bank accounts -- (Chase 7290) and (Chase 1767) both in Inglewood, California.  UMEJESI sent IGBOKWE the userid and password information for the account holder's Wells (7245) account.  The account owner, a female, was walked into the bank by UMEJESI according to the text messages between UMEJESI and IGBOKWE. IGBOKWE later texts the Chase deposit slips to UMEJESI.)

April 1, 2017 - $4,000 cash withdrawn

April 1, 2017 - IGBOKWE sends messages to UMEJESI explaining the breakdown of funds -- "Our money is 11,840. There own money is 17,760.  $29,600 * 40% = 11,840" -- indicating that they were receiving a 40% commission for doing the money laundering on someone else's BEC scam.

April 20, 2017 - Wells Fargo seizes the remaining $23,531

Victim Company 5 - April and June 2017 

This Victim Company had someone attempt to steal their entire corporate coffers!  At IRO's direction, a fraudulent company was opened in the name of VC5 with papers filed in Los Angeles County to create the corporation.  Those papers were then used to set up a Chase bank account.

Feb 17, 2017 - IRO tells IGBOKWE to have MANSBANGURA take one of her mules to open a bank account in the name of VC5.

Feb 22, 2017 - MANSBANGURA causes her mule to open the account (Chase 5027).

March 20, 2017 - IGBOKWE sends IRO the account information, with account and routing number.

March 27, 2017 - IRO provides the account details to OGUNGBE in request for "an aza for 3m$ from Philippines today".  (An "aza" is Nigerian slang for a bank account - he needs an account that could credibly receive $3M, and IRO provides this one.) 

April 4, 2017 - Wells receives a counterfeit letter "from" VC5, notarized and with the forged signature of VC5's CEO, requesting that his Wells Fargo account be closed and all funds transfered to  (Chase 5027) -- a balance of $17,300,844.58! 

April 4, 2017 - a caller to Wells, pretending to be from VC5 asks them to confirm receipt and closure of the account

June 5, 2017 - Wells Fargo receives via US Mail a second letter, again requesting that the Wells account of VC5 be closed and that all funds be sent to (Chase 5027) -- a balance of $12,760,922.93!

Both of those account takeovers failed because they were detected by bank rules.

Personal Victim A.V. - April and May 2017 Elder Fraud Victim

A.V., an 87-year old woman whose property is now under guardianship by the county Department of Health and Human Services, lost $555,013.26 to fraud in less than a year, and at least $75,000 prior to that.  Related to the current charges, A.V. sent two wires of $8,035 to Wells (1147) and two wires of $6,060 to Chase (5027).  On interview, A.V. said she had sent the Chase wires from her Capital One account to assist her first cousin who had gotten married and moved to Thailand.

IGBOKWE and CHILAKA were involved in these scams.

April 10, 2017 - IGBOKWE and CHILAKA discuss funds they are anticipating will be deposited into Wells (1147).

April 11, 2017 - A.V. wires $8,035 from her Capital One account in Maryland to Wells (1147).

April 11, 2017 - CHILAKA sends IGBOKWE a copy of the wire transfer requests.

April 17, 2017 - IGBOKWE sends CHILAKA info for a Bank of America account (3037) after being asked "Give another without Nija name".  CHILAKA then asks "Can this be used f Ali?" --  ("Ali" is the term that the Nigerian scammers use when referring to BEC scams.) .  IGBOKWE replies "No." and then "If u need aza for Ali let me know."  ("aza for Ali" would mean "a bank account to be used in BEC wire transfers.)

April 27, 2017 - A.V. wires $2,700 from her Capital One account to Chase (5027).

May 8, 2017 - IGBOKWE and MANSBANGURA are discussing the A.V. fraud and mention "we cannot use that account for any transactions from Capital One anymore." MANSBANGURA says "Chase said they will force the money back to sender. Once it posted, Chase put a hard hold on it because they want to make sure it is NOT A FRAUD money."  MANSBANGURA told IGBOKWE "No more Capital one transactions to Chase."

June 2, 2017 - CHILAKA sends IGBOKWE a voicemail from A.V. "for Mr. Davis" explaining that she has instructed her Chase banker to release the $3,360 wire. 

June 2, 2017 - IGBOKWE sends CHILAKA an audio recording of MANSBANGURA calling Chase Bank asking about the status of the wire.

Personal Victims Je.F. and Jo.F. - April 2017 Escrow Fraud

The "F Family" lived in Illinois and were purchasing land in Texas.  As they were discussing how to fund the purchase, it is clear that fraudsters were intercepting their emails and injecting themselves into the conversations.  In particular, the F Family received emails that used the same email userid as the escrow company's email, but used the domain "mail.com" instead.  The same fraudsters were also sending email TO the escrow company, imitating the "F Family"'s real gmail account, using a slightly different gmail address.

April 9, 2017 - Je.F. receives instructions to wie funds to a Chase (6217) account opened by a money mule in Los Angeles.  EKECHUKWU managed this mule, who opened the account at the request of IRO.  A nearly identical account had been previously opened by CATHEY at the request of IRO in the state of Georgia earlier in April 2017.)

April 17, 2017 - Je.F. sends $135,800.72 from their BMO Harris Bank account in Illinois to the Chase (6217), believing they are paying for the Texas real estate and closing costs.

April 18, 2017 - EKECHUKWU asked IRO "anything coming in the warehouse?"  ("Warehouse" was one of the code words the crew used to refer to a bank account that should be receiving funds from one of their scams.) IRO gives the details for Chase (6217) saying "Check this. Something is inside" the following day.

April 19-20, 2017 - IRO discusses the F Family fraud with ANOZIE and AZUBUIKE.

April 19, 2017 - IRO complained to EKECHUKWU that Chase called the account holder wanting the money back.

We still have 18 more BEC Victim and Romance Scam Victim stories JUST FROM THIS CASE, so we'll continue this blog, probably in three more parts.