Operation Skein: The Irish Garda Target Nigerian BEC Criminals

It seems nearly every week that the Garda National Economic Crime Bureau (the GNECB) announces a new arrest in Operation SKEIN.  In a newly released featured interview, Ireland's "The Journal" had Detective Chief Superintendent Pat Lordan, and Superintendent Michael Cryan of the Garda National Economic Bureau discuss what they described as "a pandemic boom in scams." 

Chief Supt Lordan says "fraud has changed from a cottage industry to a global organized crime epidemic." 

Det Supt Michael Cryan and Det Chief Supt Pat Lordan lead the GNECB
(photo from The Journal, click image for full story)

"The GNECB now believes, and arrests have proven this, that financial fraudsters, particularly an organised crime group with origins in West Africa are operating in Ireland."

Cryan says: "It is at the highest level of scams. At the bottom of the ladder you have the money mule, a boy or girl letting money be laundered through their account.  Then there's the mule herder, who we have found in Ireland -- they are the next level up, acting as a handler for the mules.  There is a next level up then, managing operations across the region.  From examining phones we've seized we found messages from West Africa set to people in various countries. They send out a message to the herder looking for an account, for example, that can manage two or three thousand euro." 

Lordan says they have managed to recover more than 25 million Euros by freezing accounts before the full amount could be withdrawn, including $500,000 stolen from an American company based in Ireland.

The Egmont Group, a partnership of 166 financial intelligence agencies around the world, including the GNECB, has been a great help in recovering funds.  The FIU.net group within Europol has also been helpful in making contact with other police financial intelligence units.

Cryan says "the money is coming victims across the globe" citing an example of a €3.8 million transfer from Lebanon or Syria into an Irish account.  He claims at least €15 million from businesses in Chile, Russia, China, and Palestine are flowing into the country, but the directions for how to receive and handle the money? Those are coming from messages on the phones sent from West Africa.

Targeting The Young (Mules)

In an interview with the Independent, (See "They put 10k in my bank account and I had to get it out. Now!")  Det Chief Super Lordan said they were currently running at least 40 investigations into online fraud, but was gravely concerned about young money mules.  He relayed the story of an arrest in Kerry where the 18 year old subject was running a network of 51 money mules from his home!  He had received over €70,000 in the proceeds of international invoice redirection fraud that had moved through those accounts, and the amount being moved each time was increasing.  The mules were between the ages of 16 and 24 and all knew their recruiter.  Many were recruited via Snapchat or other social media through advertisements offering to pay €300 or €400 for the use of their account.

The young lady whose story is the headline says she and her friend were walking in Ballyfermot and a local guy she knew approached them. He had a friend trying to send him money and his account wasn't available.  Could he use hers? He only needed it for five minutes.  He instructed her to hand over her card and he sent the details to his colleague.  Minutes later there was  €10,000 in her account and she began to realize she was in trouble. He dragged her all about town trying to withdraw the funds via ATM and in person counter transactions. She was told to withdraw the cash from the teller window in pounds rather than Euros, but she could only get  €2000 from the teller and the ATMs only let her take  €500 per transaction.  Soon her card was blocked. The men disappeared and she called the Garda.

Operation Skein

The current focus of the Irish Garda is called Operation Skein.  The operation focuses on a form of international Business Email Compromise (BEC) that begins with Invoice re-direction fraud and ends with money being laundered through bank accounts first in Ireland and then around the world.  Operation SKEIN was launched in June of 2020.  The name is possibly based on the word used in Knitting.  A Skein of yarn (like these from an Irish knitting shop) is arranged so that when you pull the string, it just keeps feeding the knitter. High praise to the gardaí for continuing to pull the string and achieving arrest after arrest!

Three Skeins of Irish Yarn (thisisknit.ie)

Earlier and parallel operations include Operation Joggle and Operation Boxplot.  Both also involve Invoice Redirection Fraud, the preferred Garda term for what we would call BEC in the USA.   By reviewing Irish press and Garda Press Releases, we can learn just how extensive these on-going investigations have been.

A Long Skein of Arrests 

31JUL2020 - Operation Joggle - a man in his 30s arrested in relation to international invoice redirection frauds totaling  €110,000 in West-African directed fraud

21AUG2020 - Operation Joggle - a fourth arrest in Operation Joggle involving two international invoice redirection frauds totaling  €36,000. So far Operation Joggle has led to searches of fifteen premises in Dublin, Louth, Meath, Kildare, and Laois going back to September 2018.

#3/#4 - 14OCT2020 - two men, one in his teens and the other in his 40s were arrested after searches in Dundalk, Tralee, and Dublin.  At this time, over  €4,000,000 has been laundered through bank accounts in Ireland.  

29OCT2020 - a man in his 20s arrested as part of Operation Skein investigating invoice redirect fraud has now been charged. He was held at Tallaght Garda station. 

29NOV2020 - Operation Joggle - a man and woman arrested for trade-based money laundering as part of an ongoing investigation into a West African organised crime gang involved in trade-based money laundering worth €14.6 million over two years!)

#5/#6/#7 - 08DEC2020 - three men arrested after searches in Dublin 2 and Dublin 8.  All three are in their 20s.  

#9/#10 - 03FEB2021 -  a 37 year-old man and a 37 year-old woman were arrested (and the female released without charges) and "a large amount of stolen property was recovered" after searches in Dublin 9 and Dublin 12.  The property was purchased via the proceeds of Business Email Compromise / Invoice Re-Direct Frauds which occurred in Asia during December 2020.  Purchases were made in Dublin over the Christmas period in 2020.  (At this time, Operation Skein had identified €6,000,000 stolen worldwide of which €5,000,000 was laundered through accounts in Ireland.  90 suspects have been identified throughout the country!) Reporting in The Independent revealed that the man arrested in Crumlin was a Nigerian, and that the woman, arrested in the Santry area of Dublin, was from Ghana.  They were arrested after victim funds from Dubai and Hong Kong were duped in separate invoice redirect frauds.  Ireland's The Sun says the man, from Nigeria, is suspected of being a leader of the organised crime gang. Just in December, he moved €55,000 through one of his accounts. 

The two spend €33,000 in Grafton Street, Dublin, between St Stephen's Day and December 31.
(photo from Independent.ie, click for their story)

More seizure photos from RTE.ie (click for story)

#11 - 25FEB2021 - a woman in her early 40s arrested after a search in Monaghen.

#15 -  15MAR2021 - The 15th individual arrested in Operation SKEIN was described as "extremely significant" by gardai speaking to Ken Foy of the Irish Independent.  Detectives found a number of fake ID documents at his home in Naas and said "this Nigerian national has played a key role in the international crime gang involved in the massive fraud operation.  He can be described as money management in that he is suspected of recruiting money mules and then managing their accounts. He decides what goes in and what goes out of the bank accounts and is deeply involved in the coordination of where the money goes."  He had been arrested two years earlier opening a bank account with his real name but a fake passport, and is believed to have been continuously involved in fraudulent finances since that time. He is closely tied to arrest #9 above, the 37 year old living in south Dublin "considered one of the main players in the mob." The investigation also revealed that the gang is using Irish-based women from Ghana and Zimbabwe in their schemes.

#16 - 19MAR2021 - a male juvenile arrested after searches in Tallaght, County Dublin. 

#17 - 07APR2021 - a 29 year-old woman arrested in Dublin. (The Garda Press Office actually called her #16, but we already had #16 and the next pair "bring to 19 the number arrested" so ...)

#18-19 - 15APR2021 - a man and woman in their late teens, arrested in Longford as part of both Operation BOXPLOT and Operation SKEIN were released without charges. 

15APR2021 - four men, ages 23 to 35, were arrested after searches in Cork, Tipperary, and Roscommon.  Three were arrested as part of Operation BOXPLOT, which targets a Criminal Organization based in the North Cork area, believed to be laundering the proceeds of international invoice re-direct (BEC) fraud through bank accounts in Ireland.  The fourth was arrested under Operation SKEIN, which targets a Criminal Organization based in Ireland involved in similar international criminal activity.  Later in the day, a fifth person was also arrested as part of BOXPLOT in County Westmeath.  

Reporting in the Sunday World (See "Five Men arrested in operation targeting multi million euro fraud") revealed that four of the men were Romanian and one was Nigerian.  Atttention was drawn to the group when a female associate was arrested in County Tipperary late last year when she attempted to withdraw €31,000.  The money was suspected of being the proceeds of an Invoice Redirect Fraud (BEC) where a Hungarian company was targeted by criminals in Ireland. "Senior sources" called the arrest of the Nigerian "highly significant" as he has close links to the main garda target of the operation which targets multi-million euro fraud.  Sunday World's source went on "What is unusual about this case is that it has shown that Romanian and Nigerian crime gangs are working together in Ireland in relation to a huge money laundering conspiracy.

According to The Journal, €65,000 was frozen in 14 bank accounts controlled by the Romanians, along with €31,000 in cash and €3,000 worth of alcohol.  The group was charged with laundering €1.5 million with funds from a variety of sources, including cyber fraud, organized prostitution, and theft. 

#WhoKnows - 16APR2021 - two additional people, another man and woman in their late teens, were also arrested in Longford as part of both Operation BOXPLOT and Operation SKEIN.  I give up on counting because this release says 5 people were arrested on 15APR and two more on 16APR "which brings to 19 the number of persons arrested."

18APR2021 - a man arrested in his 20s after a search in Clondalkin.

23APR2021 - a man in his 20s arrested after searches in Ennis, County Clare. 

02JUN2021 - Balbriggan, County Dublin - a 32 year-old man arrested who is said be the 3rd leader arrested in Operation SKEIN.  The criminal organization to which he belongs is said to have "stolen over €14 million worldwide in invoice redirect frauds/BEC frauds with at least €8 - €9 million laundered through the bank accounts of gang members and money mules all over Ireland." This man is described as a leader because of his role in recruiting money mules and directing the laundering of the proceeds of crime through multiple bank accounts.  A large amount of potential evidence was seized, including phones, laptops, bank cards, and other documents.  According to the Independent, the arrested man "is suspected of having links to the feared Nigerian crime organization called Black Axe." They continue, "The detained man is an expert computer programmer who works for a company who is contracted to a major multinational corporation based in Dublin." He is tied to >€10,000 in Smishing profits,  €60,000 in an Invoice Redirection fraud against an Irish company, and  €250,000 in fraud against an Irish bank. €120,000 in funds in another of his accounts may be linked to the proceeds of a major fraud in Germany in which there were five victims.  He is one of 30 arrested so far in 2021 as part of Operation SKEIN. 

18JUN2021 - a man in his 30s arrested after searches in Milltown area of Dublin 14. 

24JUN2021 - Limerick - a suspect in his late teens was detained for laundering  €139,211 through his bank account, sending invoice redirection fraud funds to Russia, Slovakia, Taiwan, India, and South Korea. The funds were then forwarded on, primarily to Turkey and Germany.

More Details From Court

American audiences may not understand that in Ireland and much of Europe, the name of an arrested person cannot be shared until the person is charged before a prosecutor, so in many cases, we do not yet know the names in the cases above.  But there are exceptions.

Steven Sylvester, aged 27, claimed asylum from Nigeria six years ago and has since married a woman from Dublin and had a child with her.  He continues to draw welfare from the state, living at The Alley Apartments, Fairgreen Street, in Naas, County Kildare. He faces five counts of money laundering, four charges of handling stolen ID cards, and one count of using a false passport to open bank accounts.  He was charged with receiving €190,000 in funds from invoice redirection fraud targeting businesses in Hong Kong, Finland, and the United States. The GNECB showed that he had used four stolen foreign ID cards to open bank accounts. He was released on €5,000 bail despite the protests of the GNECB.