Showing posts with label IRS. Show all posts
Showing posts with label IRS. Show all posts

Tuesday, September 11, 2018

IRS Call Scammers Sentenced in Texas

Back in 2016 we blogged about a major set of arrests in India and the United States related to a call center scam imitating the IRS.  (See "Major Call Center Scam Revealed - 56 Indicted")

This post is to just share an update on that case.  There have been so many arrests made and yet the fraud continues every day!  I received two IRS calls myself in the past week!

To begin, the IRS is NEVER going to call you and threaten arrest.  If you receive such a call, the investigative agency for IRS scams is TIGTA, the Treasury Inspector General for Tax Administration. You can call their scam hotline to report at 1.800.366.4484, or share details online at the IRS Impersonation Scam Reporting form.  All of the arrests below started because someone reported their scammers.  Although the form seems to be focused on people who actually lost money, even non-loss reports can be helpful.

The biggest round of arrests came in October 27, 2016, which was the focus of that "Major Call Center Scam" blog post.  The DOJ press release was titled "Dozens of Individuals Indicted in Multimillion-Dollar Indian Call Center Scam Targeting U.S. Victims
Over the next several months, many of the criminals pled guilty.  All but two were from India, although several were now American citizens.  Each has now been sentenced for their crimes in a mass sentencing before Judge Hittner in Houston, Texas.  Below, we show their guilty plea date, where they were living and/or conducting their crime, and what the DOJ/TIGTA press release said about their guilty plea.  We feel that the sentences were fair, ranging from just over four years to 188 months (15 1/2 years).  

Just wanted to share that EVENTUALLY, Justice is served.

However, PLEASE KEEP REPORTING!  There certainly are more IRS-imitating criminals who need to go to prison!

Bharatkumar Patel (April 13, 2017) - a resident of Midlothian, Illinois - sentenced to 50 months in prison and removal to India. 


According to his plea, beginning in or about July 2013, Patel worked as a member of a crew of runners operating in the Chicago area and elsewhere throughout the country. Patel admitted to purchasing reloadable cards or retrieving wire transfers and using the misappropriated personal identifying information of U.S. citizens. Patel also admitted to opening personal bank accounts in order to receive scam proceeds and payments from defrauded victims as well as creating limited liability companies in his name to further the conspiracy. According to his plea, Patel opened one bank account that received more than $1.5 million in deposits over a one-year period and another bank account that received more than $450,000 in deposits over a five-month period.

Ashvinbhai Chaudhari (April 26, 2017) - a resident of Austin, Texas. - sentenced to 87 months in prison.


According to his plea, since in or about April 2014, Chaudhari worked as a member of a crew of runners operating in Illinois, Georgia, Nevada, Texas and elsewhere throughout the country. At the direction of both U.S. and India-based co-conspirators, often via electronic WhatsApp text communications, Chaudhari admitted to driving around the country with other runners to purchase reloadable cards registered with misappropriated personal identifying information of U.S. citizens. Once victim scam proceeds were loaded onto those cards, Chaudhari admitted that he liquidated the proceeds on the cards and transferred the funds into money orders for deposit into various bank accounts while keeping a percentage of the victim funds for himself. Chaudhari also admitted to shipping money orders purchased with victim funds to other U.S. based co-conspirators, receiving fake identification documents from an India-based co-conspirator and using those documents to receive victim scam payments via wire transfers.


Harsh Patel (May 11, 2017) - a resident of Piscataway, New Jersey. - sentenced to 82 months in prison and deportation after his sentence.


According to his plea, since around January 2015, Patel worked as a runner operating primarily in New Jersey, California and Illinois. At the direction of India-based co-conspirators, often via electronic WhatsApp text communications, Patel admitted to purchasing reloadable cards registered with misappropriated personal identifying information of U.S. citizens. Once victim scam proceeds were loaded onto those cards, Patel admitted that he liquidated the proceeds on the cards and transferred the funds into money orders for deposit into various bank accounts while keeping a percentage of the victim funds for himself. Patel also admitted to receiving fake identification documents from an India-based co-conspirator and other sources and using those documents to receive victim scam payments via wire transfers.


Nilam Parikh (May 18, 2017) - a resident of Pelham, Alabama - sentenced to 48 months in prison 


Since around December 2013, Parikh worked as a runner operating in Alabama.  In connection with her plea, Parikh admitted that, at the direction of an India-based co-conspirator, often via electronic WhatsApp text communications, Parikh purchased reloadable cards registered with misappropriated personal identifying information of U.S. citizens.  Once victim scam proceeds were loaded onto those cards, Parikh admitted that she liquidated the proceeds on the cards and transferred the funds into money orders for deposit into various bank accounts, while keeping part of the victim funds for herself as payment.  Parikh also admitted to sending and receiving scam proceeds to and from her co-conspirators via Federal Express.


Information on the next five all came from the same DOJ Press Release: "Five More Defendants Please Guilty for their Roles in Multimillion Dollar India-Based Call Center Scam Targeting U.S. Victims


Dilipkumar A. Patel (May 26, 2017) - a resident of Corona, California - sentenced to 108 months in prison and removal to India. 


Based on the admissions made in his May 26 guilty plea, since late 2013, Dilipkumar A. Patel operated as a runner in and around Southern California, along with other co-defendants based in the region. At the direction of India-based co-conspirators, often via electronic WhatsApp communications, Patel admitted to participating in the purchase of reloadable cards registered with the PII of U.S. citizens, and the subsequent liquidation of victim scam funds loaded to those cards by co-conspirators, while keeping a percentage of the victim funds on the cards for himself. 


Fahad Ali (May 26, 2017) - a resident of Dyer, Indiana (from Pakistan) - sentenced to 108 months in prison 


According to his guilty plea, also on May 26, beginning in or around 2013, Fahad Ali worked as a member of a crew of runners operating in the Chicago, Illinois area, the Southern District of Texas and elsewhere throughout the country. Ali admitted that he first served as a driver for an Illinois-based co-defendant engaging in activities in furtherance of the conspiracy. Ali later operated at the direction of that co-defendant and others, via various means of communication, including text messages, to purchase reloadable cards, and then liquidate victim scam proceeds placed on those cards by India-based co-conspirators, in exchange for recurring payments. Ali also admitted to using false identification documents to receive wire transfers from victims of the fraud.


Hardik Patel (June 2, 2017) - a resident of Arlington Heights, Illinois - sentenced to 188 months in prison and removal to India upon completion of the sentence.

Based on the statements in his June 2 guilty plea, beginning in August 2012, Hardik Patel owned and managed the day-to-day operations of an India-based scam call center before later leaving for the U.S. While in India, in his capacity as a manager, Hardik Patel communicated extensively via email, text, and other means with various India-based co-defendants to operate the scheme and exchange scripts used in the scheme, coordinate the processing of payments from scammed victims, obtain and exchange lead lists used by callers to target U.S. victims, and exchange spreadsheets containing the personal identifying information (PII) of U.S. persons misappropriated by the scammers to register reloadable cards used in the scheme. Hardik Patel also managed worker payroll and kept detailed records of profits and expenses for various associated scam call centers. Hardik Patel continued to communicate with India-based co-defendants about the scheme and assist with the conspiracy after he moved to the U.S. 



Rajubhai Patel (June 2, 2017) - a resident of Willowbrook, Illinois - sentenced to 151 months in prison 


According to his June 6 guilty plea, Rajubhai Patel operated as a runner and assisted a co-defendant in managing the activities of a crew of other runners, based primarily out of Illinois, who liquidated victim funds in various locales in the U.S. for conspirators from India-based call centers. Rajubhai Patel communicated about the liquidation of scam funds via electronic WhatsApp communications with domestic and India-based co-defendants, purchased reloadable cards registered using the misappropriated PII of U.S. citizens that were later used to receive victims’ funds, and used those cards to purchase money orders and deposit them into various bank accounts of co-defendants and others as directed. Rajubhai Patel also admitted to creating and maintaining spreadsheets that detailed deposits, payments to co-conspirators, expenses and profits from the scheme.


Viraj Patel (June 2, 2017) - a resident of Anaheim, California - sentenced to 165 months in prison and removal to India.


According to admissions made in his June 2 guilty plea, Viraj Patel first became involved in the conspiracy between April and September 2013, prior to entering the U.S., when he worked at and assisted with overseeing the operations of a call center in India engaging in scam activity at the behest of a co-defendant. After entering the U.S., beginning in December 2014 Viraj Patel engaged in additional activities in support of the scheme in exchange for a cut of the profits, including serving as a processor of scam victim payments and as a runner engaging in the purchase and liquidation of cards loaded with victim scam funds. Viraj Patel communicated with various India-and U.S.-based co-defendants in furtherance of the conspiracy, and also obtained and circulated lead lists to his co-conspirators containing the PII of U.S. citizens for use by the call centers in targeting victims of the various fraud schemes and to register reloadable cards used to launder the proceeds of the schemes.  


Bhavesh Patel (July 7, 2017) - a resident of Gilbert, Arizona and Alabama - sentenced to 121 months in prison.


According to Bhavesh Patel’s guilty plea, beginning in or around January 2014, Bhavesh Patel managed the activities of a crew of runners, directing them to liquidate victim scam funds in areas in and around south and central Arizona per the instructions of conspirators from India-based call centers. Patel communicated via telephone about the liquidation of scam funds with both domestic and India-based co-defendants, and he and his crew used reloadable cards containing funds derived from victims by scam callers to purchase money orders and deposit them into various bank accounts as directed, in return for percentage-based commissions from his India-based co-defendants. Patel also admitted to receiving and using fake identification documents, including phony driver’s licenses, to retrieve victim scam payments in the form of wire transfers, and providing those fake documents to persons he managed for the same purpose.


Asmitaben Patel (July 7, 2017) - a resident of Willowbrook, Illinois - (previously sentenced to 24 months) 


Based on admissions in Asmitaben Patel’s guilty plea, beginning in or around July 2013, Asmitaben Patel served as a runner liquidating victim scam funds as part of a group of conspirators operating in and around the Chicago area. At the direction of a co-defendant, Patel used stored value cards that had been loaded with victim funds to buy money orders and deposit them into various bank accounts, including the account of a lead generating business in order to pay the company for leads it provided to co-conspirators that were ultimately used to facilitate the scam.


The next seven criminals guilty pleas were announced by the Department of Justice on November 13, 2017 in their press release:  "Last Defendant in the United States Pleads Guilty in Multimillion Dollar India-Based Call Center Scam Targeting U.S. Victims"


Miteshkumar Patel (November 13, 2017) - a resident of Willowbrook, Illinois - sentenced to 240 months.


Based on admissions in Miteshkumar Patel’s plea, beginning in or around 2013, Miteshkumar Patel managed a crew of a half dozen domestic runners involved in the criminal scheme, liquidating as much as approximately $25 million in victim funds for conspirators from India-based call center and organizational co-defendant HGLOBAL.  Patel communicated about the fraudulent scheme with various domestic and India-based co-defendants via email, text messaging and WhatsApp messaging.  Miteshkumar Patel and his runners purchased reloadable GPR cards that were registered using the misappropriated personal identifying information (PII) of unsuspecting victims that were later used to receive victims’ funds, and used those reloadable cards containing victims’ funds to purchase money orders and then deposit those money orders into bank accounts, as directed, while keeping a portion of the scam proceeds as profit.  Miteshkumar Patel also trained the runners he managed on how to conduct the liquidation scheme, provided them with vehicles to conduct their activities in Illinois and throughout the country, and directed a co-defendant to open bank accounts and limited liability companies for use in the conspiracy.  Miteshkumar Patel further admitted to using a gas station he owned in Racine, Wisconsin to liquidate victim funds, and possessing and using equipment at his Illinois apartment to make fraudulent identification documents used by co-defendant runners in his crew to receive wire transfers directly from scam victims and make bank deposits in furtherance of the conspiracy.


Raman Patel (age 82) (November 13, 2017) - a resident of Gilbert, Arizona - (previously sentenced in Phoenix, Arizona to probation, in consideration of his age and his cooperation.)

According to admissions in Raman Patel’s guilty plea, from in or around 2014, Patel served as a domestic runner in and around south-central Arizona, liquidating victim scam funds per the instructions of a co-defendant.  Patel also served as a driver for two co-defendants in furtherance of their GPR liquidation and related activities and sent bank deposit receipts related to the processing of victim payments and fraud proceeds to an India-based co-defendant via email and document scan services offered at various retail stores.

Sunny Joshi of Sugar Land, Texas - sentenced to 151 months in prison for money laundering conspiracy, and 120 months in prison for naturalization fraud.

Rajesh Bhatt of Sugar Land, Texas - sentenced to 145 months in prison and removal to India.


Based on admissions in Joshi and Bhatt’s guilty pleas, beginning in or around 2012, Joshi and Bhatt worked together as runners in the Houston, Texas area along with a co-defendant.  They admitted to extensively communicating via email and text with, and operating at the direction of, India-based conspirators from organizational co-defendant CALL MANTRA call center to liquidate up to approximately $9.5 million in victim funds, including by purchasing GPR cards and using those cards, funded by co-conspirators with scam victim funds, to purchase money orders and deposit them in third party bank accounts, while keeping a percentage of the scam proceeds for themselves as profit.  Joshi has also agreed to plead guilty to one count of naturalization fraud pursuant to a federal indictment obtained against him in the Eastern District of Louisiana, based on fraudulently obtaining his U.S. citizenship.


Jagdishkumar Chaudhari of Montgomery, Alabama - sentenced to 108 months in prison and removal to India.


Jagdishkumar Chaudhari admitted in his plea that between April 2014 and June 2015, he worked as a member of a crew of runners operating in the Chicago area and elsewhere throughout the country, at the direction of Miteshkumar Patel and others.  In exchange for monthly cash payments, Jagdishkumar Chaudhari admitted to driving to hundreds of retail stores to purchase GPR cards to be loaded with victim funds by co-conspirators in India, purchasing money orders with GPR cards that had been funded with victim proceeds, depositing money orders purchased using victim scam proceeds at various banks, and retrieving wire transfers sent by victims of the scheme.  Jagdishkumar Chaudhari is an Indian national with no legal status in the United States, and has agreed to deportation after he serves his sentence as a condition of his guilty plea.


Praful Patel of Fort Myers, Florida - sentenced to 60 months in prison 


In his plea, Praful Patel admitted that between in or around June 2013 and December 2015, he was a domestic runner who liquidated funds in and around Fort Myers, Florida for conspirators from India-based call center and organizational co-defendant HGLOBAL.  Praful Patel communicated extensively via WhatsApp texts with his conspirators.  For a percentage commission on transactions he conducted, Praful Patel admitted to purchasing reloadable GPR cards that were registered using the misappropriated PII of unsuspecting victims that were later used to receive victims’ funds, using those reloadable GPR cards containing victims’ funds to purchase money orders and depositing those money orders into bank accounts as directed, and using fake identity documents to receive wire transfers from victims.


Jerry Norris of Oakland, California - sentenced to 60 months in prison 


According to Norris’ guilty plea, beginning in or around January 2013 continuing through December 2014, he was a runner who worked with conspirators associated with India-based call center and organizational co-defendant HGLOBAL, and was responsible for the liquidation of victim scam funds in and around California.  Norris admitted he communicated extensively via WhatsApp and email with India-based co-defendants including Sagar “Shaggy” Thakar, purchased GPR cards used in the scheme, sent lead lists to conspirators in India that were then used by callers located in the call centers to target potential victims in the telefraud scheme, received scam proceeds via wire transfers using fictitious names, and laundered scam proceeds from GPR cards via ATM withdrawals.


Others sentenced whose guilty pleas were not mentioned above include: 


Montu Barot - 60 months in prison and removal to India after sentence

Rajesh Kumar - 60 months in prison 


Nilesh Pandya - sentenced to three years probation 


Dilipkumar R. Patel of Florida - sentenced to 52 months in prison 


Nisarg Patel of New Jersey - sentenced to 48 months in prison and removal to India.


Dipakkumar Patel, of Illinois, was sentenced to 51 months by Judge Eleanor Ross in Atlanta, Georgia.



Sunday, October 30, 2016

Major Call Center Scam Network Revealed - 56 Indicted

This week the US Attorney for the Southern District of Texas unsealed indictments against 56 individuals operating a conspiracy to commit wire fraud through a sophisticated scam involving five call centers in Ahmedabad, Gujarat, India.

The Call Centers -- HGlobal, Call Mantra, Worldwide Solutions, Sharma Business Process Outsourcing Services, and Zoriion Communications -- placed calls in four primary types of telefraud, and then laundered the money through a network of Domestic Managers, Runners, and Payment Processors in the United States.   The money was then moved via a Hawaladar, a person who runs an underground banking system, or an international money transfer service called a Hawala.  Hawala banking speeds the availability of international funds by operating on a trust system where the Hawaladar can incur or pay debts in one country for a large number of trusted parties from locally available funds on hand.

October 27, 2016 Press Release


Fraud types

IRS Scams: India-based call centers impersonated U.S. Internal Revenue Service officers and defrauded U.S. residents by misleading them into believing that they owed money to the IRS and would be arrested and fined if they did not pay their alleged back taxes immediately.

Law Enforcement Scams: India-based call centers also impersonated various law enforcement agencies, as with the IRS scams, threatening immediate arrest if the victim failed to comply with transferring funds.  (This blog has covered this scam before, including sharing a recording of one such call -- see: "Warrant for Your Arrest Phone Scams" from November 7, 2014.)

USCIS Scams: India-based call centers impersonated U.S. Citizen and Immigration Services (USCIS) officers and defrauded U.S. residents by misleading them into believing that they would be deported unless they paid a fine for alleged issues with their USCIS paperwork.

Payday Loan Scams: India-based call centers defrauded U.S. residents by misleading them into believing that the callers were loan officers and that the U.S. residents were eligible for a fictitious "payday loan".  They would then collect an upfront "worthiness fee" to demonstrate their ability to repay the loan.  The victims received nothing in return.

Government Grant Scams: India-based call centers defrauded U.S. residents by misleading them into believing that they were eligible for a fictitious government grant. Callers directed the U.S. residents to pay an upfront IRS tax or processing fee.  The victims received nothing in return.

Roles in the Operation

In the US, the primary parties were the Domestic Managers, the Runners, and the Payment Processors.  A Domestic Manager directed the activities of the runners and provided them with the resources they needed to do their work, including vehicles, and credit cards to be used to pay business expenses.  The Runners job was to purchase temporary "GPR cards" (General Purpose Reloadable) and then send the information about these cards to the scammers who were working in the call centers in India.  When they reached the "payout" portion of the scam, the funds would be transferred from the victim to the Runner's GPR card.  The Runners would then retrieve the cash and send it further upstream, often via Western Union or Moneygram using false identification documents. 

Data Brokers helped to generate "lead lists" for the Call Center Operators.  (For example, One of the data brokers used by the call centers was working as an IT Consultant for a company in New York.  Vishal Gounder would steal the PII from company databases and use the identities to activate the GPR cards.  )

Payment Processors acted as the intermediary between the Runners and the Call Centers for exchanging funds either through Hawaladars or via GPS Cards and international wire transfers.


The Indicted

The largest number of arrested and indicted individuals came from the HGlobal call Center.  I've illustrated the information from the indictment below:
HGlobal: Runners in 8 states, including Alabama


The other Ahmedabad, Gujarat, India Call Centers and their indicted members

 

GreenDot Investigations 

One of the methods that the members of the conspiracy were tracked was by their reliance on certain GPR cards, including the GreenDot MoneyPak cards.  When a GreenDot MoneyPak card is used, an identity and a telephone number have to be associated with the card.   The call centers in India operate primarily by using "Magic Jack" devices to place unlimited international calls over Voice Over IP (VOIP) lines where they can choose the callerid number that is displayed.   GreenDot investigators found that more than 4,000 GreenDot cards had been registered to the same Magic Jack telephone number, (713) 370-3224, using the identity details of more than 1,200 different individuals!

That Magic Jack number was controlled by Hitesh Patel, the call center manager of HGlobal.

The criminals did a poor job back-stopping their fake identities.  In this case, the Magic Jack was registered to the email "acsglobal3@gmail.com" which used as its recovery email hitesh.hinglaj@gmail.com, which lists the telephone number 9879090909, which Hitesh also used on his US Visa Application.  The Magic Jack device had been purchased in Texas by Asvhwin Kabaria, who used the email acs.wun@gmail.com to send the news to acsglobal3@gmail.com that he was shipping him 20 Magic Jack devices via UPS.  The same individual would ship more than 100 Magic Jack devices to other members of the conspiracy, including people in India and in Hoffman Estates, Illinois.

Another Magic Jack number, (630) 974-1367, was associated by 990 Green Dot GPR Cards using 776 different stolen identities.  (785) 340-9064 was associated with 4,163 Green Dot cards using 1903 different stolen identites!  That one was used by Jatan_oza@rocketmail.com which was frequently checked from the same IP address that Magic Jack calls using this number were originating.

Sunny Joshi (sunny143sq@yahoo.com) was shown to have purchased $304,363.45 worth of GPR cards in a single month (October 2013!)  Emails to and from Sunny often had spreadsheets documenting which transactions had been funded by which GRP cards.  One spreadsheet showed $239,180.79 worth of transactions from 116 different cards!

Another investigative trick was to look for cards that were used in "geographically impossible" situations.  For example, on January 13, 2014 at 11:37 AM a conspirator used a card to buy gas in Racine, Wisconsin.  On the same day at 12:46 PM the same card was used to buy groceries in Las Vegas, Nevada.

At least 15,000 victims have been confirmed to have lost money to these scammers, and an additional 50,000 victims are known to have had their identity details in the possession of these scammers.

The Most Vulnerable Among Us

The most vulnerable victims seem to have been recent immigrants and the elderly.  Those who are accustomed through habit or fear to quickly obeying any order of authority, even when it seems incredulous.   There are several victims who were ordered repeatedly to purchase the largest possible Green Dot cards ($500 value) and to do so in batches over several days.  One victim in 2013 purchased 86 cards worth $43,000 and transmitted the details to the scammers.  These cards were accessed from the IP of the 703 Magic Jack phone and transferred by email to "hglobal01@gmail.com".  

One resident of Hayward, California was contacted repeatedly from January 9, 2014 through January 29, 2014 and extorted into purchasing 276 MoneyPaks worth $136,000 and transmitting the PIN numbers to the thieves.  She was frightened into believing she was speaking with the IRS and would be immediately arrested if she did not comply!

Recent immigrants are also especially vulnerable.  In one of the many examples from the indictment, Rushikesh B., a resident of Naperville, Illinois, was extorted for $14,400 by an individual claiming to be the Illinois State Police and threatening arrest if he did not immediately pay fines related to immigration violations.

Those who work with our elderly and with recent immigrant communities are strongly encouraged to remind them that NO LAW ENFORCEMENT OFFICIAL will EVER take payment for a fine via money transferred over the internet or email!  Nor will they ever require a GPR card to be used to pay such a fee!   

Anyone who hears of a friend, family member, co-worker who has been a victim of such a scam is strongly encouraged to file a report. 

For all IRS-related telephone scams, please help your colleague to report the scam by using the TIGTA website, "IRS Impersonation Scam Reporting" run by the Treasury Department's Inspector General for Tax Administration. 
The URL is: https://www.treasury.gov/tigta/contact_report_scam.shtml

For all other Telefraud scams involving government impersonation, this FTC website may be used:  https://www.ftccomplaintassistant.gov  

Email Traffic a key to the Case

The indictment goes on for 81 pages listing incident after incident, including many email accounts used by the criminals.  Some of the criminals made accounts for money movement, such as money.pak2012@gmail, payment8226@gmail, but others used their "primary emails" like Cyril Jhon who used the email cyrilhm2426@gmail for his conspiracy traffic. Saurin Rathod used the email saurin2407@gmail, while Hardik Patel used hardik.323@gmail!  One of the payment processors, Rajkamal Sharma, sent over 1,000 emails to conspirators with directions about where to deposit various funds. Almost 50 pages of the 81 page indictment are walking through the evidence uncovered by email analysis!

The full indictment is a fascinating read ... you can find a copy here:

https://www.justice.gov/usao-sdtx/file/905837/download

The indicted:
Hitesh Madhubhai Patel
Hardik Arvindbhai Patel
Janak Gangaram Sharma
Tilak Sanjaybhai Joshi
Saurin Jayeshkumar Rathod
Tarang Ranchhodbhai Patel
Kushal Nikhilbhai Shah
Karan Janakbhai Thakkar
Manish Balkrishna Bharaj
Rajpal Vastupal Shah
Sagar Thakar (aka Shaggy, Shahagir Thakkar)
Cyril Jhon Daniel
Jatin Vijaybhai Solanki
Jerry Norris (aka James Norris, IV)
Nisarg Patel
Miteshkumar Patel
Rajubhai Bholabhai Patel
Ashvinbhai Chaudhari
Fahad Ali
Jagdishkumar Chaudhari (Jagdish)
Bharatkumar Patel (Bharat)
Asmitaben Patel
Vijaykumar Patel
Montu Barot (Monty Barot)
Praful Patel
Ashwinbhai Kabaria
Dilipkumar Ramanlal Patel
Nilam Parikh
Dilipkumar Ambal Patel (Don Patel)
Viraj Patel
Abshishek Rajdev Trivedi
Samarth Kamleshbhai Patel
Harsh Patel
Aalamkhan Sikanderkhan Pathan
Jaykumar Rajanikant Joshi
Anjanee Pradeepkumar Sheth
Kunal Chatrabhuj Nagrani
Subish Surenran Ezhava (aka Chris Woods)
Sunny Tarunkumar Sureja (aka Khavya Sureja)
Sunny Joshi (aka Sharad Ishwarial Joshi, Sunny Mahashanker Joshi)
Rajesh Bhatt (aka Manoj Joshi, Mike Joshi)
Nilesh Pandya
Tarun Deepakbhai Sadhu
Vishalkumar Ravi Gounder (Vishal Gounder)
Bhavesh Patel
Raman Patel
Rajesh Kumar Un
Aniruddh Rajeshkumar Chauhan
Rahul Tilak Vijay Dogra
Vicky Rajkamal Bhardwaj
Clintwin Jacob Chrisstian
Aneesh Antony Padipurikal (Aneesh Anthony)
Jatankumar Kareshkumar Oza (aka Jatan Oza)
Rajkamal Omprakash Sharma
Vineet Dharmendra Vasishtha (aka Vineet Sharma, Vineet Vashistha)
Gopal Venkatesan Pillai

Thursday, April 14, 2016

University "Paperless W2" Phish

Please visit my blog post at PhishMe to see information about a wide-spread campaign of "Paperless W2" phish that have been observed by at least twenty different universities.

http://phishme.com/universities-face-w2-phish-president-impersonation/

Here's one example of the spam that University students, staff, and faculty have received, this one from Auburn University:

(image source: www.auburn.edu/oit/news/article.php?id=422 )

Monday, February 17, 2014

Interac Phishers try their hand at IRS

Last week Malcovery Security had an interesting phish show up claiming to be related to the IRS. This one turns out to be a great example of the (activate 1940 horror movie narrator voice) The POWER OF CROSS BRAND INTELLIGENCE (/activate). Here's what the website looked like:


Phish from: bursafotograf.com / profiles / interac / RP.do.htm

In this phish, the "big idea" is that you can escalate your IRS Tax Refund if you specify which bank you would like the refund to be deposited into. When you click the bank's logo, you are taken to a phishing site for that brand and asked to provide your Userid and Password, which are then emailed to the phisher. Here's an example of the page you would see if you clicked on the Regions Bank logo (graphic courtesy of PhishTank submission 2254700.)

Things get quite fascinating though when we hide the graphics:

Why would an IRS phish have ALT TEXT including for four of the largest Canadian banks? By looking at the source code for the phishing page, we see that this is a very lightly rebranded Interac phish: First, the website Title is "INTERAC e-Transfer" ...

INTERAC is a very interesting money transfer system used in Canada that allows anyone to send money to anyone else simply by using either their email address or cell phone text messaging service. A Transaction code is texted/emailed from the payer to the recipient, allowing the recipient to login to the Interac service and choose what account, and what bank, they would like to receive the funds into.

The phish has some Javascript at the top that includes variables like "var provinceList = new Array ("Alberta", "British Columbia", "New Brunswick", "Newfoundland and Labrador", "Nova Scotia", "Ontario", "Prince Edward Island", "Saskatchewan");" and a pull down menu with options "Select Institution", "Select Province or Territory" and "Select Credit Union."

As we continue into the table of graphics, we see that the phisher has changed his graphics and links to refer to the American banks, with code such as:

href = chasecustomerprofile
img src = chasecustomerprofile/css/images/chaseNew.gif .... but with "alt=CIBC"

href = navy/index.htm
img src = imgs/nfculogo.png  .... but with "alt=President's Choice Financial"

href = suntrust
img src = imgs/suntrust.png  .... but iwth "alt = RBC Royal Bank"

etc . . . 

Phishing Cross-Brand Intelligence

It seems fairly clear that we should be able to find more phishing sites that used the original Interac code, and of course we can in the Malcovery PhishIQ system.

Here is a phish that was seen on June 21, 2013 on the website freevalwritings.com / wp / interacsessions / RP.do.htm

And another first seen on May 28, 2013 on the website anglaisacote.com / interac / RP.do.htm (note the common path on both of these that matches the current IRS phish = "interac/RP.do.htm" RP.do.htm is used on the REAL Interac website.

Phishing & Spam Cross-Brand Intelligence

An interesting thing about phishing emails that differentiates them from standard spam. While normal spam is often sent via botnets, phishing emails tend to be sent from the same IP address over a period of time. When we use Malcovery PhishIQ to examine the IRS version of the Interac phish, which attempts to steal money from Bank of America, Chase Bank, Navy Federal Credit Union, SunTrust, Regions Bank, Wells Fargo, USAA, and Citi, we see that the originally advertised URL was actually "130.13.122.25 / irsjspmessageKey-IG09210358i /". That URL forwarded visitors to the website "ernursusleme.com / Connections / irsonlinedeposit /" which then forwarded the visitors to "bursafotograf.com / profiles / interac / RP.do.htm" which is where the screenshot at the top of this article was captured.

So, to find spam messages related to this phish, it seems reasonable to search the Malcovery Spam Data Mine for emails that advertised URLs on 130.13.122.25.

We found two sets of spam messages that advertised URLs on that host in our spam collection. One batch from January 8, 2014 and the other batch from January 28th and January 29th, 2014.

The January 28th and January 29th emails claimed to be from "From: USAA (USAA.Web.Services@customer.usaa.com)" with an email subject of "New Insurance Document Online".

Two of the emails were sent from 122.3.92.116 (Philippines) and one email was sent from 70.166.118.54 (Cox). What other emails were sent from those IP addresses?

Here are the emails from 122.3.92.116

Date: Subject: From NameFrom Email
Dec 13, 2013Your account has been limited until we hear from youservice@ intl.paypal.comsurvey.research-3086@ satisfactionsurvey.com
Dec 13, 2013Your account has been limited until we hear from youservice@ intl.paypal.comsurvey.research-3086@ satisfactionsurvey.com
Dec 14, 2013Your account has been limited until we hear from youservice@ intl.paypal.comsurvey.research-3086@ satisfactionsurvey.com
Dec 16, 2013Confirmation - personal information updateUSAAUSAA.Web.Services@ customermail.usaa.com
Dec 18, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Dec 18, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Dec 18, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Dec 23, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Dec 30, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Dec 31, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Dec 31, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Dec 31, 2013INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Jan 5, 2014Notification of Limited Account AccessPayPalPayPal@ abuse.epayments.com
Jan 7, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 7, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 7, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 8, 2014View Your USAA Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 8, 2014View Your USAA Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 8, 2014View Your USAA Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 8, 2014View Your USAA Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 8, 2014View Your USAA Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 8, 2014View Your USAA Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 8, 2014View Your USAA Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 17, 2014Canada Tax send you an INTERAC e-Transfernotify@ payments.interac.canotify@ payments.interac.ca
Jan 19, 2014Your dispute has been ended 01/20/2014: Get your money backPayPalpaypal.feedback@ email.com
Jan 19, 2014Your dispute has been ended 01/20/2014: Get your money backPayPalpaypal.feedback@ email.com
Jan 20, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 20, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 20, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 20, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 20, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 21, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 21, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 21, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 21, 2014View and Sign Your USAA Insurance PolicyUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 21, 2014Your dispute has been ended 01/20/2014: Get your money backPayPalpaypal.feedback@ email.com
Jan 28, 2014New Insurance Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Jan 28, 2014New Insurance Document OnlineUSAAUSAA.Web.Services@ customermail.usaa.com
Feb 8, 2014Canada Revenue send you an INTERAC e-TransferTD Canada Trustnotify@ payments.interac.ca
And here are the emails from 70.166.118.54

Date: Subject: From NameFrom Email
Jan 29, 2014New Insurance Document OnlineUSAAUSAA.Web.Services@customermail.usaa.com
Feb 3, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 3, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 3, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 3, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 3, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 3, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 4, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 4, 2014INTERAC e-Transfer Receivednotify@ payments.interac.canotify@ payments.interac.ca
Feb 8, 2014Canada Revenue send you an INTERAC e-TransferRBC Royal Banknotify@ payments.interac.ca
Feb 9, 2014Canada Revenue send you an INTERAC e-TransferRBC Royal Banknotify@ payments.interac.ca
Feb 11, 2014Wells Fargo ATM/Debit Card Expires SoonWells Fargo Onlinealerts@ notify.wellsfargo.com
Feb 11, 2014Wells Fargo ATM/Debit Card Expires SoonWells Fargo Onlinealerts@ notify.wellsfargo.com

The Power of Cross-Brand Intelligence

To summarize, we started with a new IRS phish, and through some comparisons in the Phishing and Spam Data Mines, ended with phish for USAA, PayPal, Wells Fargo, and Interac all being linked together. Investigators interested in learning more are encouraged to reach out!