Source: Bloomberg — 

For weeks, the Secret Service agent had been trying to identify the scammers moving millions of stolen dollars through banks around the New York tri-state area. His quest had begun on a quiet afternoon in May 2020, when the streets of New York were still mostly empty. Cases were moving slowly, and legal processes were delayed. The agent was restless, trying to keep busy during what he thought would be a short-lived pandemic.

Sitting in his office, in a gray tower near the Brooklyn Bridge, the agent, whom we’ll call Alex (he asked to protect his identity because of the undercover nature of his job), started the routine process of scouring a government database called the Internet Crime Complaint Center. The IC3, as the database is known, is accessible to all domestic law enforcement agencies and spans more than two dozen types of crimes, including credit card frauds, ransomware attacks, and identity thefts. Last year it received an average of more than 2,300 cybercrime complaints a day, about one every 37 seconds. Alex was looking for business email compromises, or BECs, a type of scam where hackers infiltrate corporate accounts to send fake wire requests, such as an invoice or a contract payment.

BEC scams indiscriminately target all types of industries, but over the past few years they’ve found a new kind of victim: the eager homebuyer. Individuals and couples who, anxious to close on their dream home and inundated with paperwork and emails, think they’re transferring their down payment to a title company or a lawyer handling the closing process. Instead—by missing an impossibly subtle detail in an email, such as a spelling error or an extra character, indicating it’s a fake—they mistakenly wire tens or hundreds of thousands of dollars to a hacker.

In a single moment, they’re losing their entire nest egg, along with the home they thought they were about to move into, with little chance of ever getting the money back. “I was shellshocked for a couple of days. I just didn’t sleep,” says Christopher Garris, a 35-year-old assistant professor who lost almost $150,000 in 2021 when he tried to buy a condo in Boston after landing a position at Harvard. “It caused problems between my wife and I, and it caused a lot of stress. Having lost considerable money we saved for a long time—it’s been a big source of anxiety for us.”

Alex, whose work focuses on BEC crimes, was on a case that required him to screen complaints logged in the IC3 in his geographic area. He noticed an attempted hack on a construction company in Long Island, in which thieves tried to steal $30,000 by sending fake statement claims. By heist standards, it was a minuscule amount that most agencies wouldn’t have bothered to investigate. But a newly attempted hack can reveal fresh clues that the culprit might have been left behind, potentially opening doors to other cases.

There are several ways to try to locate the person behind a BEC scam: email or internet addresses, bank accounts where the money is wired, and phone numbers, to name a few. Alex did a wider database search to see if other complaints had indicators matching the $30,000 hack attempt. There were plenty. It ended up leading to more than $9 million worth of stolen funds affecting 50-plus victims across different sectors, with real estate losses amounting to more than $2 million, according to a source familiar with the matter who asked not to be named because of the confidential nature of the case. The tens of thousands “may not seem like a lot of money to the government or attorney’s office, but if I lost it, I’d be really upset,” Alex says. “That’s a lot of money to me.”