Warning: Companies Are the Victims of Forged International Bank Transfer Orders, a Growing Threat

Massive scams with a global scope referred to as "the forged international bank transfer order scams" have been targeting for approximately the last two years, the subsidiaries of large French companies located within the European Union or the foreign subsidiaries of companies based in France.

From a French perspective, this phenomenon represents, over such period, more than 400 attempted or committed offences, for which the damages are estimated to exceed 200 million Euros.

According to the Serious Financial Crime Office of the French Judicial Police (Office Central pour la Répression de la Grande Délinquance Financière de la Direction Centrale de la Police Judiciaire) (the "OCRGDF"), which has identified with great precision the modus operandi of these crooks, the authors of these offences all operate by telephone. The tracing of the fraudulent transfers has in particular enabled to determine that the funds identified to China for final destination and more particularly banks in the Zhejiang province.

To organize their "forged international bank transfer order scams," the criminal organizations have broken down their actions into several steps:

The Preparatory Acts For The Scams

Firstly, the criminal organization proceeds with the "social engineering" of the targeted companies. To this effect, the criminal organization purchases via the Internet, from organizations such as "Infogreffe," the relevant information on the company, i.e. trade and companies registry extract ("K-bis extract"), indebtedness situation, by-laws, articles of association, files of the last instruments, minutes of the general meetings, annual accounts, background of the amendments, etc. The complete company files, with the names of all senior managers, their duties, telephone numbers, signatures… It only costs approximately sixty Euros to obtain such documents! A simple search on the Internet enables these groups to establish the "social engineering" file: company codes, logos, workforce, and even the "message from the Director" … and provides them with an overall vision of the company, its language and trademarks.

The criminal organization then obtains the email addresses, fax and telephone numbers to communicate with the future victim without the latter being able to find out where the crooks are located.

All necessary elements for a targeted attack on a company are then in the hands of the criminal organization. It is furthermore indisputable that proceeding with "social engineering" has been made easier through the advent of new technologies.

The Danger of the New Technologies

The use of prepaid payment cards, which are rechargeable for purchasing information from Infogreffe, was identified by the investigators. This type of card presents the advantage for its incumbent of remaining anonymous and untraceable. However, the subterfuge being revealed, crooks now frequently obtain the numbers of bank cards pirated on the Internet to make their purchases on Infogreffe.

The telephone resources rely on the same principle: purchasing telephone numbers from dematerialized platforms with rechargeable prepaid payment cards or pirated bank cards.

This simple process relies on the acquisition of telephone numbers for a small amount (approximately ten Euros per month), provided with the dialing code of the country requested. If the targeted company is a foreign subsidiary of a French company, the telephone and fax numbers purchased will begin with the French dialing code, which will prevent the contact from becoming suspicious.

The Operating Mode

With the essential information of the targeted company and by using an apparently French telephone number, a crook will call, for example, a foreign subsidiary of the targeted company. He then pretends to be the senior manager of the company and tries to persuade his/her contact (generally the financial officer of the subsidiary) to perform a bank transfer on a foreign account. The crook justifies this unusual and urgent request through the occurrence of an imminent tax audit, the performance of a stock exchange transaction or differently, depending on his/her imagination. While using varied and diverse psychological stratagems such as threats or flattery, the crook will convince the employee empowered to sign to perform the bank transfer.

The money will then be compensated, through an elaborate financial system, between the different criminal organizations operating in Israel, China, and France. These three countries were identified in this scam according to the following scheme:

• Israel as the rear base from where the crooks operate by telephone,
• France as the country where the targeted companies are located, and

• China (Beijing, Wenzhou (Zhejiang province) and Hong Kong) as the place of payment for the bank transfers.

Two groups of wrongdoers operating according to this modus operandi have already been arrested in France in 2011 and 2012 thanks to the intervention of the OCRGDF. However, the phenomenon is continuing. Furthermore, these criminal networks have now understood that they have to train their teams in the English language to extend the scam to a larger number of countries.

The fight against this organized criminality requires the deployment of preventative actions by French companies, the banks, and the specialized economic press to impact the largest possible number of managers.

Therefore, when faced with this very efficient modus operandi that is particularly damaging for the French national economy, a reinforced attention from all companies is necessary at all levels of their hierarchy.

In this field, a national and international "public-private" cooperation is fundamental to act as fast as possible with respect to the blocking of accounts, as the money can circulate in more than three countries in less than 24 hours. The OCRGDF is in charge of centralizing the information on a French scale for this type of fraud.

Several tools enabling companies to confront this type of fraud exist:

Regularly Raising Awareness on Fraud Internally. All associates in the company must be warned and in particular the financial and accounting departments, as well as those in foreign subsidiaries to reinforce the level of attention.

Informing the Employees of the Dangers of the New Technologies. Crooks can easily obtain very precise data on the operations of the victim companies through social networks in particular. It is recommended to remind employees of the company of the importance of not providing information on social networks that could be used at the expense of the company (such as some personal data, the contact details or even the schedule of the senior managers, any instrument bearing the signature of a member of the senior management, the company stamp…).

Auditing the Internal Bank Transfer Procedures. It is also recommended to perform an upstream identification of the potential weaknesses of the internal bank transfer authorization and performance procedures as well as compliance therewith by the financial and accounting departments.

Establishing Efficient Internal Procedures to Secure the Authorization and Performance of Bank Transfers. In particular, the following can be contemplated: a strict multiple signature system for all international bank transfers (some software enables the blocking of any transaction that has not obtained a counter-approval), a regularly modified electronic or coded signature system, an intra-group verification procedure enabling to recoup any payment request or even the use of the intranet network of the company. It is important to exclude any oral request from these procedures.

Implementing a Partnership With Banks. Establishing procedures for a securitization of bank transfers with banks can be particularly efficient.

The company that is the victim of forged international transfer orders must by order of priority and urgently:

Block the bank transfers within the concerned banking institution to stop the fund transfers. The reaction time is indeed decisive in this type of fraud.

• Urgently appoint a law firm in the location where the fraudulently made bank transfers are credited (generally China) to block the transfer of funds on the bank account of the addressee of the bank transfers, through a procedure of preventive seizure of the concerned bank account.
• Lodge a complaint with the Public Prosecutor (Procureur de la République) having jurisdiction over the location where the offence was committed, inform the OCRGDF, and perform an internal investigation to prepare an extensive file on the fraud enabling to identify its stages.

Lawyer Contacts

For further information, please contact your principal Firm representative or one of the lawyers listed below. General email messages may be sent using our "Contact Us" form, which can be found at www.jonesday.com.

Bénédicte Graulle
Paris
+33.1.56.59.46.75
bgraulle@jonesday.com

Sion Richards
London
+44.20.7039.5139
srichards@jonesday.com

Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which can be found on our web site at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.