How US woman lost US$64.5k to phishing scam

Greenwich police in the US have also advised companies and local residents to make significant money transfers only after "face-to-face or verbal confirmation." — Image by katemangostar on Freepik

GREENWICH: Police have a term for it: "Business Email Compromise," or BEC. It is more commonly known as a "phishing scam."

A Greenwich woman was the victim of a such a scam when she responded to an email from an alleged fraudster and wired US$64,461 (RM283,422) to a bank account that was controlled by someone who set up a trail of false identities as part of an alleged criminal enterprise.

After an extensive investigation by Greenwich police, Alondra Maracallo, 25, of Miramar, Fla., was charged in late December with a number of financial crimes earlier this month, all felonies. She is currently being held in custody after failing to post a US$150,000 (RM659,620) bond.

The Greenwich woman had hired an interior decorator in 2021 to work on an apartment, according to the arrest warrant application, and had been communicating via email with the designer. When the Greenwich woman received an email in November 2021 with the company name of the designer and directing her to send US$64,461 by a wire transfer to a bank branch in Orlando, Fla., she sent the money, according to the affidavit.

She later learned the design company never sent the email seeking payment. Investigation later established that the email account used by an assistant at the design firm "had been compromised at some point by an unknown perpetrator," the authorities wrote in the court filing.

According to the affidavit, "In a BEC scam, perpetrators send an email message to a victim that is made to appear to have come from a legitimate source, usually through social engineering, spoofing email addresses, hacking into a legitimate business email or a combination of the three."

Greenwich police began working on the Florida bank account where the funds were wired. A detective discovered that a person identified as Maracallo was using the identity of another Florida woman to set up access to the bank account, as well as a cell phone, according to the court filing. Using cell phone data and video images from the bank, police were able to identify Maracallo as the person who withdrew the funds from the bank account after the transfer, the court filing stated.

Police said Maracallo was working with a male accomplice who has not yet been charged, the affidavit stated. The two "actively set up fraudulent bank accounts which were then used in an attempt to obfuscate the source of the funds," according to the court filing.

Maracallo was charged Dec 20 with first degree larceny, conspiracy to commit larceny, computer crime, conspiracy to commit computer crime and illegal email phishing, all felonies. She was also cited for criminal impersonation, a misdemeanour.

Authorities note that criminal computer operators can send emails that appear authentic.

As the Office of the Connecticut Attorney General, states, "These emails appear to be from a company or government agency and are designed to look authentic, right down to the company or government logo."

Greenwich police have also advised companies and local residents to make significant money transfers only after "face-to-face or verbal confirmation."

Earlier this month, the ringleader of a computer-crime ring was indicted after he and his co-conspirators allegedly stole US$8mil (RM35.17mil) after they "compromised the email accounts of corporate victims, including a pharmaceutical company headquartered in New Jersey and a technology firm headquartered in Oregon," according to federal prosecutors.

Banks typically compensate victims of cybercrime, but the larger costs are passed on to the public.

Maracallo is due back in court Feb 23. – The Middletown Press, Conn./Tribune News Service