{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2019-operation-rewired-281-arrested-worldwide-in-bec-crackdown"},"incident":{"title":"Operation reWired: 281 arrested worldwide in BEC crackdown","date":"2019-09-10","date_precision":"day","victim_org":"Multiple businesses and individuals (global)","sector":"Other","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation","Credential Phishing Portal","Romance / Investment Scam"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss","Attempt Blocked","Identity Theft"],"loss_usd":null,"loss_note":"Not a single-victim loss. The four-month operation produced 281 arrests, seized about $3.7 million and disrupted roughly $118 million in fraudulent wire transfers. IC3 reported nearly $1.3 billion in BEC/EAC losses for 2018 alone.","records_affected":null,"threat_actor":"Multiple BEC networks, predominantly Nigeria-based, plus actors in Turkey and Ghana","summary":"Announced on September 10, 2019, Operation reWired was a four-month international action against business email compromise. It resulted in 281 arrests, 74 in the United States and 207 abroad, including 167 in Nigeria, 18 in Turkey and 15 in Ghana. Authorities seized approximately $3.7 million and disrupted around $118 million in fraudulent transfers. One case involved a community college and an energy company that lost about $5 million, of which banks froze roughly $3.6 million.","how_it_worked":"Operators compromised business and personal email accounts through phishing and credential theft, then monitored correspondence to time an intervention around a real pending payment. When a legitimate invoice, payroll run or closing disbursement was in flight, they injected altered banking instructions that appeared to come from the known counterparty. Victims spanned companies, schools, energy firms, seniors and real estate purchasers. Proceeds were funneled through networks of money mules and fictitious identities before being sent overseas. Thirty-nine FBI field offices and partners in nine countries coordinated arrests, seizures and mule warning letters simultaneously to disrupt both the fraud and its laundering infrastructure.","lessons":"Because criminal proceeds move through domestic mule accounts within hours, rapid reporting to the FBI's IC3 Recovery Asset Team is the single most effective control after a diverted payment is discovered.","confidence":"Confirmed","sources":[{"title":"281 Arrested Worldwide in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes","url":"https://www.justice.gov/archives/opa/pr/281-arrested-worldwide-coordinated-international-enforcement-operation-targeting-hundreds","publisher":"U.S. Department of Justice"},{"title":"Operation reWired","url":"https://www.fbi.gov/news/stories/operation-rewired-bec-takedown-091019","publisher":"Federal Bureau of Investigation"},{"title":"74 Arrested in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes","url":"https://www.justice.gov/archives/opa/pr/74-arrested-coordinated-international-enforcement-operation-targeting-hundreds-individuals","publisher":"U.S. Department of Justice"}],"entry_type":"campaign","slug":"2019-operation-rewired-281-arrested-worldwide-in-bec-crackdown","year":2019,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2019-operation-rewired-281-arrested-worldwide-in-bec-crackdown"}}