U.K. police are hailing the sentencing of four people who used a sophisticated Trojan horse program to siphon money out of online bank accounts and send it to Eastern European countries and Russia.
The case marks the first collaboration between the financial industry and the Police Central e-Crime Unit (PCeU), which was established earlier this year after accusations the U.K. government wasn’t doing enough about cybercrime.
The men used a Trojan horse program called PSP2-BBB that executed a so-called man-in-the-browser attack when potential victims logged into online bank accounts. The Trojan would insert a special page within the customer’s browsing session asking for more personal information, according to police. The Trojan would then set up a transfer to another account, according to police.
The security company RSA cited an increasingly number of attacks in the U.K. using PSP2-BBB in a report released last month about online fraud.
In such attacks, the money would be transferred later in the day to a “dump” account, or one belonging to a money mule. A mule is someone who has either been deceived into receiving illegal funds or knowingly agrees to accept the money in their own account.
Typically, the mule withdraws the money, takes a small cut as a fee and transfers the rest using a service such as Western Union. In the U.K. case, most of the money went to Russia or other places in Eastern Europe, according to the PCeU.
Multiple financial institutions were attacked and “hundreds of thousands” of pounds were stolen, said Richard Jones, spokesman for the Specialist Crime Directorate of the Metropolitan Police Service, under which the PCeU falls. The exact cost of the fraud hasn’t been released.
For the first time, the PCeU worked closely with financial institutions and other entities such as ISPs, Jones said. Without their cooperation, “you can only get so far,” Jones said.
In April, more than 50 officers raided several addresses in southeast London to pursue the gang, which originated in Eastern Europe, police said.
On Friday in Southwark Crown Court Azamat Rahmonov, 25, of Uzbekistan, was sentenced to four and a half years for conspiracy to defraud and money laundering. Shohruh Fayziev, 23, of Uzbekistan, was sentenced to four years for conspiracy to defraud and possession of articles for use in fraud.
Joao Dos Santos Cruz, 33, of Angola, was sentenced to three years for conspiracy to defraud, possession of articles for use in fraud and possession of false identity documents. Paolo Jorgi, 36, of Portugal, was sentenced to 21 months for money laundering. A fifth person, Edgar Orlando Henriques, 21, of Venezuela, is still at large.
The convictions come as the U.K. is undertaking new efforts to fight online crime and fraud. The PCeU will receive about £7 million (US$11.7 million) in funding over the next three years from the Home Office and Metropolitan Police, a figure police officials have said isn’t enough. The U.K. is also developing the National Fraud Reporting Center that will comprehensively track all forms of e-crime and fraud.
The police have their work cut out for them. According to figures released last month, online banking fraud increased 55 percent to £39 million for the first half of this year compared to the same period a year ago, according to Financial Fraud Action UK (FFA), which collects data reported by U.K. financial institutions. FFA blamed an increase in sophisticated malicious software programs.