Three UK-based criminals have been handed heavy prison sentences for their part in a vast phishing campaign that police claim would have stolen up to £59 million ($89 million) from British banks alone had it not been disrupted before execution.
Initially the operation involving the Police Central e-Crime Unit (PCeU), SOCA Cyber and the US Secret Service monitored 2,600 phishing pages set up by the gang to pose as banks from 14 countries, including US, Russia, China, Australia, Canada and the UK.
On 29 October 2012, UK police tracked the gang, Nigerian Sunday Godday Etu (27), and Romanians Inout Caraman (22) and Adrian Iorgovean (27) to a London hotel where they arrested the threesome in the act of logging on to US and French-based servers used to collect data gathered from the first 30,000 online bank victims.
Around 12,500 of these were based in the UK, picked from a staggering 70 million potential victims that were to be targeted using a database of customer email addresses, police said.
Because the campaign was disrupted in its early stages, police were only able to guesstimate the potential level of fraud as being a hypothetical £59 million, but this only covers UK losses; international losses might have multiplied this number several times over.
"Quite what they [the gang] have managed to steal is yet to be determined but their conviction has prevented them from systematically defrauding thousands more bank customers across the world,” said PCeU detective inspector, Jason Tunn.
"This is by far the biggest case the PCeU has dealt with to date and is likely to be the biggest cyber phishing case so far in the UK.”
An unusual and encouraging detail of the case was the extent to which police were quickly able to execute search warrants across jurisdictions, including Romania, as part of their evidence gathering. This suggests that international cooperation is becoming more effective, something that hasn’t always been the case in the past.
"My personal thanks go to the UK banking industry, the United States Secret Service, Municipal Police of Lille, and the Romanian Police Cyber Division for their invaluable and ongoing cooperation which has enabled these convictions to be secured,” added Tunn, alluding to that dimension.
At Inner London Crown Court Etu was sentenced to eight years in prison on several counts, while Caraman was given seven years and two months, and Iorgovean five years and seven months. Eight others arrested as part of the investigation have been bailed until July.