'Phish Fry' Nets 100 Fraudsters

Biggest Cyber Crime Investigation in U.S. History An international phishing operation was smashed on Wednesday by the Federal Bureau of Investigation and law enforcement in Egypt.

The case called "Operation Phish Phry" has the largest number of defendants ever charged in a cyber crime case. A total of 53 people across the country and 47 people in Egypt were indicted in the multinational investigation. Law enforcement over a two-year period uncovered a sophisticated "phishing" operation that fraudulently collected personal information from thousands of victims and then used to defraud customers of American banks, including Wells Fargo and Bank of America, into providing banking information such as account login and passwords.

On Wednesday, 33 of the 53 people named in a federal grand jury indictment were arrested. This is the first joint cyber investigation between Egyptian and U.S. law enforcement. The FBI, the U.S. Attorney's Office and the Electronic Crimes Task Force in Los Angeles were involved in the investigation.

"This international phishing ring had a significant impact on two banks and caused huge headaches for hundreds, perhaps thousands, of bank customers," says Acting United States Attorney George Cardona. "Organized, international criminal rings can only be confronted by an organized response by law enforcement across international borders, which we have seen in this case."

This huge phishing operation indictment comes just days after the Anti Phishing Working Group's 2009 report shows that criminal attacks against online users has increased nearly 600 percent this year.

The investigation began in 2007 when FBI agents, working with United States financial institutions, took proactive steps to identify and disrupt sophisticated criminal enterprises targeting the financial infrastructure in the United States.

The FBI and Egyptian authorities agreed to pursue a joint investigation into multiple subjects based in Egypt after investigators in both countries uncovered an international conspiracy allegedly operating an elaborate phishing scheme. The group is accused of conspiring to target American-based financial institutions and victimize an unknown number of account holders by fraudulently using their personal financial information, say law enforcement officials.

In the U.S., the accused "phishers" were arrested in California, Nevada and North Carolina. The 51-count indictment accuses all of the defendants with conspiracy to commit wire fraud and bank fraud. Some of the defendants are also charged with bank fraud; aggravated identity theft; conspiracy to commit computer fraud, specifically unauthorized access to protected computers in connection with fraudulent bank transfers and domestic and international money laundering.

Egyptian-based hackers obtained bank account numbers and related personal identification information from an unknown number of bank customers through phishing, the indictment alleges. It also alleges co-conspirators in Egypt collected victims' bank account information by using information obtained from the phishing emails. With this bank account information, the phishers hacked into accounts at two banks. After they accessed the accounts, the individuals operating in Egypt communicated via text messages, telephone calls and Internet chat groups with co-conspirators in the U.S. They then coordinated the illicit online transfer of funds from compromised accounts to newly created fraudulent accounts.

The United States part of the ring was allegedly directed by defendants Kenneth Joseph Lucas, Nichole Michelle Merzi, and Jonathan Preston Clark, all from California. They instructed trusted associates to recruit "runners," who set up bank accounts where the funds stolen from the compromised accounts could be transferred and withdrawn. A portion of the illegally obtained funds withdrawn were then transferred via wire services to the individuals operating in Egypt who had originally provided the bank account information obtained via phishing, says the indictment.

"The sophistication with which Phish Phry defendants operated represents an evolving and troubling paradigm in the way identity theft is now committed," said Keith Bolcar, Acting Assistant Director In Charge of the FBI in Los Angeles. "Criminally savvy groups recruit here and abroad to pool tactics and skills necessary to commit organized theft facilitated by the computer, including hacking, fraud and identity theft, with a common greed and shared willingness to victimize Americans."

About the Author

Linda McGlasson

Linda McGlasson

Managing Editor

Linda McGlasson is a seasoned writer and editor with 20 years of experience in writing for corporations, business publications and newspapers. She has worked in the Financial Services industry for more than 12 years. Most recently Linda headed information security awareness and training and the Computer Incident Response Team for Securities Industry Automation Corporation (SIAC), a subsidiary of the NYSE Group (NYX). As part of her role she developed infosec policy, developed new awareness testing and led the company's incident response team. In the last two years she's been involved with the Financial Services Information Sharing Analysis Center (FS-ISAC), editing its quarterly member newsletter and identifying speakers for member meetings.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.com, you agree to our use of cookies.