Global Law Enforcement Scored A Major Win By Taking Down iSpoof

Uncovering iSpoof

The cybercrime department of the Dutch police says it found the servers hosting iSpoof in Almere, a small town near Amsterdam, during a bank helpdesk fraud investigation.

This led to a new investigation focusing on the service, which led to the discovery of the iSpoof operator’s location in London. They then informed Scotland Yard, which started its own in-depth investigation into the suspect.

Next, the police in the Netherlands placed a “tap” on the servers in Almere and gathered insight into how the service worked and who used it.

The UK police say the covert operation of tracking iSpoof closely started in June 2021, helping the law enforcement authorities map the criminal network.

Europol got involved in August 2021 to help the UK police collect evidence and intelligence from global law enforcement partners.

In the framework of its analytical work, Europol was able to identify additional users of the iSpoof service, a number of which were already known for their involvement in other high-profile cybercrime investigations at the European level according to Europol

The administrators of the servers in Almere, two men, aged 19 and 22, were also arrested. The Dutch police underline they’re now de-anonymizing more service users based on evidence collected from the seized servers. This may lead to the arrest of nearly 60,000 criminals!

Following iSpoof’s takedown, the service’s users from dark web forums have been advised to “throw everything away.” But their transactions on the seized servers will be evidence enough of their intent!

Europol & Other Law Enforcement Agencies Shut Down iSpoof Scamming “spoofing” Service & Arrests 142 In Europe

This has a big impact on fake phone scams

Action against a criminal website that offered ‘spoofing’ services to fraudsters: 142 arrests in Europe and hundreds more in other countries, with the potential of arresting nearly 60,000 scammers worldwide!

According to Europol:

Judicial and law enforcement authorities in Europe, Australia, the United States, Ukraine, and Canada have taken down a website that allowed fraudsters to impersonate trusted corporations or contacts to access sensitive information from victims, a type of cybercrime known as ‘spoofing’. The website is believed to have caused an estimated worldwide loss in excess of GBP 100 million (EUR 115 million).

In a coordinated action led by the United Kingdom and supported by Europol and Eurojust, 142 suspects have been arrested, including the main administrator of the website.

London’s Metropolitan Police Commissioner Sir Mark Rowley stated: “The exploitation of technology by organized criminals is one of the greatest challenges for law enforcement in the 21st century. Together with the support of partners across UK policing and internationally, we are reinventing the way fraud is investigated. The Met is targeting the criminals at the center of these illicit webs that cause misery to thousands. By taking away the tools and systems that have enabled fraudsters to cheat innocent people at scale, this operation shows how we are determined to target corrupt individuals intent on exploiting often vulnerable people.”

Eurojust President Mr. Ladislav Hamran said: “As cybercrime knows no borders, effective judicial cooperation across jurisdictions is key in bringing its perpetrators to court. Eurojust supports national authorities in their efforts to protect citizens against online and offline threats, and to help see that justice gets done.”

Europol’s Executive Director Ms. Catherine De Bolle said: “The arrests today send a message to cybercriminals that they can no longer hide behind perceived international anonymity. Europol coordinated the law enforcement community, enriched the information picture and brought criminal intelligence into ongoing operations to target the criminals wherever they are located. Together with our international partners, we will continue to relentlessly push the envelope to bring criminals to justice.”

The services of the website allowed those who sign up and pay for the service to anonymously make spoofed calls, send recorded messages, and intercept one-time passwords. The users were able to impersonate an infinite number of entities (such as banks, retail companies and government institutions) for financial gain and substantial losses to victims.

The investigations showed that the website has earned over EUR 3.7 million in 16 months. According to UK authorities, losses to victims at present are GBP 43 million (EUR 49 million), with estimated worldwide losses in excess of GBP 100 million (EUR 115 million).

In an international coordinated action carried out in November 2022, 142 users and administrators of the website were arrested across the world. The main administrator of the website was arrested in the UK on 6 November.

On 8 November 2022, the website and server was seized and taken offline by US and Ukrainian authorities.

The case was opened at Eurojust in October 2021 at the request of the UK authorities. National authorities from ten countries, including European Union

Member States and third countries, supported the investigation. The Agency played a key role in facilitating the judicial cross-border cooperation among all parties involved. Two coordination meetings were hosted by Eurojust to coordinate the national investigations and to prepare for the action.

On a request of the United Kingdom, Europol started supporting the case earlier that same summer (August 2021). Since then, Europol’s European Cybercrime Centre (EC3) has been providing continuous intelligence development to the national investigators through the Joint Cybercrime Action Taskforce (J-CAT). In addition, EC3 provided a secure platform for law enforcement to exchange large packages of evidence. In the framework of its analytical work, Europol was able to identify additional users of the iSpoof service, a number of which were already known for their involvement in other high-profile cybercrime investigations at the European level.

The following authorities took part in or supported this investigation:

• Australia: Australian Federal Police
• Canada: Royal Canadian Mounted Police – Federal Policing Cybercrime Investigation Team Toronto
• France: Cyber Criminality Unit – PPO Paris; Law Enforcement : C3N – Gendarmerie Nationale
• Germany: Office of the Public Prosecutor General in Bamberg – Bavarian Central Office for the Prosecution of Cybercrime
• Ireland: An Garda Síochána
• Lithuania: Prosecutor General’s Office of the Republic of Lithuania; Lithuanian Criminal Police Bureau
• Netherlands: Cybercrime team Midden-Nederland and Public Prosecutor’s Office Midden-Nederland
• Ukraine: Department of cyber police of National Police of Ukraine
• United Kingdom: Metropolitan Police Service (Cyber Crime Unit), City of London Police, and Crown Prosecution Service
• United States: Federal Bureau of Investigation – Pittsburgh Division; United States Secret Service – Pittsburgh Field Office; and the United States
• Attorney’s Office for the Western District of Pennsylvania

THIS REPRESENTS A MAJOR WIN FOR LAW ENFORCEMENT

According to the BBC:

UK POLICE CONTACT 70,000 VICTIMS IN LARGEST ANTI-FRAUD CAMPAIGN RELATED TO iSPOOF

UK Police text 70,000 victims in UK’s biggest anti-fraud operation related to EUROPOL’s action against a “spoofing” service provider website

Detectives have begun contacting 70,000 people suspected of being victims of a sophisticated banking scam.

The Metropolitan Police is sending text messages to mobile phone users it believes spoke with fraudsters pretending to be their bank.

Met Commissioner Sir Mark Rowley described an “enormous endeavour” in gathering evidence after the discovery of an online fraud network.

There have been more than 100 arrests so far, and one man has been charged.

People who receive a text message in the next 24 hours will be directed to the Action Fraud website to register their details as officers build cases against suspects.

Sir Mark told BBC Radio 4’s Today program the Met was contacting mobile numbers that were connected to the fraudsters for longer than a minute, suggesting a fraud or attempted fraud had taken place.

The scam involved fraudsters calling people at random, pretending to be a bank and warning of suspicious activity on their account.

They would pose as employees of banks including Barclays, Santander, HSBC, Lloyds, Halifax, First Direct, NatWest, Nationwide and TSB.

The fraudsters would then encourage people to disclose security information and, through technology, they may have accessed features such as one-time passcodes to clear accounts of funds.

As many as 200,000 people in the UK may have been victims of the scam, police said, with victims losing thousands of pounds, and in one case £3m.

The 70,000 people being contacted are connected to calls made by individuals known to police, Sir Mark said, and their evidence could be used to prosecute cases.

Genuine messages from police will be sent on Thursday or Friday, detectives said. They said the messages would direct victims to the Metropolitan

Police website which would ask people to register with Action Fraud. Any other texts should be regarded as fraudulent themselves.
iSpoof breakthrough

The mammoth cyber fraud operation began when police in the Netherlands bugged a website that allowed fraudsters to make anonymous phone calls from spoof numbers, posing as bank employees.

The iSpoof website, which has since been taken down by the FBI, crucially allowed scammers to access one-time passcodes and passwords, detectives said.

One-time codes, often delivered through text messages, have become a standard security measure for most online banks in recent years.

Det Supt Helen Rance, from the Met’s Cyber Crime unit, said victims would not have known the phone call was coming from iSpoof.

“The person on the other end of the line can be very convincing,” she said. “This is an absolutely devastating crime for so many people. They must be worried, I really feel for them,”

Fraudsters paid between £150 and £5,000 a month in bitcoin to use the iSpoof service, contacting, at times, 20 people a minute, primarily in the USA, UK, Netherlands, Australia, France and Ireland.

So far, police believe £48m may have been stolen by criminals using iSpoof. This figure is likely to rise. Those behind the service are allegedly earning £3.2m and living “lavish” lifestyles.

A notice on the website says that it has been taken down by the FBI.

Detective Supperintendent Rance said the investigation remained active. Police believe 59,000 potential suspects may have used the iSpoof service, but are prioritising those in the UK who have spent at least 100 Bitcoin to get access, believing they were anonymous.

Early in November they raided an address in east London and arrested a man alleged to be behind iSpoof.

In other raids, 120 people thought to have used the service for fraud have been taken into custody.

Detective Supperintendent Rance warned other criminal “enablers” will have taken over to provide services to fraudsters. “Undoubtedly they will go to another website,” she said.

A 34-year-old man, Teejai Fletcher, has been charged with making or supplying articles for use in fraud and participating in the activities of an organised crime group. He will appear at Southwark Crown Court on 6 December.

In Ireland:

IRELAND ARRESTS 6 SCAMMERS IN GLOBAL SWEEP CAUSED BY iSPOOF!

Irish arrests in a global anti-fraud operation. Six people have been arrested in the Republic of Ireland as part of an international investigation into a global financial scam.

The investigation involved a website enabling fraudsters to commit a type of cybercrime known as spoofing.

Users of iSpoof.cc could impersonate trusted corporations to get sensitive information from victims and defraud them.

In the Netherlands:

The Central Netherlands cybercrime team tracked down two men aged 19 and 22 from Almere because iSpoof servers were running in that city. This allowed the team to tap into the service and listen in on the fraudulent calls. The police expect that more people will be arrested in the Netherlands in connection with the fraud case in the near future.

According to the Scotsman:

Scam Call site

Criminals, who found out about the site from adverts posted on channels on encrypted messaging app Telegram, used it to buy technology that allowed them to mask their phone number.

This meant they could trick victims into thinking they were being contacted by their bank and persuade them to pass on personal details that allowed the fraudsters to steal cash.

One victim lost £3 million and the average loss among the 4,785 people who have reported being targeted to Action Fraud is £10,000.

There are thought to be many more potential victims.

Of 10 million fraudulent calls made, 40% were in the United States, 35% were in the UK and the rest were spread across a number of countries. Around 70,000 UK phone numbers called by criminals who used the site will be alerted by the Metropolitan Police via text message on Thursday and Friday and asked to contact the force.

Police action to take down iSpoof

UK Metropolitan Police Commissioner Sir Mark Rowley acknowledged it is “slightly bizarre” that potential fraud victims will now be contacted about the crime by text, but encouraged people to go through the official police website if contacted.

He told BBC Radio 4’s Today programme: “There is something sort of slightly bizarre about this, isn’t there, which is why we’re encouraging people to actually go on to the Met Police website and they’ll find the shortcuts and links there to report this. “So don’t respond to any texts with sort of dodgy shortcuts and things. Come through official websites is the best way of doing this.”

“But we want to hear from you because the people we message in the next 24 hours have been victims of fraud or attempted fraud and we can stack all these offences against the people we’ve been arresting.”

How many people have been arrested through iSpoofs?

So far 120 arrests have been made – 103 in London and 17 outside the capital in the UK.

These include alleged site administrator Teejay Fletcher, 35, who was arrested in east London earlier this month and is facing criminal charges.

Police said Fletcher, who is alleged to be a member of an organised crime group, was living a “lavish” lifestyle.

The site is said to have made more than £3 million profit.

Sir Mark said the number of potential UK victims is “extraordinary”, adding: “What we are doing here is trying to industrialise our response to the organised criminals’ industrialisation of the problem.”

iSpoof was created in December 2020 and at its peak had 59,000 users, allowing them to pay for the criminal software using Bitcoin, with charges ranging from £150 to £5,000 per month. UK police began investigating the site in June 2021, opting for ispoof as the largest criminal site that was based in the country.

Detective Superintendent Helen Rance, who leads on cyber crime for the Met, said: “By taking down ispoof we have prevented further offences and stopped fraudsters targeting future victims. “Our message to criminals who have used this website is we have your details and are working hard to locate you, regardless of where you are.”

Summary:

• Of the 10 million FRAUD calls made via iSpoof, 40 percent were made in the US and 35 percent in the UK.
• It is estimated that there may be a million victims in total, with 200,000 in the UK alone.
• One victim lost £3 million and the average loss among the 4,785 people who have reported being targeted to Action Fraud is £10,000.
• At its peak, the fraudulent website had 59,000 users. The criminals often paid for the service in bitcoin, because those transactions are difficult to trace.
• As of this publication:
  • 142 criminals have been arrested in Europe
  • 120 criminals have been arrested in the UK
  • 6 criminals have been arrested in Ireland
  • many thousands more to follow!

PLEASE SHARE SO OTHERS WILL KNOW