“the crooks aren’t here” · extradition requests are formal packages of official documents...

©2013 Association of Certified Fraud Examiners, Inc.

“The Crooks Aren’t Here”

Pursuing White-Collar Crime in

a Foreign Country

Pauline Roberts

Special Agent (Retired) FBI


Agenda

First steps to take when a victim is defrauded

How to identify and follow the trail of clues to locate and

identify the criminal

How to follow the money

Roles of international law enforcement Interpol

Europol

Eurojust

United Stated Department of Justice


Cybercrime Is Worldwide

In 21st century it is inevitable

If it happened online it is probably an international

crime.

Essential to understand the clues you receive from

forensic examiners or corporate IT.


Internet Protocol Address:

Where Was He Sitting When He Did It?

Unique number identifying a machine connected to

the internet

Version 4 IP address: 46.254.129.4

Newest versions: 2001:db8:0:1234:0:567:8:1

Researching tell you the internet service provider

(ISP)

IP addresses are not static

Formal request to the ISP

Establish who has access to the computers


When the Criminal Lives Online

Servers and Web Hosting

Web hosting is a service


Cloaks of Anonymity:

Proxy Servers and “Bulletproof” Hosting

Proxy servers stand in front of a server that is

holding the information you want

Anonymity is one of the primary reasons for using

proxies

Bulletproof hosting are “bad-guy” fronts opperating

as proxies

Compromised servers, “zombie” servers are other

cloaks: unwitting servers


Internet Crime Complaint Center (IC3)

www.ic3.gov

Use to find what the latest online schemes are

www.ic3.gov/crimeschemes.aspx


FBI Fusion Units

Goal of this unit Investigate significant crime

Identify who

How they are doing it

Where they are located

Build evidence for a prosecutable case

Identify subjects in foreign countries

Prepare referral packages of complaints and

evidence

Perfom undercover


Common International

Online Frauds

ATM skimming, Cash Trapping and Card Cloning

Merchandising and Employment Schemes /

Business Opportunity Schemes

Automated Clearing House (ACH) Bank Transfers

Internet Extortion


24/7 Point of Contact

Person or office who can be contacted by law

enforcement investigators

Assist on cyber information from ISPs such as Yahoo

Google

AOL

Assists from domain registers, Web hosting service

providers and online merchants eBay, Amazon, etc.

Each country has an officially designated 24/7 point

of contact (POC)


Following the Money and

Anti-Money Laundering (AML)

Until funds are converted to cash there is either a

paper or electronic funds transfer trail to follow

Move the money as far away from the victim as

possible

Change the identity and source of funds


Egmont Group

Countries routinely share information about

suspicious financial activities

Written agreements set the common rules for

exchanging information about suspicious banking

and financial activities Privacy concerns

Each member country is part of the Egmont Group of

Financial Intelligence Units (FIU)

120 counties are members producing and sharing

suspicious activity reports


Financial Intelligence Units (FIU)

In most countries FIUs operate within the Ministry of

Finance

Analyze what banks are reporting

Refer potential cases to police and prosecutors and

foreign counterparts

In USA suspicious activity information is collected by

the Financial Crimes Enforcement Network (FinCen)


Does the Crook Have a Bank Account

In Your Country?

Can We Get His Bank Records?

Local police scan the country’s banks to identify

accounts held by a suspect

This is not possible in USA

Chex Systems, Inc. is a network of many banks and

financial institutions who report information to each

other About customers who mishandle accounts

Or try to repeatedly open accounts at different banks


Bank Secrecy Laws

Strong laws protecting the privacy of bank customers

Search warrant obtained after proving to a judge why

secrecy should be lifted

Advisable to work with prosecutor in each country

where accounts are located.\


Currency Transaction Reports (CTRs)

If You Are on the Trail of Cash

Most countries require reports of large cash

transactions

CTRs can come from Customs declarations

Transactions just below or over $10,000

Money flows just below the reporting threshold are

called structuring or smurfing and is illegal in the

USA

CTRs can be obtained through a country’s FIU


Layering

Money launder’s technique for obscuring a money

trail

Virtual labyrinth of transactions

Requires the support of a prosecutor to unravel


Prosecutive Interest

Guidelines for the minimum size loss a fraud case

must have to pursue criminally

Who will prosecute? Jurisdiction.


Criminal Forfeiture

In the USA is usually handled by prosecutors who

are pursuing the primary criminal case

Burden of proof for asset forfeiture is on prosecutor

in USA

In some countries it is on defendant Prove where his money came from


Who Do I Turn To For Help Abroad?

How Do I Contact Them?

US Federal law enforcement have agents assigned

around the world

Role is to share information with FIUs, asset

forfeiture inspectors, police, and prosecutors outside

USA

Work in partnership to gather evidence, testimony,

arrest suspects, and freeze and seize assets in USA

Assist those aboard doing the same in the USA for

cases being prosecuted abroad

Work to deconflict cases that may overlap


Iterpol / Europol / Eurojust

Exchanging Information

on Cross-Border Crime

Interpol: Information exchange network

190 countries share police information

Databases serve as a private Internet for police

Red Notices: tell police around the world that a suspect is

wanted in a particular country for arrest and extradition

Analysts review emerging trends in fraud and other crimes

www.interpol.int/psgapp/educational/crime-prevemtion.html





Europol: Functions like Interpol but exchanges among 27 countries

of European Union (EU)

Combats organized crime and fraud affecting Europe

Cooperates with non EU countries including Balkans

Cooperates with organizations including the European Anti-

fraud Office (OLAF), European Central Bank (ECB),

European Commission, European Police College (CEPOL)

Operated the European Cyber Crime Center (EC3)





Eurojust: Functions like Europol

Information exchange is between prosecutors and court

officials

European Arrest warrants are valid throughout the 27 EU

member states


Extradition &

Mutual Legal Assistance Treaties

Legal timeframes and procedures are established by

extradition treaties signed and ratified by individual

countries

Extradition requests are formal packages of official

documents

Mutual Legal Assistance Treaties (MLAT) establish

police cooperation, how to conduct investigations

and can be limiting

Occasionally may not provide the kind of speed or

techniques which might be optimal in a fraud case


How to Get Admissible Evidence

from Another Country?

In USA if evidence is obtained in a manner legal in

another country it is admissible

Some certified documents from the US may not be

admissible until apostilled (certified)

Hague Convention Abolishing the Requirements for

Legalization for Foreign Public Documents Signed by all EU member states


Conclusion


Questions?


Thank You

Pauline Roberts

Special Agent (Retired) FBI