RSA Firstwatch shines a spotlight in the darker corners of the Internet to better understand Internet Fraud and Criminal trends online. When possible, RSA Firstwatch members will use this space to share information about some of our findings.
In order for criminals to trade internationally in stolen goods and credit card information, they often turn to money mules to serve as unwitting pawns to move goods via standard shipping. High unemployment rates, coupled with good domain names and a professional websites, works well to lure victims into the scheme. The scheme to recruit a money mule usually starts with a spam run promising work from home opportunities. The emails are extremely well written in perfect American English, and the emails include links to their professionally desinged websites.
Victims responding to the spam offers are sent a followup email that contains an employment contract like the one attached below. Again, these contracts are very professional-looking and the phone numbers tend to be Google Voice or similar VOIP numbers.
This post will detail three operating Money Mule Recruitment sites. Since this blog site has higher page ranks on search engines than the scam sites, it is hoped that victims doing a little bit of research on these fraudulent job opportunities will find this information and be dissuaded from participating in the scam.
The first site, Lightspeedexpress.com, is a Russian-owned website registered and activated just after Thanksgiving in 2012. A screenshot is below:
Whois information will reveal that the site has not been around since 2006 as claimed.
LWA-trade.com is another professional-looking website related with shipping, cargo and transportation services. It was created in March 2012, and the operators of the site are still sending fraudulent work from home messages. The site is hosted in Hungary, but the primary language of the site's control panel operations is Russian language.
The third website is Inctor.com, a website created in September 2013. It is hosted in the Netherlands. The webpage bills itself as a consulting and purchasing website, but the operators of the site are also engaged in fraudulent work from home scams.
Interent users should be careful when responding to unsolicited employment offers. It is difficult to determine from visiting the fake corporate websites that the source of the email is actually a member of a criminal gang recruiting money mules. If the job offered involves receiving packages and mailing them forward, don't do it. It embroils you in criminal activity, and should police become involved as they investigate the criminal chain of custody of stolen property, it is the money mules that become the focus of the investigation. And most money mules never get that first paycheck they had been promised. Additionally, most money mules must disclose personal information to these criminals, and it is advisable that they flag their credit reports for possible fraud and identity theft.
