©2013 Association of Certified Fraud Examiners, Inc.
“The Crooks Aren’t Here”
Pursuing White-Collar Crime in
a Foreign Country
Pauline Roberts
Special Agent (Retired) FBI
©2013 Association of Certified Fraud Examiners, Inc.
Agenda
First steps to take when a victim is defrauded
How to identify and follow the trail of clues to locate and
identify the criminal
How to follow the money
Roles of international law enforcement Interpol
Europol
Eurojust
United Stated Department of Justice
©2013 Association of Certified Fraud Examiners, Inc.
Cybercrime Is Worldwide
In 21st century it is inevitable
If it happened online it is probably an international
crime.
Essential to understand the clues you receive from
forensic examiners or corporate IT.
©2013 Association of Certified Fraud Examiners, Inc.
Internet Protocol Address:
Where Was He Sitting When He Did It?
Unique number identifying a machine connected to
the internet
Version 4 IP address: 46.254.129.4
Newest versions: 2001:db8:0:1234:0:567:8:1
Researching tell you the internet service provider
(ISP)
IP addresses are not static
Formal request to the ISP
Establish who has access to the computers
©2013 Association of Certified Fraud Examiners, Inc.
When the Criminal Lives Online
Servers and Web Hosting
Web hosting is a service
©2013 Association of Certified Fraud Examiners, Inc.
Cloaks of Anonymity:
Proxy Servers and “Bulletproof” Hosting
Proxy servers stand in front of a server that is
holding the information you want
Anonymity is one of the primary reasons for using
proxies
Bulletproof hosting are “bad-guy” fronts opperating
as proxies
Compromised servers, “zombie” servers are other
cloaks: unwitting servers
©2013 Association of Certified Fraud Examiners, Inc.
Internet Crime Complaint Center (IC3)
www.ic3.gov
Use to find what the latest online schemes are
www.ic3.gov/crimeschemes.aspx
©2013 Association of Certified Fraud Examiners, Inc.
FBI Fusion Units
Goal of this unit Investigate significant crime
Identify who
How they are doing it
Where they are located
Build evidence for a prosecutable case
Identify subjects in foreign countries
Prepare referral packages of complaints and
evidence
Perfom undercover
©2013 Association of Certified Fraud Examiners, Inc.
Common International
Online Frauds
ATM skimming, Cash Trapping and Card Cloning
Merchandising and Employment Schemes /
Business Opportunity Schemes
Automated Clearing House (ACH) Bank Transfers
Internet Extortion
©2013 Association of Certified Fraud Examiners, Inc.
24/7 Point of Contact
Person or office who can be contacted by law
enforcement investigators
Assist on cyber information from ISPs such as Yahoo
AOL
Assists from domain registers, Web hosting service
providers and online merchants eBay, Amazon, etc.
Each country has an officially designated 24/7 point
of contact (POC)
©2013 Association of Certified Fraud Examiners, Inc.
Following the Money and
Anti-Money Laundering (AML)
Until funds are converted to cash there is either a
paper or electronic funds transfer trail to follow
Move the money as far away from the victim as
possible
Change the identity and source of funds
©2013 Association of Certified Fraud Examiners, Inc.
Egmont Group
Countries routinely share information about
suspicious financial activities
Written agreements set the common rules for
exchanging information about suspicious banking
and financial activities Privacy concerns
Each member country is part of the Egmont Group of
Financial Intelligence Units (FIU)
120 counties are members producing and sharing
suspicious activity reports
©2013 Association of Certified Fraud Examiners, Inc.
Financial Intelligence Units (FIU)
In most countries FIUs operate within the Ministry of
Finance
Analyze what banks are reporting
Refer potential cases to police and prosecutors and
foreign counterparts
In USA suspicious activity information is collected by
the Financial Crimes Enforcement Network (FinCen)
©2013 Association of Certified Fraud Examiners, Inc.
Does the Crook Have a Bank Account
In Your Country?
Can We Get His Bank Records?
Local police scan the country’s banks to identify
accounts held by a suspect
This is not possible in USA
Chex Systems, Inc. is a network of many banks and
financial institutions who report information to each
other About customers who mishandle accounts
Or try to repeatedly open accounts at different banks
©2013 Association of Certified Fraud Examiners, Inc.
Bank Secrecy Laws
Strong laws protecting the privacy of bank customers
Search warrant obtained after proving to a judge why
secrecy should be lifted
Advisable to work with prosecutor in each country
where accounts are located.\
©2013 Association of Certified Fraud Examiners, Inc.
Currency Transaction Reports (CTRs)
If You Are on the Trail of Cash
Most countries require reports of large cash
transactions
CTRs can come from Customs declarations
Transactions just below or over $10,000
Money flows just below the reporting threshold are
called structuring or smurfing and is illegal in the
USA
CTRs can be obtained through a country’s FIU
©2013 Association of Certified Fraud Examiners, Inc.
Layering
Money launder’s technique for obscuring a money
trail
Virtual labyrinth of transactions
Requires the support of a prosecutor to unravel
©2013 Association of Certified Fraud Examiners, Inc.
Prosecutive Interest
Guidelines for the minimum size loss a fraud case
must have to pursue criminally
Who will prosecute? Jurisdiction.
©2013 Association of Certified Fraud Examiners, Inc.
Criminal Forfeiture
In the USA is usually handled by prosecutors who
are pursuing the primary criminal case
Burden of proof for asset forfeiture is on prosecutor
in USA
In some countries it is on defendant Prove where his money came from
©2013 Association of Certified Fraud Examiners, Inc.
Who Do I Turn To For Help Abroad?
How Do I Contact Them?
US Federal law enforcement have agents assigned
around the world
Role is to share information with FIUs, asset
forfeiture inspectors, police, and prosecutors outside
USA
Work in partnership to gather evidence, testimony,
arrest suspects, and freeze and seize assets in USA
Assist those aboard doing the same in the USA for
cases being prosecuted abroad
Work to deconflict cases that may overlap
©2013 Association of Certified Fraud Examiners, Inc.
Iterpol / Europol / Eurojust
Exchanging Information
on Cross-Border Crime
Interpol: Information exchange network
190 countries share police information
Databases serve as a private Internet for police
Red Notices: tell police around the world that a suspect is
wanted in a particular country for arrest and extradition
Analysts review emerging trends in fraud and other crimes
www.interpol.int/psgapp/educational/crime-prevemtion.html
©2013 Association of Certified Fraud Examiners, Inc.
Iterpol / Europol / Eurojust
Exchanging Information
on Cross-Border Crime
Europol: Functions like Interpol but exchanges among 27 countries
of European Union (EU)
Combats organized crime and fraud affecting Europe
Cooperates with non EU countries including Balkans
Cooperates with organizations including the European Anti-
fraud Office (OLAF), European Central Bank (ECB),
European Commission, European Police College (CEPOL)
Operated the European Cyber Crime Center (EC3)
©2013 Association of Certified Fraud Examiners, Inc.
Iterpol / Europol / Eurojust
Exchanging Information
on Cross-Border Crime
Eurojust: Functions like Europol
Information exchange is between prosecutors and court
officials
European Arrest warrants are valid throughout the 27 EU
member states
©2013 Association of Certified Fraud Examiners, Inc.
Extradition &
Mutual Legal Assistance Treaties
Legal timeframes and procedures are established by
extradition treaties signed and ratified by individual
countries
Extradition requests are formal packages of official
documents
Mutual Legal Assistance Treaties (MLAT) establish
police cooperation, how to conduct investigations
and can be limiting
Occasionally may not provide the kind of speed or
techniques which might be optimal in a fraud case
©2013 Association of Certified Fraud Examiners, Inc.
How to Get Admissible Evidence
from Another Country?
In USA if evidence is obtained in a manner legal in
another country it is admissible
Some certified documents from the US may not be
admissible until apostilled (certified)
Hague Convention Abolishing the Requirements for
Legalization for Foreign Public Documents Signed by all EU member states
©2013 Association of Certified Fraud Examiners, Inc.
Conclusion
©2013 Association of Certified Fraud Examiners, Inc.
Questions?
©2013 Association of Certified Fraud Examiners, Inc.
Thank You
Pauline Roberts
Special Agent (Retired) FBI