Criminals Prey on the Unemployed

From the Wall Street Journal | Apr 12, 2010 | By SIOBHAN
GORMAN

Scammers Use Online Ads to Con Desperate Job Seekers into 'Mule' Operations

Out of work for six months, Mary Long
spent hours each day surfing the Web. She found a job listing this fall
for a logistics manager that paid $65,000 a year and fired off her
resume.

But the company, Advanta Transportation Network LLC, appears to be
part of an increasingly common scam that has snared Ms. Long and many
others, according to cybercrime experts.

Matt Nager/Wall Street Journal

Mary Long fell into a shipping scam when
she answered an online job ad.

As U.S. job seekers grow more
desperate, criminals are using the Internet to con participants into
so-called mule operations.

These operations generally follow a formula, say security experts:
Cybercriminals post an ad on a job board. Successful job applicants are
"hired" or asked to complete a trial project. Scam operators wire stolen
money to the applicant's credit card and applicants are asked to
purchase such goods as expensive electronics. The applicant ships the
goods, often to Eastern Europe, where scam operators sell them.
Applicants end up with neither a job nor a paycheck.

Advanta used this approach, according to cyber experts who have
reviewed the company's activities. Several attempts to reach Advanta for
comment were unsuccessful.

"In the last couple of years, [the growth in mule schemes] has been
tremendous," said Uri Rivner, chief of cybercrime technologies at RSA,
the security division of EMC Corp., an information-technology company.
"The bad economy has a lot to do with pushing this type of thing."

There are few statistics on this underground economy. But federal law
enforcement has started to track such scams in the past couple of years
and they now number in the hundreds, one federal law-enforcement
official said.

The number of active scams tracked by the leading Web site that
monitors them, bobbear.co.uk, grew from 34 in December 2007 to 591 in
December 2009. This Web site has become a leading source of data on mule
schemes since it began tracking them in 2006 to draw the attention of
authorities. U.S. law enforcement frequently turns to the site's
proprietor, a private cyber-fraud investigator in the U.K., for data.

These operations are recruiting large numbers of Americans, experts
say, and often go to great lengths to appear legitimate. Advanta's Web
site, for example, showed it used some of the same language as a
legitimate Japanese transport company, according to bobbear, and listed
offices in Copenhagen, New York, London, and Hong Kong. The networking
site Linked-In had a profile of David A. Maeweather, who is listed as
the company's special projects supervisor.

Advanta's Web site is no longer functioning, and emails sent to
several Advanta managers, including Mr. Maeweather, were returned
undeliverable. The toll-free phone number for the New York office led to
a marketing firm based in Texas that said it was recently assigned the
number but has no affiliation with Advanta. The four company offices had
no address listings in city business directories.

Advanta appears to have been succeeded by an outfit, likely run by
the same criminal group, according to bobbearco.uk, called A-Cape
Transportation LLC. A-Cape's Web site bears a resemblance to Advanta's,
including the same addresses for its four global offices and lists a
similar set of transport services. Phone and email messages to the
numbers listed for A-Cape weren't returned.

A federal law-enforcement official said he couldn't speak about
Advanta specifically, but said authorities have seen these types of
fraudulent transactions fueling other cybercrime operations.

Federal authorities don't often target specific mule Web site
operations because the same criminal group can launch 50 or more such
sites a year. Instead of engaging in a whack-a-mole effort to shutter
each Web operation, they collect intelligence to figure out what group
is behind a collection of sites and go after the group, cybersecurity
specialists said.

Ms. Long said that about a month after sending her resume to Advanta,
she received an email from a human-resources officer at the company,
outlining a long screening process. The screening required weeks of
online tests, in-person training, and a "credit score over 600 and NO
criminal background."

"I was desperate for a job," said Ms. Long, a 50-year-old former
executive training coordinator for AT&T, who lives in a suburb of
Dallas. "I was more hopeful than I was skeptical."

Ms. Long conducted online searches for Advanta before starting the
company's training process in October. She said she found only the
company's Web site and the job listing posted on Careerbuilder.com, but
decided to give it a try.

A Careerbuilder spokeswoman said the company takes a number of
measures to fight ads that appear to be scams, but declined to provide
details to avoid tipping off scammers.

Ms. Long said she thought her job would entail customer support for a
shipping company. "I thought it was legit," she said.

After some early tests, Ms. Long's contact at Advanta, Mr.
Maeweather, asked her to help with a trial project, she said. Advanta
would transfer money to her credit card so she could purchase two Apple
MacBook laptops and then ship them to an Advanta contact using prepaid
labels. She would earn $350 in commission, he told her in an email.

Ms. Long went to purchase the MacBooks at her local Apple Store and
discovered that her credit-card company blocked the $5,000 Advanta
transfer. Ms. Long's boyfriend, Graham Shevlin, paid for it with his
credit card instead, she said.

"Even when we were buying the laptops, I was still thinking this is
fine," Ms. Long said. "Bells were not going off."

Ms. Long planned to mail the laptops the next day. But when she and
Mr. Shevlin looked at the shipping labels closely that day, the mailing
address in Ukraine raised their suspicions.

Mr. Shevlin did some research online that evening and alerted her the
next morning that Advanta had recently been listed on bobbear.co.uk as a
fraudulent shipping operation for cybercriminals. She didn't ship the
computers, she said, and returned them to the store.

Ms. Long alerted the FBI, but hasn't heard back. An FBI spokeswoman
said she couldn't speak about specific complaints.

In a phone conversation with a fraud officer at her credit-card
company, Capital One Financial Corp., Ms. Long said she was told that
the money transfer to her Capital One card had been flagged as
fraudulent. The transfer was being made with a stolen Bank of America
credit card.

A Capital One spokeswoman, Pam Girardo, confirmed Ms. Long's account.
"Anybody who says they want to pay you by putting a transfer on your
credit card, that's a big flag," Ms. Girardo said.

Write to Siobhan
Gorman at siobhan.gorman@wsj.com