Suspicious matter reports submitted to AUSTRAC led to the arrest of an international fugitive wanted for cybercrime and fraud offences. The suspect pleaded guilty to conspiracy to commit bank fraud, conspiracy to commit money laundering and computer fraud.
The suspect was sentenced to five years and 10 months imprisonment and also agreed to assist United States authorities to recover the stolen funds.
The suspect was an international fugitive who was wanted in the United States for cybercrime and fraud-related offences. United States authorities alleged that the suspect was part of an organised crime group that stole more than USD30 million from United States victims through an elaborate home equity line-of-credit fraud. United States authorities seeking the suspect's arrest published information about him online to alert the public and international authorities.
Australian authorities analysed three SMRs submitted by reporting entities, which included detailed information about multiple aliases used by the suspect. The SMRs prompted AUSTRAC to conduct further analysis, which ultimately assisted Australian law enforcement to identify the suspect.
Initial analysis of AUSTRAC information identified that the suspect held multiple Australian bank accounts in a false name, a joint bank account with a third-party and a business account for a cafe he operated. The SMRs detailed a range of transactions, described below, which reporting entities considered to be suspicious.
International funds transfer instructions (IFTIs)
The SMRs detailed high-value incoming IFTIs sent to the suspect's Australian bank accounts. The suspect received incoming IFTIs in USD totalling approximately AUD1.5 million. These funds were sent from Hong Kong by different individuals and businesses over a one-month period. The suspect also received two incoming IFTIs for AUD90,000 and AUD95,000 from Canada.
Further analysis identified incoming IFTIs into the suspect's accounts totalling approximately AUD6.6 million over a one-year period. The IFTIs were sent from Canada, Hong Kong, Indonesia, Nigeria and the United Arab Emirates. The individual IFTIs were for amounts between AUD30,000 and AUD765,000.
Of the AUD6.6 million transferred into the suspect's accounts, AUD2.6 million was sent to the suspect's personal account, mostly from Hong Kong, Canada and Nigeria. The suspect's business account received approximately AUD4 million from Hong Kong, Indonesia, Nigeria and the United Arab Emirates. The high-value IFTI activity was inconsistent with the café's established customer profile.
The SMRs reported that the suspect withdrew the funds received via the incoming IFTIs shortly after receiving them, using a range of withdrawal types:
- cash withdrawals at different bank branches in two Australian states
- cash withdrawals from automatic teller machines (ATMs) at gaming venues
- use of a debit card to purchase high-value goods including:
- AUD50,000 purchase at a luxury car dealer
- AUD95,000 purchase at a high-end jeweller
- withdrawal of a bank cheque for AUD195,000 made payable to a real estate agent.
Over the same period the suspect sent IFTIs totalled approximately AUD318,000. The IFTIs were sent to the United States, Canada, Germany, Luxembourg and Malaysia. The value per transaction ranged between AUD20 and AUD245,000. An outgoing IFTI to Canada for AUD245,000 was described by the suspect as 'pay out of mortgage'.
An SMR noted that the high-value incoming IFTIs and withdrawals were inconsistent with the customer's established profile, and therefore grounds for suspicion.
The SMRs identified a large number of high-value cash withdrawals from accounts operated by the suspect:
- eight cash withdrawals totalling AUD94,000 conducted at multiple bank branches over a 10-month period in amounts ranging between AUD1,000 to AUD57,000
- cash withdrawals undertaken within a short time frame at multiple bank branches including:
- three cash withdrawals totalling AUD25,000 over an eight-day period in amounts ranging between AUD6,500 and AUD9,500
- more than 15 cash withdrawals undertaken at multiple bank branches totalling AUD128,000 over a two-month period in amounts ranging between AUD5,000 and AUD9,700
- The above withdrawals appeared to be structured into amounts of less than AUD10,000 to avoid the threshold transaction reporting regime
- eight cash withdrawals of AUD1,000 each on the same day at the same branch
- more than 100 cash withdrawals at ATMs totalling AUD105,000 over a three-month period in amounts of between AUD80 and AUD2,000
The SMRs detailed a high volume of high-value cash deposits at multiple bank branches, including:
- two cashdeposits of AUD8,500 and AUD32,000 made at two bank branches on different days
- cash deposits totalling AUD56,000 over a three-month period with each deposit ranging between AUD3,000 and AUD23,000
- cash deposits for amounts between AUD45 and AUD65,000 totalling AUD105,000 made at multiple bank branches over a 10-month period.
Domestic electronic transfers
The SMRs also detailed high-volume and high-frequency domestic electronic transfers between the suspect's accounts:
- numerous transfers totalling AUD1.3 million over a two-month period between the suspect's accounts
- transfers from the joint bank account to the suspect's own accounts totalling AUD1.5 million over a three-month period
- transfers to and from unrelated third parties including:
- approximately 75 transfers totalling AUD7.2 million ranging in value between AUD140 and AUD1.2 million over a three-month period from the suspect's accounts to unrelated third parties
- transfers received from unrelated third parties totalling AUD7.2 million over a three-month period, ranging in value between AUD400 and AUD1.2 million.
Dissemination of SMRs to partner agencies
After analysing the SMRs, AUSTRAC disseminated them to law enforcement partner agencies, who used them to identify additional false names used by the suspect.
A further five SMRs submitted by reporting entities triggered AUSTRAC's monitoring system and were also disseminated to law enforcement. The financial transaction activity reported to AUSTRAC in the SMRs was consistent with the activity outlined above. Reporting entities detailed additional financial activity of the suspect including:
- two domestic electronic funds transfers conducted on consecutive days for AUD25,000 and AUD60,000 to bank accounts held by a casino and another gaming venue
- cash buy-ins of gaming chips totalling AUD275,000 during six visits to a casino, amounting to a total annual loss of AUD53,700 ('Chip buy-in' is the process of converting cash into gaming chips to be used in casino gambling)
- multiple structured cash buy-ins of gaming chips worth AUD9,000 and the suspect's refusal to show identification at a casino
- cash totalling AUD175,000 used to place bets at multiple gaming venues over a two-month period.
AUSTRAC information combined with analysis undertaken by law enforcement confirmed the identity of the suspect. AUSTRAC data identified phone numbers and address details used by the suspect which ultimately led to his arrest. AUSTRAC data also provided authorities with detailed information about the suspect's financial activities.
The suspect was arrested and extradited to the United States. He pleaded guilty to conspiracy to commit bank fraud, conspiracy to commit money laundering and computer fraud. He was sentenced to five years and 10 months imprisonment. The suspect also agreed to assist United States authorities to recover the stolen funds.
Case 5 - AUSTRAC data helped capture international cybercriminal