Organized Fraud Treats Scamming Like an Ordinary Business

Organized crime today looks less like back-alley deals and more like an ordinary multinational company. Fraudsters, hackers, and money launderers partner across borders and engineer ever-trickier and more dangerous scams. This organized fraud is clever and hard to trace. But our best defense is surprisingly simple.

See Money Laundering with Geoff White for a complete transcript of the Easy Prey podcast episode.

Geoff White is an author and investigative journalist covering the intersection between organized crime and technology. That includes cybersecurity, cybercrime, fraud, money laundering, and various types of financial crime. He has spent decades investigating fraudsters, hackers, and money launderers, and his work has been featured on BBC News, Sky News, The Sunday Times, and more. He’s also written multiple books. His most recent, Rinsed, looks at how tech has changed money laundering. It springs from work he’s done on the hit podcast and book The Lazarus Heist, which explored North Korea’s computer hacking campaign.

Geoff covered technology and cybersecurity for Channel 4 News, a UK broadcaster, for a while, and found an interest in the way these people and organizations operated. But it was challenging to condense the complexities of tech and crime into a 3-minute on-air segment. So he ended up doing more investigative work and long-form pieces, eventually leading to his books and podcast series.

What Makes Organized Fraud Interesting

Geoff has focused on this line of reporting because he finds how these gangs work and work together fascinating. He’s interested in organized crime, but more interested in organized criminals. He’s curious about the people behind it, how they work, and how they interact. These investigations let him look under the hood and see how things operate.

Organized fraud acts like a legitimate business empire. They have office space. They have employees that work Monday through Friday and get sick pay and paid holidays. They’re experimenting with AI and have recruitment issues. Everything you see in a normal business, you also see in these organized crime operations.

All the things you have in your normal business, they have on the organized crime side.

Geoff White

One of the big things that has changed about organized crime with the rise of technology is that back in the day, you tended to know the people you were working with. If you were robbing banks in London, you were working with other people in that area. If something went wrong, they could use the threat of physical violence to enforce “contracts.” But in the modern organized crime world, these gangs are international. This makes it hard for law enforcement to catch them, but it’s also a disadvantage because they no longer know who they’re working with. You can’t threaten to break someone’s legs if they double-cross you if you don’t even know where they are. Often, you don’t even know their name, just an online handle. It makes for some intricate and fascinating trust networks.

Old Crime and New Crime

It’s not that the old ways of doing organized crime have died out. These groups have just added modern organized fraud structures on top. This makes for some interesting dynamics among and between these groups.

If you look at street-dealing drug gangs, each dealer has a certain “territory” where they deal. Most gangs know that their territory ends at some point and another gang’s territory takes over. Gangs do get together and carve up territory, and this even happens on a global level. They all want to make money, and so they make agreements. It’s only when something happens, like someone deals on a street they’re not supposed to, that conflicts escalate. Physical territory is a big part of it.

Modern organized fraud and cybercrime don’t have physical territory. Instead, these gang wars happen at a commercial level, just like Google tries to steal customers from Microsoft. Because organized fraud gangs can’t kill or threaten each other very well, they just have to out-compete them. Ransomware gangs are especially notorious for that. The “affiliates” who use the viruses can use ones from different groups, so the virus creators have to appeal to them with how well it works and what kind of cut they give. These organized gangs are like enterprises, and competition now is less violent and more corporate.

In these modern organized financial crime empires, you can’t … kill them off or threaten them. So you just have to out-compete them.

Geoff White

Who is Doing Organized Fraud

These organized fraud gangs are a mix of existing criminal groups and new actors. It depends on where you look. In ransomware, for example, some of the people involved have been doing it since the earliest days of hacking, but a lot of them are also young and new to the field.

There is a global movement of young people in these kinds of cybercrime. In the UK, people as young as sixteen years old have been arrested for involvement in major cybercrimes. Young people understand tech better, so it makes sense that some of them would go into cybercrime.

There are also actors in this space who have been in organized crime for a long time. Especially with the scam compounds in Southeasts Asia, the people running those have often been in organized crime for a long time doing drugs and gambling before moving into cybercrime. Older players see the advantage of new crimes and move in, too. So it’s a very mixed picture.

Organized fraud also needs a lot of different roles. People who create viruses and run gangs are often people with a long criminal career. But to get into companies to distribute that ransomware, they need grunt work to try loads of passwords, do social engineering, and send phishing messages. The people doing that grunt work tend to be newer and less skilled.

Cybercrime requires an interesting mix of skills that can take years to build. Learning how to program a ransomware virus takes years. Learning how to call someone up and trick them into giving you their password is much easier.

Organized Fraud and Money Laundering

Money laundering has been around since organized crime was invented. Criminals have always needed a way to “clean up” their ill-gotten gains. Money launders find the need, find something to put the money through, and take some percentage off the top. It’s a fascinating industry because it does adapt to needs, and the options have grown with more technology. Obviously there is crypto now, but also video game currencies, NFTs, and other new financial systems emerging.

There aren’t any kind of rate boards for what percentage money launderers take. But Geoff has seen dark web forums showing costs up to 60%. If you’re new to organized fraud, you might end up paying that. But that’s a huge cost to your business, and there’s lots of incentives to get rid of that money launderer and find a cheaper one. There’s lots of competition trying to drive that percentage down. Geoff has seen percentages as low as 10%. But there’s a lot of incentive for these gangs to do their own money laundering and cut out the middleman.

The Dangerous Game of Money Laundering

For organized fraud gangs, lower-level “money mules” are disposable. They know the police are almost certainly on to these people, but if that person gets arrested, they can always get another. Victims especially are inherently disposable. But even if it’s someone else knowingly helping for a fee, these gangs know that for every one that gets arrested, there are ten more ready to take their cut.

People don’t understand how serious money laundering really is. They know it’s a bit dodgy, but they often have no idea that if they get caught, they’re going down for a long time. They think it’s not too big of a risk to take their cut and pass the rest along. But then the police knock on their door, and they’re in real trouble for enabling millions of dollars in crime.

Victims Become Accomplices

One amazing case, connected to a scammer known as Classic Baggie who was involved in romance scams and business email compromise (BEC), used victims to launder money. He had victims of BEC send the money to romance scam victims. This both helped launder the money and convince the romance scam victims that the person they were talking to online was genuinely rich. It was diabolically clever. Victims became money launderers, eliminating the overhead and keeping the victims hooked.

Giving victims some money back is an important tactic to keep them hooked, and it dates back over a century. The classic Hollywood film The Sting is based on a real and extravagant scam that happened in 1920s America. An important step in that scam was called “putting the mark on send.” The mark is the victim. To put them on send, the scammer gave them a small amount of money and sent them away for a little bit of time. It has significant psychological impact because the victim thinks that if they gave me money, it can’t be a scam. If the scammer has worked on the mark well, they’ll come right back and invest all the way in the rest of the scam.

An Experience Being “Put on Send”

Geoff got first-hand experience in a fascinating scam that put him on send. He got a tip and did some work for a service. It showed him a picture of a hotel and he had to give it a rating and a review. At the end of the day, they said he’d earned $20 and asked where to send it. He thought they were trying to get account information, so he set up a dummy account. But the money turned up in that account, and he withdrew it with no issues. The next day, he did it again. At the end of the day, they told him he earned $50, but if he wanted to unlock the next level, he had to pay $100. They had put him on send to make him feel like it was legitimate, then started an escalator scam where the amounts would keep going up.

Geoff walked away with the $20 and gave it to charity. But he realized someone must be looking at spreadsheets and calculating the investments. If too many people back out early, obviously the organized fraud gang won’t make a lot of money. How many people need to put in $10,000 to make up for the people who walk away at the $100 stage? Someone had to be doing the math, and he wanted to talk to that person.

Geoff has spoken to people who ran into crypto investment schemes that escalated incredibly far. Even when victims had lost everything, scammers came back to say that to get their money out, they needed to pay more fees. Even when they’ve taken everything, scammers keep squeezing. It’s frankly appalling.

Even when [scammers] have cleaned them out for everything they have, they come back to sting them even more.

Geoff White

Recovering Money Lost to Organized Fraud

When it comes to recovering the money that organized crime gangs steal from victims, it’s a very mixed picture. In 2021, ransomware hit Colonial Pipeline, and they got almost all of the ransom back. (However, it was in Bitcoin, and by the time it was recovered it was worth about half of what the company had paid.) There are cases where victims get their money back. But this was an attack on critical infrastructure, so was highly political and highly public. Most scams are for much smaller amounts of money, and the victims never get it back.

The vast, vast majority of scams … are for small amounts of money, and the victim just never gets their money back.

Geoff White

There was a story on BBC recently about a couple that lost a quarter of a million in crypto. They can see the wallets where the money is. Because of how the blockchain works, anyone with a computer can trace it. But finding it isn’t recovering it. If someone steals your wallet, just because you can watch them running away doesn’t mean you got your wallet back. To actually get the money back, you have to freeze it and then recover it.

Freezing requires a court order, so you have to know who you’re enforcing it against and get the court in that country to issue it. Recovery is also a legal process requiring you to prove it’s yours. And money launderers often stick the money in a thousand different crypto wallets. Now you have to get a thousand warrants against a thousand people – if you can even identify who owns those wallets in the first place. It’s extremely difficult in even the biggest cases, and law enforcement often doesn’t go through the effort for small amounts.

The Downsides of Controlling Our Money

Geoff was talking to someone the other day who brought up an interesting idea. Previously, we kept all of our money in banks. Banks were responsible for security, and they took a tiny amount of our money in fees to pay for vaults, security guards, and cameras. Now we have the idea of self-custody of worth. Crypto is a large part of that – it’s designed specifically to be kept out of banks.

But it’s not just crypto. If you want to stash all your money in a barn, that’s your choice. But are you hiring guards, putting up cameras, and protecting it like it would be protected in a bank? Even online banking and banking apps give us more power over our money. The more power you have over your money, the more responsible you are for your own security. That’s not an easy lesson to learn. And it’s challenging because we’re not security experts.

The more power we have over our money, the more on the hook we as consumers and individuals become for the security of it.

Geoff White

What laws and protections are available depend on your jurisdiction. But unfortunately, right now the primary responsibility for protecting ourselves from organized fraud is on us.

Protecting Yourself from Organized Fraud

British people are stereotypically obsessed with tea. So in the UK, they have a fraud defense rule known as “1-2-3 cup of tea.” It means that when anybody asks you to do anything to do with money, count to three, go make yourself a cup of tea, then come back to deal with the situation. This pause and stepping away will help you think more clearly and rationally.

We’ve gotten used to doing things immediately. In many ways, that’s great. We can instantly communicate with people anywhere in the world. But it also gets used against us. Quick decisions are often bad ones. Companies use it to get us to buy on impulse, and organized fraud uses it to steal from us. We have to push back and resist the pressure to act now. The more time we take, the safer we are.

The more pressure comes on us to make quick decisions, the more we have to push back and say no, no, I don’t have to make a quick decision on that.

Geoff White

We also need to be suspicious over longer periods of time. Scammers used to just send you one phishing message, and if you didn’t reply, they’d move on. But organized fraud is more patient. They’ll try longer and across more channels. Sometimes they spend weeks or months building a relationship with you before they start the scam. Unfortunately, we have to be constantly vigilant. It’s not a great message to tell people that they have to be suspicious for a long period of time. But it’s what we have to do to stay safe.

It’s not just that we have to be more patient and more questioning, more suspicious, unfortunately. We have to be suspicious over a longer period of time.

Geoff White

Hear Others’ Stories

Geoff’s final piece of advice is to listen to other people’s experiences with scams and organized fraud. If you’re not hearing them from your friends and family, start googling, listen to podcasts, or read articles. These stories are often hard to hear. But the one positive thing you can get out of them is to learn more. Think about what happened, how it could happen to you, and what you would do in that situation.

That’s why really good coverage of these stories explains what happened to the victim and how. You can glean information from that. When you find similarities between your life and the victim, you can start to identify where your risk factors are and be aware of what could target you. Never let a crisis go to waste – let someone else’s bad story make yours good. Seek out these stories, and when you hear them, run it against your own. Hopefully it will make you more secure in the end.

Learn more about Geoff White on his website, geoffwhite.tech. You can find all his stuff and his contact information there. He is also on LinkedIn. You can find his books, Crime Dot Com (about cybercrime in general), The Lazarus Heist (about how North Korea became a cyber superpower), and Rinsed (about money laundering) wherever books are sold.