Police in Australia have arrested two men in connection with a $2.6m BEC (business email compromise) scam involving phony invoices.
The men are believed to be part of a syndicate responsible for emailing businesses with invoices doctored to divert transferred funds into the scammers' personal bank accounts.
In two early-morning raids carried out on April 2, New South Wales Police arrested a 29-year-old in Zetland, whom they believe to be the leader of the syndicate, and a 30-year-old in Roseberry.
Police seized computers, phones, drugs, $5,000 AUS, and $12,400 USD from two properties.
The 29-year-old is believed to have successfully gained more than $1.6m from illegal scams, which ran from mid-2018 until early 2020. His attempts to gain a further $1m didn't pan out.
His alleged partner in crime was arrested for supporting the syndicate, drug charges, and handling the proceeds of crime.
“These arrests are a timely reminder for all individuals and businesses to have strong cybersecurity measures in place for protection,” said commander of the NSW Cybercrime Squad, Detective Superintendent Matthew Craft.
“During this investigation, officers uncovered a criminal network targeting hard-working Australian businesses through a series of sophisticated email scams."
The syndicate allegedly stole money from businesses across a range of industries, which included property development, finance, construction, and other trades.
Police said the scammers didn't restrict their activities to one single region.
“Victims of cybercrime offences are not limited by state and territory borders and police will allege this syndicate targeted companies right across the country,” said Craft.
Last year, NSW police charged three other people in connection with the same criminal syndicate.
Australian businesses lost an estimated $60m to business email compromise scams in 2018 alone.
Earlier this year, Canterbury Olympic Ice Rink in southwest Sydney was conned out of $77k in a BEC scam. The rink's finance department received an invoice for a new ice resurfacer that contained changed payment details. As a result, the rink's payment for the new equipment ended up going to an anonymous criminal’s bank account in Hungary.