How Scammers Took a Winnipeg Town For $430K Using Bitcoin (www.cbc.ca) 37
Slashdot reader lowvisioncomputing shares a story from the CBC about an elaborate heist discovered "when the chief administrative officer of a southwestern Manitoba rural municipality [population: 3,300] noticed the series of unusual cash withdrawals from its bank account...."
It began with a job advertisement. A seemingly legitimate company, with a professional website and a Nova Scotia address, claimed it was looking for cash processors. The contract was for one month. Employees could work from home.
They were told they would receive payments to their credit cards, which they would be expected to move to their bank accounts. They would then withdraw the payments, convert them into bitcoin, and send that to another account.... The majority of the 18 people hired were young and lived in various communities across the country.... Anyone who did an internet search for the company would find a professional website, with information matching what was provided in the employment agreement.
In early December 2019, the cybercriminals sent a phishing email to multiple people at the municipal office of WestLake-Gladsone, a municipality about 150 kilometres west of Winnipeg, on the southwestern shore of Lake Manitoba. At least one person clicked on the link, which allowed the hackers to get into the municipality's computers and bank accounts. But weeks went by and nothing happened, so the municipality didn't report it to the police. It was only after the money disappeared that the municipality discovered the two incidents were connected, said Kate Halashewski, who at the time was the assistant chief administrative officer for the Municipality of WestLake-Gladstone....
Court documents say that on Dec. 19, 2019, a person logged into the municipality's bank account and changed the password, along with the personal verification questions. Over the next 17 days, the cyberattackers added the 18 "employees" hired as payees and began systematically making withdrawals, transferring the money to the employees' credit cards. Dozens of withdrawals were made, totalling $472,377, according to court documents — a considerable amount for a municipality with an entire annual budget of $7 million.
Those withdrawals weren't discovered until Jan. 6, when Halashewski saw 48 bank transfers — each less than $10,000 — going to unfamiliar accounts.... Once they'd completed the initial transfers and conversion, the bitcoin was then sent to the private account of the scammers — who cybersecurity experts say likely aren't in Canada....
The municipality finally announced it had lost nearly half a million dollars in an Oct. 12, 2020, news release.... No arrests have been made in connection with the WestLake-Gladstone cyberattack and RCMP say it is no longer under active investigation.
They were told they would receive payments to their credit cards, which they would be expected to move to their bank accounts. They would then withdraw the payments, convert them into bitcoin, and send that to another account.... The majority of the 18 people hired were young and lived in various communities across the country.... Anyone who did an internet search for the company would find a professional website, with information matching what was provided in the employment agreement.
In early December 2019, the cybercriminals sent a phishing email to multiple people at the municipal office of WestLake-Gladsone, a municipality about 150 kilometres west of Winnipeg, on the southwestern shore of Lake Manitoba. At least one person clicked on the link, which allowed the hackers to get into the municipality's computers and bank accounts. But weeks went by and nothing happened, so the municipality didn't report it to the police. It was only after the money disappeared that the municipality discovered the two incidents were connected, said Kate Halashewski, who at the time was the assistant chief administrative officer for the Municipality of WestLake-Gladstone....
Court documents say that on Dec. 19, 2019, a person logged into the municipality's bank account and changed the password, along with the personal verification questions. Over the next 17 days, the cyberattackers added the 18 "employees" hired as payees and began systematically making withdrawals, transferring the money to the employees' credit cards. Dozens of withdrawals were made, totalling $472,377, according to court documents — a considerable amount for a municipality with an entire annual budget of $7 million.
Those withdrawals weren't discovered until Jan. 6, when Halashewski saw 48 bank transfers — each less than $10,000 — going to unfamiliar accounts.... Once they'd completed the initial transfers and conversion, the bitcoin was then sent to the private account of the scammers — who cybersecurity experts say likely aren't in Canada....
The municipality finally announced it had lost nearly half a million dollars in an Oct. 12, 2020, news release.... No arrests have been made in connection with the WestLake-Gladstone cyberattack and RCMP say it is no longer under active investigation.
From one scam to another (Score:2)
Insurance may not offer protection: expert
Now they need to deal with another set of scammers, legal scammers. Knowing how Insurance can work, I suspect the salesman said "you are covered, be happy" when writing the contract for that town.
Re: (Score:2)
Insurance may not offer protection: expert
Now they need to deal with another set of scammers, legal scammers. Knowing how Insurance can work, I suspect the salesman said "you are covered, be happy" when writing the contract for that town.
Knowing how insurance does work, I suspect you have no idea how much legal insurance turns out to be little more than a scam.
Do yourself a favor and relax and enjoy the holidays. Then, to celebrate the perpetual New Years promise of getting back into shape, go ahead. Print out all the fine print on your insurance contracts, and put it in front of you on a treadmill.
You'll lose 20 pounds the first week out of anger alone.
News for nerds? (Score:2)
That's not news.
Re: (Score:2)
It will be when it's reposted for the third time.
It's also just a bog-standard scam, phish someone, get into their organisation, move funds out through various means, the only thing that makes this one a bit different is that BTC is involved instead of the usual gift vouchers or prepaid credit cards.
So dumb (Score:2)
This is the obvious result of our scam society in which you can't ever trust anyone and politicians can lie as much as they want with no consequences. It lower's people resistance to scams which should be obvious. No company needs you to use your accounts to do their business.
Re: (Score:3)
Seriously. Use your own accounts, not the business's accounts. Move money through multiple accounts then withdraw the money. Convert it to BitCoin. The entire process was red flags all the way down - how the fuck are people this stupid?
Re: (Score:2)
The mistake was once they realized they clicked a malware link they didn't report it. But given the number of dodgy links they probably come across in the course of their jobs it would be an easy mistake to make.
Re: (Score:3)
The scam is so obviously scammy, and yet people fall for it. Who really thinks that you can get a job withdrawing money from one account and putting it into a different account? And yet... I think either they see "job" and "work from home" and don't read further, or else they are the type to just click any links in email.
And my mom falls for both. I say "this is clearly money laundering to avoid taxes" when I see money go in one day and the same amount being taken out the next, and she replies"he said h
Re: (Score:2)
> how the fuck are people this stupid?
P. T. Barnum had the answer nearly 400 years ago.
Re: (Score:2)
Why wouldn't an atmosphere of distrust (being unable to "ever trust anyone", as you said) and dishonest politicians should increase people's resistance to scams?
The mules who volunteered their accounts to help launder the money were fools, yes -- but the actual losses were causes because the town didn't lock down or report a compromise of the town's banking credentials.
Re: (Score:3)
Why wouldn't an atmosphere of distrust (being unable to "ever trust anyone", as you said) and dishonest politicians should increase people's resistance to scams?
You never ever ever start from a position of trust.
And before we blame our usual targets like politicians, lawyers, or whatever axe we have to grind, grifting has been around since humans have been around.
It is an inherent part of humans being humans. It is greed.
So what you do is as old Ronnie RayGun said.. trust - but verify.
So we have this amazing offer - you have people work from home, processing cash, get money put in their own personal accounts, then withdraw it and buy bitcoin with it.
Re: (Score:3)
"So what you do is as old Ronnie RayGun said.. trust - but verify"
Reagan learned that from the Russians & it rhymes in that language: doveryay, no proveryay
Re: (Score:2)
"This is the obvious result of our scam society in which you can't ever trust anyone"
Were that the case, the knuckehead who clicked on the link letting the scammers get a foothold would never have done so. There have always been scammers and people too stupid to realize one. And politicians aren't especially egregious with respect to lying. Everybody lies to some extent. It is lamentable, as you recognize, there is no penalty for them doing it.
Come to it, how would you define lying that would hold up in cou
Bitcoin wasn't involved in taking the money (Score:5, Insightful)
The money was taken with stolen credentials and credit cards. The town will get their money back. Unlike Bitcoin, these transactions are reversible. The money mules will be criminally prosecuted. They are also civilly liable. Try convincing a judge that you thought withdrawing close to $10000 and then buying Bitcoin with cash was a legitimate business and not the obvious money laundering that it is.
Re:Bitcoin wasn't involved in taking the money (Score:4, Insightful)
The story is pretty much a HOWTO for this sort of scam.
Other holidays to watch out for: summer vacation time, spring break for educational institutions, disruptions during strikes, election time (local, provincial/state/territory, federal), or in the US, government shutdowns.
Re:Bitcoin wasn't involved in taking the money (Score:4, Insightful)
1. people with no real skills are always looking for an easy way to make money (cf: crypto suckers);
2. people WANT to believe that it's legit. They NEED to believe it's legit.
The story is pertinent right now because the account was compromised before the Christmas holidays but not reported because "there was no activity."
The scammers did the smart thing - waited until the Christmas break to grab the money. It was only after people returned to work in January that it was noticed.
As for clicking on an email link - these are municipal employees. They get emails all the time from residents, suppliers, other governments, etc. Scammers know this.
We really need to ban crypto-coins. They serve no legit purpose, are a waste of the planet's resources, and facilitate criminal activity.
Re: (Score:2)
So they used the mules just to get local bank accounts with some normal history to avoid heuristic detection?
Re: (Score:2)
ISTR the average amount was around $2k, which the receiving bank wouldn't normally twig on, especially from a government source.
Winnipeg town? (Score:2)
Re: (Score:3)
should be a dupe from 2020 :) (Score:2)
The municipality finally announced it had lost nearly half a million dollars in an Oct. 12, 2020, news release....
You'd think this was on slashdot in 2020, but it looks like it wasn't.
Re:should be a dupe from 2020 :) (Score:4, Funny)
You'd think this was on slashdot in 2020, but it looks like it wasn't.
Slashdot runs on Amtrak Standard Time.
A Winnipeg town (Score:2)
Re: A Winnipeg town (Score:2)
Yo dawg!
Re: (Score:2)
Umm, no, they are talking about the province of Winnipeg, which is right next to the province of Regina. :P
Has nothing to do with Bitcoin... (Score:1)
How? (Score:3)
"They were told they would receive payments to their credit cards, which they would be expected to move to their bank accounts. They would then withdraw the payments, convert them into bitcoin, and send that to another account"
How does this sound legitimate, and not a classic money laundering scheme?
Re: (Score:3)
Of course it is a classic money laundering scheme. It's great that you recognize it as such, but it was explained pretty clearly to you, in the context of of article about scammers. I'm not a scammer, but I imagine that the people doing this (the mules) didn't recognize it because
1) They aren't that perceptive, at least about financial matters (doesn't even mean they aren't smart in other aspects in their lives). Remember there are some incredibly dumb people out there.
2) They are blinded (maybe willingl
Russia has to fund the war somehow (Score:2)
People still answer these "job" ads? (Score:2)
The supply of suckers must indeed be limitless. I would have assumed anybody of legal age has heard this one by now. Some people seem to just have a tenuous connection to reality and in addition a very low level of suspicion. Also, "if it sounds too good to be true, it usually is" should a "must understand to pass" thing in school.
Facebook Content Filtering (Score:1)