That's the ad they saw on Facebook.  "Due to special reasons" the company has decided to "sell the last batch of laptops." If you click the Shop Now button, it takes you to the website "maxwellplaceonhudson[.]com"

https://mainichi.jp/english/articles/20191223/p2g/00m/0bu/050000c

But How Do We Know It's Real?  ... Testimonials!

Strange that all of the comments on Sdhuy's page are in Filipino.  Even stranger? Someone named Tonie Pomintel thanked the computer seller "Memasabe" for a laptop using exactly the same words!

Mandy lives in Quezon City, Philippines, which does make it seem odd that he would be mail-ordering a laptop from New Jersey.  Even stranger?  "Ams Minang" shared exactly the same image to thank "Memasabe" for her new laptop!

MD tells us "So far so good, works great, looks great!" 

But then, for MD, people who look like John J. Rogers are kind of "his type."

I'm sure that Mandy and Sdhuy are fine people.  But let me tell you friends, MD, he's a Scammer!

MD Sajjad is a fake account that is giving a fake testimonial.

Take a look at his Facebook "Likes" -- 

He likes John J. Rogers, Noah Robert, Oliver Noah, Sean M Hemming, Debra Carter, Gerry R Frederickson, George S Krebs, and RiodiJanero ... who surprisingly all have the same two profile pictures!

Romance Scam and Online Fraud expert "FireFly" at www.scamsurvivors.com let us know that one of these men is the model "Michael Justin."  The profile picture is swiped from a 16MAY2019 post by Instagram user @themichaeljustin: 

https://www.instagram.com/p/Bxizn4iFWXy/ (@themichaeljustin)

The other primary profile picture is from a photo sales site and is entitled "businessman with laptop thinking at night office." 

https://photodune.net/item/businessman-with-laptop-thinking-at-night-office/20174205

Let's look at what else they have in common!

	Noah Robert is a "Computer Company" ... oh gee! On November 25th "due to special reasons" he starting selling computers from his website "ajakubowski[.]com" You may be surprised to know that ajakubowski's website is IDENTICAL to  MaxwellPlaceHudson's website! His telephone number is in Afghanistan. (+93 is international dialing code for Afghanistan.) Email ioiw7nkrvs@claimab.com https://www.facebook.com/Noah-Robert-103879551585935/
	Oliver Noah is a Computer Company. You'll never guess! Due to Special Reasons, he's selling the last batch of his laptops!  His website, "utoal[.]com" strangely looks EXACTLY like John's website! Sort of odd that he has an Afghanistan telephone number (+93) Email n7x1z325fk@thrubay.com https://www.facebook.com/Oliver-Noah-100751858389405/
	Sean M Hemming is a Computer Company . Guess what! Due to Special Reasons, he's selling the last batch of his laptops!  He has an Afghanistan telephone number and his website is MarbleTownGreen[.]com. (But it's closed down now.) https://www.facebook.com/Sean-M-Hemming-769171696455694/ Facebook tells us the Page Manager location is Bangladesh
	Debra G. Carter is a Computer Company. Guess what! Due to Special Reasons, he's selling the last batch of his laptops. He has a +93 Afghani telephone number and his website is "teamlse[.]com" https://www.facebook.com/Debra-G-Carter-746064202423878/ Facebook tells us the Page Managers are in Indonesia, Liberia, Saint Vincent, and the Grenadines.
	You might already be able to guess on this next one. Gerry R Fredericksen is a Computer Company.  Due to Special Reasons, he's selling the last batch of his laptops.  He has a +93 Afghani telephone number and  His website is "legeb[.]com" is currently disabled. https://www.facebook.com/Gerry-R-Fredericksen-104079251980543/
	George S Krebs is a Computer Company.  Due to Special Reasons, he's selling the last batch of his laptops.  His email is "esi01uo8d15@claimab.com"  His website is "highlyacceleratedstresstest[.]com" is offline. https://www.facebook.com/wo.kya.hoti/
	RiodiJanero is a Computer Company.  Due to Special Reasons, he's selling the last batch of his laptops. His email is xdwdseiwb6@linshiyouxiang.net His website is PineappleHillDesigns[.]com is offline. He has a +93 Afghani telephone number.

So, getting back to the original question:  

Actually, I'm thinking that you may not really be able to buy a $2,600 laptop for $79 and have it delivered anywhere in the world in time for Christmas.  But then, my friends all tell me that I'm paranoid.

And there's so many more ... 

 

another Fake testimonial account: https://www.facebook.com/ams.minang.5/likes 

https://www.facebook.com/antonia.pomintel.5/likes_all

• Helen Z Picket
  • https://www.facebook.com/Helen-Z-Pickett-111752013985708/
  • http://andaluciapropertyservices.com/
  • (216) 755-9391
• Jackie K Freund
  • https://www.facebook.com/Jackie-K-Freund-448774108917513/
  • http://affordablegreensystems.com/
• Andrew H Doyle
  • https://www.facebook.com/Andrew-H-Doyle-105266824762892/
  • http://affordablegreensystems.com/
  • +93212-307-8110
• Memasabe
  • https://www.facebook.com/Memasabe-103806308164677/
  • http://snvpL.com/
  • +93803-520-1898
• Fernando
• https://www.facebook.com/Fernando-1894457434202054/
• http://caughtfromabove.com/
• 6trmfvuo2sh@thrubay.com
• +93704-927-4239
• Anne P Dudley
• https://www.facebook.com/Anne-P-Dudley-141541912968147/
• http://fricade.com/
• y38msxh8zps@claimab.com
• Dean B Vigil
• https://www.facebook.com/Dean-B-Vigil-116775383783140/
• http://fmpcms.com/ (live) 
• +93816-539-3967
• shhk60jhpng@claimab.com
• A Addawd
• https://www.facebook.com/A-addawd-100571795787651/
• http://schoolbackpackstore.com/ (live) 
• Criative
• https://www.facebook.com/criativcalcad/
• http://fourteenkaratomaha.com/
• 5c992xqncjc@thrubay.com
• My House 
• https://www.facebook.com/My-House-100743925704289/
• https://konamitech.com/ nbsp;(live) 
• +213717-630-6321
• gv2q360p9q@claimab.com
• Helen T Lewis
• https://www.facebook.com/Hector-T-Lewis-106551108311154
• http://stevestoyboxny.com/
• +93304-763-9483
• ftxwy0rlela@linshiyouxiang.net
• Leonia D Hill
• https://www.facebook.com/Leonia-D-Hill-107212691802456/
• https://chealyjean.com/
• +93361-299-6243
• ioiw7rnkrvs@claimab.com
• Kermit
• https://www.facebook.com/Kermit-119766538090600/
  
• http://certificadoscolombia.com/

And the network is even bigger, because they also have female fake store owners selling Mobile Phones: 

This week the Department of Justice received a guilty plea from Jianjie Liu, a Chinese citizen living in Texas. 

https://www.justice.gov/usao-ndga/pr/chinese-national-pleads-guilty-money-laundering-scheme

The case began when Liu was arrested at a Walmart in Duluth, Georgia after attempting to purchase "a suspicious number of gift cards."  During that arrest, her 2016 black Nissan Altima was searched, and was found to have 718 gift cards, mostly WalMart, Vanilla Mastercard, and American Express gift cards. he also had a deposit slip showing that she controlled a JP Morgan Chase Bank account ending in #5887. The bank account was tied to her business license in Gwinnett County, Georgia fro "A&J Commercial Services" which used an address at 16634 Roseglade Drive, Cypress, TX 77429. 

The 16,000 images on her phone were reviewed, and found to contain many images of gift cards along with their accompanying purchase receipts. 

From May 30, 2019 until September 30, 2019, Liu deposited at least $70,400 into her Chase account from elderly fraud victims.  Those funds were all seized by the U.S. Secret Service, however there were many other victims and victim types described in the court records:

In a "Grandparent Scam""Sergeant Jonathan Parker" called one of the elderly victims claiming their teenaged grandson had been arrested for assaulting a police officer and was required to post $9,000 bail.  He sent a box with $9,000 cash in it to an address in Las Vegas, Nevada.  Days later, Sergeant Parker demanded an additional $15,000 to settle the matter out of court.  He again sent a box of cash to Las Vegas.  Then he was asked to send $5,000 to pay the medical bills of "Officer Joyce Phillips" and this time sent a personal check to "Joyce Phillips" of A&J Commercial Services, 3182 Steve Reynolds Boulevard, Duluth, GA 30096. 

In a "Compromised SSN Scam" another elderly victim was told he was being investigated by the IRS, and that during the investigation, to protect his funds, he needed to convert all of his cash to Gift Cards, which would be held in escrow pending the results of the investigation.  These gift cards were used by Liu to purchase the gift cards in the Walmart in Duluth, Georgia. 

Liu posted $10,000 bail, and shockingly, failed to appear in court again.  

She was re-arrested in Pearland, Texas on 06JAN2021 for theft, where it was discovered that she had an outstanding warrant.

https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf

The number of complaints increased by 7% to 847,376 from 2020 to 2021, however the reported losses increased by 64% year over year to $6.9 Billion!

#1 is still Business Email Compromise, but with only a 3% increase in victims, there was a 28% increase in reported financial losses.  That's an average loss of $120,000 per victim, compared to last year's $96,700 per victim. 

#2 dislodges Romance Scams by Investment Scams for the first time ever with a dramatic increase!  Investment Scams went from 8,788 complaints to 20,561 complaints, while losses increased 333% from $33.6 Million dollars to $1.45 Billion dollars!  THat's an average loss of $70,810 per victim, up from $38,287 per victim last year!

#3 Romance Scams was quite similar to 2020 in the number of complaints, however the amount of losses still increased by 59%.  In 2020, the average victim lost $25,272, but in 2021, the average victim lost $39,344.  And these victims tend to be senior citizens! 

Investment Scam Examples

Crypto-Trades[.]uk

The site pictured above claims to be "Crypto-Trades[.]uk" and offers proof of their legitimacy by providing a link to their "Certificate of Registration."

Crypto-Trades dot UK

claiming to be the British Corporation, "Crypto Ltd" which is a real company, just not them. 

They are regularly abused in that way.  CryptSparkFX[.]com, Crypto-binary[.]com, CryptoTrust[.]ltd, CryptoAlphas[.]uk, CryptoHive[.]uk, Webull-Investments[.]com, ExploreFX[.]uk, Crypto-Gain[.]ltd, Slushpool-investment[.]com, Intrex-invest[.]com, and FedelityFunds-Crypto[.]com are some of the other Investment Scam sites that use their address, hoping to gain credibility from it. 

Intrex-Invest[.]com

FedelityFunds-Crypto[.]com

Slushpool-investment[.]com

CryptoHive[.]uk

A True Victim Story

A successful businessman in my area came to me to ask for help.  He had originally joined a group such as those above called CryptoHood[.]io which later became CryptoHood[.]co.  He invested a small five figure number on their site, and got scammed, losing it all.  When he was complaining about being scammed, someone in a Facebook investment group let him know they too had been scammed by those people.  But good news!  He had found a legitimate company that really paid out!  EasonFXPro[.]com! Because he had been burned already, he put in a smaller investment this time.  $2,500.  An amount that this CEO "could afford to lose."

The scammers let him know that because he was a VIP investor, they were going to let him use their "special" app, so that he could watch his trades in real time.  The theory was that their advanced Artificial Intelligence was doing Bitcoin trading to make amazing profits.  The app they used was in the Google Play store ... but the VIP version was only available via their special URL.  They convinced him to download the app from "blockchain.en.uptodown[.]com/android/download/2264221." That was his "personalized" version.  He was truly amazed by the bot, and could enter "his" bitcoin address into any blockchain explorer to see his earnings.  (We checked the address, and it was doing HUGE volumes of small transactions ... it just wasn't his wallet.   He was led to believe that the transactions were "the AI doing trades" for him.  Within a couple months, his bitcoin address had funds worth nearly $250,000!  So he decided to cash out.

In order to cash out, he just had to pay them a "Sigma Fee" of 10%.  He refused ($25,000!?!?!?!) 

They then offered to let him withdraw just $50,000, for a Sigma Fee of only $5,000.

He was harassed on the phone for a while by "Elizabeth Frances" and "Evelyn" and "Mark Gerrard" and "Steven Williams" but chose to file an IC3.gov report about his experiences and walk away from Crypto Investments for a while.

The Appeal of Easy Money

With 1100 "likes" it must be real, right?

And they provide screenshots as proof that they are really getting paid!  So, it's guaranteed, right?

BLUF: Bottom Line Up Front

Organizations should report anomalous cyber activity and/or cyber incidents 24/7 to report@cisa.gov or (888) 282-0870.

 Anyone who has seen one of my presentations recently knows that I am a huge cheerleader for CISA.gov, the Cybersecurity & Infrastructure Security Agency at DHS, which replaced the National Protection and Programs Directorate (NPPD) that previously led private sector engagement and interaction for DHS.

Previously, I've asked people to make sure someone in their organizations was watching four critical information sharing pages at CISA.  

Documentation of Two Historical Hacking Campaigns Against Critical Infrastructure

https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical

My niece, Anna, is a school teacher in the Birmingham Public School system.

Another teacher in the system got phished and the phisher sent an email to a bunch of other teachers, offering them a summer job as an administrative assistant, earning $500 weekly for working only 8 hours.  Tempting?  

The email had a link to a Google Form with the job application.

The form goes on to ask her Full Name, Email: [Not School Email!], Alternative Email, and Phone Number, as well as Current Occupation, Age, Sex, and Available Time.

Why does it say "Not School Email!" -- because this exact scam is being conducted by phishing people in schools all across the country! 

Her new boss, Dr. Reinn, hit her up on text, from the phone number (904) 297-8521, got her resume, reviewed it, and offered her the job on the spot!

She got hired and was EMAILED a set of duties and responsibilities.

Her duties were basically:

• DONATE to three foster homes a month
• book TRAVEL ARRANGEMENTS for her boss and his associates 
• manage RETURNS and errands such as shopping, POST OFFICE 
• send birthday cards and GIFTS to clients, family, and friends

Her first assignment would be to make a donation to a local orphanage.  

So he emails her an IMAGE of a check that she was supposed to mobile deposit to herself and then send $4800 of the $4950 via ZELLE to a second scammer email: lookatthepudding@gmail.com

I'm not sure why she would think this check is not TOTALLY LEGITIMATE, right?  And why wouldn't donations to an orphanage be sent to someone's Zelle account named "Look At The Pudding?"

Clearly Anna's name and the amount have been laid on top of the check on another piece of paper and then photographed.  Who writes a check like that?  Oh!  Someone who has STOLEN a check and needs to re-use it but is too lazy or stupid to wash it properly.

She wisely did NOT deposit the check, which revealed that she knows this is a scam.  

Unfortunately, during the job application process she was required to provide referrals.  Now the scammer is calling and messaging her references asking for her whereabouts and claiming that she stole $4,950 from his company and he was trying to find her to have her arrested.  He also called her current employer at least three times.

On July 7, 2022, the US Attorney for the Northern District of Texas announced that Ping Express had been found guilty. Prior to this, their CEO Anslem Oshionebo*, their COO Opeyemi Odeyale (now imprisoned at the Danbury Federal Correctional Institute, 60177-177), their IT Manager Aleoghena Okhumale (now imprisoned at the Fort Worth FMC), and Olufemi Sadiq (now imprisoned at the Pollock FCI) were arrested on March 10, 2020.

What was Ping Express? Ping was a small business, never having more than ten employees, which operated from 8585 N. Stemmons Freeway, Dallas, Texas. Their CEO was Anslem Oshionebo and their COO was Opeyemi Odeyale. Ping had a smart phone app and a website and advertised that its users could easily send money to Nigeria for a small fee. It operated by having money on deposit in Nigeria. When a US-based client requested a transfer, a hold was placed on the customer's bank account (similar to a hold placed when one rents a car or stays in a hotel.) Then Ping would transfer funds from its Africa-based wallet to the recipient's Africa-based bank account. When the transfer was completed, Ping would then request payment from the sender's bank account.

While this post is about the US-based aspects of Ping Express and their crimes, the company's Instagram page continues to advertise that individuals in many places can use their services, including the UK, Canada, and Europe.

During a three-year period examined in this case, Ping transfered more than 300,000 payments totaling $167 Million USD. During this time it did not file a single Suspicious Activity Report, although they did make some batches of reports under section 5318(g) in 2015, 2016, and 2019.

To maintain a business license in Texas, they were required to file a detailed business plan, including their statements regarding how they would comply with BSA/AML laws (Bank Secrecy Act and Anti-Money Laundering Act, including CFT, Countering Financing Terrorism). Among the rules that Ping established and conveyed to the state of Texas, they agreed to the following:

• All first-time customer transactions are limited to $499.
• Total monthly transactions cannot exceed $4500.
• Further transactions are limited to $1800 each, with a $3000 daily maximum.

They also claimed that they had "automated velocity checks" and the ability to "track and block IP addresses" to help prevent violations.

The court records include a "Factual Resume""in support of Ping Express US LLC's plea of guilty to the offense in Counts 1 and 2 of the Superseding Information."

Count One - "failure to maintain an effective anti-money laundering program" was proven by demonstrating the defendent acted willfully in failing to develop, implement, and maintain an effective anti-money laundering program.

Count Two - "operating an Unlicensed Money Transmitting Business"

In the Factual Resume, the Count One requirements which they failed to implement are stated as:

An "effective anti-money laundering program" which is required by law, requires that Ping Express establish one or more of the following minimal requirements set forth by regulations of the Secretary of the Treasury. The Guilty Plea confirms that they failed to do so:

a. Effective written polices, procedures and internal controls for one or more of the following:
i. Verifying customer identification
ii. Filing reports, such as suspicious activity reports
iii. Creating and retaining records

b. Designating a person to assure day-to-day compliance with the anti-money laundering program, including assuring tat:
i. Ping properly filed reports, created and retained records, in accordings with applicable requirements, such as suspicious activity reports
ii. the [AML] program was updated as necessary to reflect new requirements

c. Provide education and/or training of appropriate personnel concerning their responsibilities.

Examples of AML Failures

• Fatai Okunola, a first-time customer, sent $1800 in January 2018
• Raman Saliu, a first-time customer, sent $1800 in October 2017
• Jeffersonking Anyanwu, a first-time customer, sent $1400 in March 2018

Between April 1, 2016 and June 30, 2018, 1500 different customes violated the maximum monthly transfer rules.

Okunola sent more than $6700 his first moneth, and broke the $4500 rule every month from January 2018 to November 2018. He sent $80,000 just in August 2018!

Anyanwu paid $17,000 through Ping, and broke the maximum monthly rule six times between March and November 2018, paying more than $10,000 in a month four times.

Another customer broke the rule six times from October 2016 through June 2018.

Okhumale, who worked for Ping as their IT and Technical Support Manager, broke the monthly rule three times, paying $25,000 just in October 2018.

The daily rule was also largely ignored. Okunola violated the $3000 daily limit 45 times, and sent more than $5000 in a day 20 times! Okhumale, the Ping employee, sent on three consecutive days in October 2018 $4600, $5200, and $3600! Collins Orogun sent more than $3000 per day 60 times between November 2018 and December 2019, totaling more than $300,000!

Although Ping claimed that they used the IP address of the customer to ensure that they lived in a state where Ping was licensed to do business, and required customers to submit a utility bill from a company where they were licensed to do business as proof of residency in that state, they frequently ignored this rule. Ping was only licensed to do business in Georgia, Maryland, Texas, Washington State, and Washington D.C.

• Joseph Kadiri, a Ping customer, sent $216,000 claiming to be in Texas or Maryland, when in fact he resided in New York and Michigan where Ping is not licensed. He violate te daily limit 20 times and the monthly limit twice.
• Isaac Omohake, a Florida resident, sent $469,000 through Ping, which is not licensed in Florida. He violated the daily limit repeatedly, and in November 2018 sent $78,000 in one month.
• Taiwo Akinsanmiju, an Indiana resident, started sending funds at age 17 (a violation) and sent $220,000 to 85 different named individuals!
• Ayodeji Jegede, an Ohio resident, sent $468,000 through Ping, violating the first transaction rule, the monthly rule (twelve times from June 2018 to June 2019) and in May 2019 sent $69,000 in a single month!

Investigators found that Ping's top 100 customers sent $19,400,000 from March 2016 through September 2019, and that 2/3rds of these customers were from "unlicensed" jurisdictions. Ping was fully aware that these customers lived in unlicensed states. When the Ping offices were search on March 9, 2020, 130 customer shipping labels were found for statements being sent to unlicensed states. Just those customer's transactions were $4,000,000!

The laws in this area are United States Federal Code Title 18 Section 1956, the Anti-Money Laundering Law, and Title 18 Section 1960, the Prohibition of Unlicensed Money Transmitting Business Law. The first states that you may not process funds that you know or should know are derived from certain specified criminal activities. (There are 200 such illegal activities specified in the law.) It specifically states that you cannot allow yourself to be "Willfully blind" to the source of funds. Detailed guidance, often called "Know Your Customer" or KYC, is provided for how to recognize and report suspicious activities.

• Nevada: $476,000
• New Jersey: $234,000
• Utah: $1,500,000
• West Virginia: $507,000
• Connecticut: $626,000

When a customer entered their street address at registration, Ping willfully chose to not include the City, State, or ZIP code in their records if the customer was not in a licensed location, storing only their street address.

Ping's Execs and Investors

Ping's Chief Operating Officer, Opeyemi Odeyale, was well aware of US banking law. Prior to Ping, Odeyale earned an MBA from Edinburgh School of Business and held jobs at Pricewaterhouse Coopers, JPMorgan Chase, Oceanic Capital, BNP Paribas, and Barclay's Bank.

During the time he was running Ping Express in the United States, he also served as a director in the British firm "PayZen Limited" from 25JUN2013 through 03DEC2020 (recall he was arrested in March 2020.) His fellow officers at PayZen included Adekanmi Olaolu Adedire, Robert Aghadiuno (IT Consultant), and Anslem Oshionebo (Financial Consultant), his CEO at Ping. Notably, Payzen was originally incorporated as Fiem Ltd but changed its name on 10FEB2020. Texas records also indicate that Ping Express originally operated as Fiem Group, LLC, and bank accounts in the name of Fiem Group are on the Forfeitures list below! On 01FEB2017 Opeyemi Odeyale filed papers with Companies House indicated that his nationality had changed to "British." When the British company was first incorporated (as Clicks FX Limited), he had given his date of birth as 14FEB1979 and his nationality as Nigerian.

Ping's Chief Executive Officer, Anslem Oshionebo, began his career with an MBA from Seton Hall University's Stillman School of Business. His LinkedIn page says he worked at PriceWaterhouse Coopers for 14 years, working his way from Senior Associate to Manager, and then Senior Manager, at least partially in Los Angeles. He then worked at Riveron Consulting as a Principal in the Dallas/Fort Worth area before co-founding Ping Express in 2014. His Crunchbase profile says that his areas of practice at PWS included "Compliance regulations and financial forensics!" Anslem's domain "anslemoshionebo.net" has articles he has written on philanthropy and diversity, while his anslemoshionebo.medium.com page has articles about what books Entrepreneurs should read and a five part series called "Challeges of an Immigrant" (which were mostly written AFTER he was arrested!)

In April of 2017, Synergy Capital Managers, a Mauritius-based private equity firm, made an investment in Northstar Finance Services Limited, "a financial services platform providing solutions across the financial service value chain in select countries across West Africa." Northstar was said to be managed by Obafami Alonge and Bolanle Oduyale, In Synergy's announcement, Northstar's CEO said that with this investment the company now had a "majority stake" in Safetrust Nigeria, Northstar Home Finance, Avance Insurance, Ping Express Inc., and Fast Credit Limited. PWC, where Oshionebo worked for so long, was said to be the advisor to Synergy Capital "on Financials and Tax due diligence."

This comes to play in that if Ping had "foreign investors" they are required to disclose those.  When the Texas B

Top Customer: Collins Orogun, Romance Scammer and Money Launderer

Collins Orogun, a Texas resident, paid Ping more than $800,000 which included $220,000 in wire transfers during a six-month period in 2019. Ping only reported $292,500 of these transmissions. (Collins was released from prison on 12MAR2020 for prior charges but has another sentencing hearing in October 2022 for the current charges.) In his guilty plea, Orogun admitted that he received funds from people "all across the United States" in forms including cash, money orders and checks. He then deposited those funds into his accounts, including at JPMorgan Chase, both in his true name and as "Collins Enterprise", at Navy Federal Credit Union, at Wells Fargo Bank, both in his true name and as Orogun Enterprises, and at BBVA.

His JPMC accounts received $120,000 in funds, which he sent out through Ping in 13 transactions. In another example, he received $26,500 "in currency and money orders" between November 29, 219 and December 31, 2019. He sent these funds out via Ping in six $5,000 transactions. In his Navy FCU account, he received $530,500 in "currency and money orders" and sent a wire transfer of $218,500 out. He also sent $192,600 via Ping in 68 transactions. His first Wells account received $87,171 in deposits, sending $65,610.56 of those out via Ping. His second Wells account received $157,578 in deposits, of which he sent $82,367 out via Ping. His BBVA account received $144,808 in deposits, of which $140,000 was sent out via Ping.

Some of his Romance Scam victims included:

$40,000 into BBVA that came from "D.M." a senior citizen in California who sent the money to facilitate the sale of an estate in Nigeria. He believed that he was helping to repair an estate which would be then sold for $570,000,000, and that he would receive a large repayment when the estate was sold.

"P.L" from Indiana believed her $6,309 was sent to "Thomas Ken" an Irish sea captain with whom she had a romantic online relationship. The funds were supposed to be used to repair his ship. She took out a title loan against her vehicle and wired the money to Orogun Enterprises. The captain immediately asked for more funds afterwards.

"D.N." a 59 year old in Indiana sent $2300 to the BBVA acount, believing that "Carson Steve Jacks" an oil roughneck working in the Gulf of Mexico needed the funds because he had contracted malaria and couldn't work. He later asked for an additional $15,000. The couple "fell in love" via Google Hangouts.

These three had all agreed to testify at trial, prior to Collins changing his plea to Guilty on June 28, 2022.

Additional Factors Violating Texas Department of Banking License

• Ping stated that they had no "authorized delegates or agents" yet Nimerex claims to be Ping's agent and has Ping letterhead documentation appointing them as Ping's agent.
• Ping claimed to have no foreign affiliates, but had received $160,000 from a Mauritius-based account in the name "Ping Express (Mauritius) Ltd.""for the benefit of Fiem Group LLC" and a $280,000 wire from a British account in the name Ping Express CM.
• Ping claimed to be sending "small remittances" back to Nigeria, but had sent $1,600,000 in large round number wire transfers to business bank accounts in Nigeria (at First City Monument Bank and Wema) for "marketing" and "consulting" payments.
• Ping received $49,000 in wire transfers from the company "Date2Marry LLC" and an individual connected with that LLC.

These details came out during a search of Olufenwi's phone as he returned to California from England. The phone also documented a five year "currency exchange partnership" between Ping and "Wilfobs Bureau De Exchange Limited" in Nigeria involving multiple foreign bank accounts for Ping. Ping had disclosed in previous reporting to the Texas Department of Banking that they had no bank accounts outside U.S. borders and thus were not required to file a Foreign Bank Account Report.

Chats on Odeyale's phone made it clear he was trying to avoid AML and Suspicious Activity detection as he received foreign funds. An example:

Forfeitures ordered by the Court

1. Approximately $10,601.52 in funds seized from the JPMorgan Chase Bank account with number ending in 2885 in the name of Collins Ogaga Orogun.
2. Approximately $3,679.78 in funds seized from the JPMorgan Chase Bank account with number ending in 8900 in the name of Collins Ogaga Orogun dba Collins Enterprise.
3. Approximately $42,873.96 in funds seized from the JPMorgan Chase Bank account with number ending in 1223 in the name of Ping Express LLC.
4. Approximately $1,385.13 in funds seized from the JPMorgan Chase Bank account with number ending in 2686 in the name of Ping Express LLC.
5. Approximately $13,269.69 in funds seized from the JPMorgan Chase Bank account with number ending in 5397 in the name of Crusaders Health and Wellness LLC.
6. Approximately $3,010.72 in funds seized from the Navy Federal account with number ending in 2248 in the name of Collins O Orogun.
7. Approximately $8,307.53 in funds seized from the Wells Fargo Bank account with number ending in 4593 in the name of Anslem Oshionebo.
8. Approximately $369.82 in funds seized from the Wells Fargo Bank account with number ending in 4437 in the name of Blackbit LLC.
9. Approximately $8,364.86 in funds seized from the Kasasa Tunes 0031 account at Neighborhood Credit Union for member number XXXX5691.
10. Approximately $55,235.41 in funds seized from the Soho Business Checking account at Resource One Credit Union for member XXX1450 in the name of Fiem Group LLC.
11. Approximately $37.40 in funds seized from the Bank of America account with number ending in 3918 in the name of Deyks LLC.
12. Approximately $9.91 in funds seized from the Bank of America account with number ending in 3921 in the name of Deyks LLC.
13. Approximately $14.15 in funds seized from the Bank of America account with number ending in 3947 in the name of Deyks LLC.
14. Approximately $11.52 in funds seized from the Bank of America account with number ending in 3692 in the name of Deyks LLC.
15. Approximately $29,198.23 in funds seized from the Capital One account with number ending in 2957 in the name of Aleoghena Okhumale.
16. All funds seized from the account with number ending in 1891 at Silvergate Bank in the name of Wyre Payments Inc. deposited after February 19, 2020 from “5/3 BANKCARD SYS DEPOSIT; 5/3 BANKCARD; or WORLDPAY”. 

 Lately there has been a media-driven craze in the fraud community to call every crypto-investment scam "Pig Butchering."  I hope you will join me in canceling that term after you read this article.

The term "Pig Butchering" comes from the Chinese term 杀猪盘 (Shā zhū pán or "butchering plate.") While the term has been used in Chinese media since at least 2018, it really became famous after the courageous actions of a human trafficking victim who was caught up in the game.

Hao Zhendong (郝振东) was recently divorced and had lost custody of his daughter as he was facing personal financial challenges and could not care for her.  During his time of desperation, he received a message from his uncle.  The uncle told him that he should come to Myanmar and join him at his work.  He claimed that Zhendong would be able to easily earn 60,000 to 70,000 yuan per month. 

Image from "Talking to Strangers" interview

Zhendong says that he often considered attempting to flee, but northern Myanmar is an "extrajudicial land" and Chinese people are regularly kidnapped and killed there with no consequence to their attackers.  One man who attempted to flee was forcibly returned to the camp, with the fingers on one hand amputated. 

In the work camp where Zhendong was enslaved, there were three buildings.  Two were dormitories and the call center was housed in the "Science and Technology Building." Each team was assigned to different topics.  Some worked lottery scams, others foreign currency exchange scams, naked chat / extortion scams, pornography scams, etc.  But Zhengdong was assigned to a "pig-killing gang." 

He was provided a manual which described his role.  His job was to target victims on the Internet and use emotions to convince them to invest their entire net worth in illegal online gambling.  His job as a "recruiter" for these scams was referred to in the manual as a "dog pusher" (“狗推” Gǒu tuī.)

He was provided three mobile phones and three "love story" script books.  His job was to find wealthy single or divorced women on social networks, and add at least two to his chat each day and build a romantic relationship with them online.  Once they were suitably "hooked" into his romance, he was supposed to turn them over to his team leader, who had 30-40 "dog pushers" under him to "kill." If the victim provided more than a million dollars, there was a celebration and the dog pusher was rewarded extravagantly. 

While he was learning the role, "the company" became very excited about a successful scam that one of the other dog pushers had accomplished.  He had convinced a young woman in Shanghai to invest her entire life savings - 2.92 million yuan - and when she realized she had been scammed, she committed suicide by jumping off a roof.  Another woman was convinced to sell her car and her house in order to invest more.  While the company thought these were great examples to emulate, Zhendong's spirit died.  He realized that he had to try to do something about this. 

On one point, his uncle had been telling the truth.  The company used cash bonuses as incentives, and each month they would spread millions of yuan on the table and pay out bonuses.  Some made the equivalent of hundreds of thousands of dollars in bonuses.  But Zhendong couldn't do it. 

He began sneaking up on the roof, using a stolen phone, and messaging his victims - explaining to them that he was enslaved and being forced to scam them.  Because he was failing to earn, his controllers were becoming very angry with him and his life was actually in danger. 

A potential victim, Yang Yu, changed things for him.  When he called Yang Yu to warn him, Yang Yu asked him "How can I help you get home?" In order to protect Zhendong, Yang Yu passed him money that he could give to his controllers as proof that he was working. Then Zhendong stole a list of victims from the company and urged Yang Yu to take it to the police. 

In February 2021, she took a list of 18 victims to the Anti-Fraud Center of Nanchang Public Security Bureau. 

Tao Jiangjiang, the leader of an Electronic Fraud task force who helped Zhendong get home

Tao Jiangjiang began to communicate with Zhendong and a rescue mission was arranged through the Yunnan police, working with an informant in Myanmar.  Despite being advised not to take any risks by Tao Jiangjiang, Zhendong felt that he could not leave empty-handed.  He worked to observe the password his Pig Killer boss used to log in to the company server and late one night logged in and wrote down as many names as he could.  When he arrived back in China, he had a list of 105 additional victims with him who were contacted and assisted by the Chinese police. 

There was a dramatic event at the China-Myanmar Nansha Port when Zhendong recognized a man from the company chasing after him.  When armed Chinese police took custody of Zhendong, the company man backed off. After this, Zhendong did many media interviews, some alongside the Electronic Fraud police, which helped to popularize the term "Pig Butchering." 

While there are definitely "Dog Pushers" and "Pig Killers" who are targeting the Chinese ex-patriat community, unless your scammer is speaking Chinese from a call center in Myanmar, you may be a fraud victim, but you are not a victim of "Pig Butchering." 

The main sources for this story were the Chinese versions of Zhendong's misadventure, especially these two: 

荐见 | 反水、救赎、卧底：逃出缅北“杀猪盘”

(Rebellion, redemption, and undercover work: escape from the "pig killing" center in northern Myanmar - an article by “荐见美学” ) 

and

误入杀猪盘团伙后，他偷出了105名受害者名单丨和陌生人说话

("After accidentally entering the pig killing gang, he stole a list of 105 victims" in the TenCent column, "Talking to Strangers" - if you speak Chinese there is a great interview here!) 

 On 10AUG2022 three Nigerians were extradited from the UK to the US to face charges related to their roles in conducting Business Email Compromise (BEC) attacks against a number of US-based businesses.

43-year old Oludayo Kolawole John Adeagbo, 40-year old Donald Ikenna Echeazu, and 42-year old Olabanji Egbinola were brought to North Carolina to face their charges, although some of their crimes were also charged in Texas and their victims are across the United States and the world. 

The three were linked together by exchanging data related to construction companies who were involved in multi-million dollar building projects, and whose emails they were able to acquire through phishing attacks against targets they had purchased from a commercial intelligence service intended to be used by potential sub-contractors. 

BEC's through Look-alike Domains

Victim A notified the FBI that someone was spoofing Victim B, by sending emails from the address "accounts@lucasconstruct.com." (The real company, Lucas Construction, in League City, Texas, uses the domain "lucasconst.com".)  In one email, a victim received an appropriate form that their company used for updating banking information.  The email sender was clearly familiar with their processes, as the email said: 

Please find attached our completed ACH form and a copy of a voided check as requested. Kindly let us know once updated. 

After processing the change of banking information, Victim A sent the next construction payment of $525,282.39 to a SunTrust bank account rather than to Lucas Construction!

Victim C, a community college in the Houston, Texas area, had a similar experience, resulting in sending $1,995,168.64 to a PNC Bank account controlled by criminals after receiving a similar request to update their records from "accounts@tellepsengroup.com."  The real domain (Victim D) should have been tellepsen.com, a four generation family owned construction and concrete company in Houston.  

Victim E, a county government in Texas, sent $888,009.40 to a JPMorgan Chase account after being asked to update the banking records via an email from "accounts@dwcontractorsgroup.com." 

All three of those domains were registered by NameCheap by "Daniel Roberts" who used three different email addresses for the domains.  danielroberts604@mail.com, danielroberts605@mail.com, and danielroberts606@mail.com.  Additional domains, including TellepsenGroup.com, D1construct.com, and SouthWoodBuilding.com were also created by the criminal -- close imitations of the real domains, tellepsen.com, d1construction.com, and southwoodbuilders.com. These domains were used to target additional victims with BEC attempts via bank record "update" requests.

The Texas FBI investigators learned that danielroberts604 was also linked to an investigation being led by FBI Charlotte, North Carolina, where he had used the domain rodgersbuildersinc.com to do a similar scam, as well as another Texas scam using the domain leelewisusa.com to steal funds from a school system in Dallas, Texas. 

North Carolina was able to add another victim to the case - Appalachian State University, from which ADEAGBO and ECHEAZU were able to steal $1,959,925.02 using a similar methodology.  The two recruited a money mule in Los Angeles, California, Ho Shin Lee, who agreed to register a company "Royce Hub Trading" and open a JPMorgan Chase bank account in the same name. Funds stolen by imitating North Carolina based "Rodgers Builders" were stolen after sending emails from "accounts@rodgersbuildersinc.com" to change the banking information.  (The real company uses the domain rodgersbuilders.com.) 

Construction Market Data

The scammers had subscribed to a service operated by Construction Market Data (CMD), which provided contact information related to "hundreds of thousands" of commercial and civil construction projects. 

CMDGroup.com

CMD provided data to the FBI, indicating that the relevant records had been requested by one John Edwards who listed both a US and UK address: 

• 1270 Hasen Hurst Drive, Apt 12, West Hollywood, CA 90046
• 14 College Gardens, London, GB e47ALG

and who used the email JohnEdwards79@yahoo.co.uk.  The associated telephone number +44 797.335.9482 belonged to ADEAGBO.  JohnEdwards79 was actually an alias to the email account OludayoAdeagbo@yahoo.co.uk. 

Adeagbo was found to possess three passports, a Nigerian and British passport in his true name, listing the birthday 06APR1979, and a second UK passport in the name "John Edwards" b. Nigeria on 06APR1979. 

Prior to his involvement in BEC, the BBC reported that ADEAGBO was part of a car-theft ring that used stolen identities to allow them to drive off in Jaguars, Mercedes, BMW's and Porsches. Calling themselves "the iPod Crew" Adeagbo's car theft ring stole 70 luxury automobiles worth $1.8 million over a ten month period in 2001.  Adeagbo told the BBC in 2004 that he served a 2.5 year prison sentence during which he "found God" and that he was "trading crime for Christianity." 

JohnEdwards and DanielRoberts were both found to have used the same IP addresses to access a variety of online accounts which all provided IP history to the FBI, including Apple, Yahoo, LocalBitcoins.com, and Namecheap. OludayoAdeagbo@yahoo.co.uk also had bank statements in true name for his Santander bank accounts. 

The CoinBase account for JohnEdwards79, was actually confirmed to a different person!  Donald Echeazu, who used the email diecheazu@yahoo.co.uk and phone 7837887959.  Although Coinbase had two photos on file for JohnEdwards which were consistent with Adeagbo, the third photo matched the UK Passport of ECHEAZU. 

Homeland Security Investigations (HSI) and Customs and Border Patrol (CBP) learned more when they searched the phone of another co-conspirator as he entered the country.  In that phone, he chatted with ADEAGBO's known UK telephone number, labeled "John Dayo" in his contacts, about bank accounts which he was providing. ADEAGBO instructed him to open up a JPMorgan Chase account in order to receive funds.  They discussed a bank transfer where they had expected to received 12 Million (currency unspecified) but were only able to take 8 million.   

Photos that were shared in the account, showing ADEAGBO in a Porsche, were found to match a car that he was driving when he was ticketed in London (a black Porsche.) 

Another chat in the phone showed a Bank of America account (#32508061285) in the name "Oludayo Kolawole John Adeagdo" using the address 1270 Havenhurst dr Apt 12, West Hollywood, CA 90046. 

The Bank of America account had been used to pay $4,510 in several payments in order to receive business information for individuals in North American construction companies from the aforementioned CMD. 

Olabanji Egbinola

The final party in the group of extradited scammers, Olabanji Oladotun Egbinola, was tripped up in exactly the same way.  Having likely received construction data from the same source (CMD), Olabanji used the email address "accounts@kjellstromleegroup.com" to imitate the real Richmond, Virginia-based company Kjellstrom and Lee.  Using the name "Rachel Moore" Olabanji interacted with the University's Treasury department acting as if a payment was missed and then providing new bank details to fix the problem.  As a result they wired the next construction payment of $469,819.49 to the new bank account at the Bank of Hope. 

The bogus domain was registered at NameCheap by "bridgetclark" who also registered more than 50 other domains with namecheap, each "deceptively similar to the Internet domain names associated with legitimate construction companies." Because "bridgetclark" was using a TOR-based cryptocurrency wallet to obscure his true location, the FBI pursued a Rule 41(b)(6)(A) search warrant.  Rule 41(b) allows a search warrant to be issued from any US jurisdiction if the location of the target has been obscured using technology and to use technology to seize data from such a targeted computer.   In the FBI's case, this is referred to as a NIT, or a Network Investigative Technique. After receiving the court's authority, the FBI sent a NIT-laden email message to accounts@kjellstromleegroup.com, which was used to determine the account was being operate from a computer at the IP address 86.191.189.88, a British Telecom IP in the UK. BT was then able to provide UK law enforcement with the subscriber identification of that IP address and it was found that subscriber Samiat Egbinola in Essex shared the residence with OLABANJI OLADOTUN EGBINOLA. 

Egbinola had been previously arrested in 2008 for money laundering in the UK and had previously traveled to Los Angeles, California, when he used the email address aegbinola@gmail.com for his point of contact going through customs. A review of the email account, which had been active since 2008, showed that he was in regular communications with the scammers listed above on their yahoo.co.uk addresses. 

TL;DR? Good news!  I read them for you! 

 On 15SEP2022, the Department of Justice released their report "The Role of Law Enforcement in Detecting, Investigating, and Prosecuting Criminal Activity Related to Digital Assets" (66 pages).  The first of the nine reports ordered by President Biden's Executive Order 14067 "Ensuring Responsible Development of Digital Assets" was also released by the DOJ back on 06JUN2022, "How To Strengthen International Law Enforcement Cooperation for Detecting, Investigating, and Prosecuting Criminal Activity Related to Digital Assets" (58 pages). 

•  "Action Plan to Address Illicit Financing Risks of Digital Assets" (20 pages),
•  "Crypto-Assets: Implications for Consumers, Investors, and Businesses" (58 pages),
•  "The Future of Money and Payments" (56 pages)

•  "Technical Evaluation for a US Central Bank Digital Currency System" (58 pages)
•  "Climate and Energy Implications of Crypto-Assets in the United States" (46 pages)
•  "Technical Design Choices for a US Central Bank Digital Currency System" (33 pages).  
  

The Role of Law Enforcement in Digital Assets

Requests for Legislation 

1. extend the prohibition against disclosing subpoenas (currently in effect for financial institutions) to VASPs (Virtual Asset Service Providers), strengthen the laws against operating an unlicensed money transmitting business, and extend the statutes of limitations from 5 to 10 years for certain crimes. 
2. support for initiatives that would aid investigators in gathering evidence
3. strengthening sentencing guidelines for certain BSA violations
4. extend BSA record keeping rules to VASPs 
5. ensuring that law enforcement has resources to conduct and staff sophisticated digital asset-related investigations. 

International Considerations 

 As you know from the title of my blog, "CyberCrime & Doing Time," I'm very interested in cybercrime and the criminal justice system. This week I've been looking at SIM Swapping cases and wanted to share what I learned from reading the sentencing memos sentencing transcript for Ricky Handschumacher.

Ricky was one of the members of "The Community" - a group of six OGUsers/HackForums punks who decided to go into the crypto theft business. They haunted crypto community forums gathering data on people who over-shared about their crypto earnings and then did the social media intelligence (SOCMINT) work to id their target, assess their holdings, get their online credentials, and then pay a phone company contractor or employee to SIM Swap their device and steal their crypto.

They stole over $50 Million dollars.

Ricky was the last guy to get sentenced.  The other members of the group (not their phone store patsies, but the core group) were: 

• Conor Freeman, 20, of Dublin, Ireland.  Conor was sentenced to three years in Ireland.
• Colton Jurisic, 20, of Dubuque, Iowa. He was sentenced to 42 months and restitution in the amount of $9,517,129.
• Reyad Gafar Abbas, 19, of Rochester, New York.  He was sentenced to 24 months and restitution in the amount of $310,791.
• Garrett Endicott, 21, of Warrensburg, Missouri.  He was sentenced to 10 months and restitution in the amount of $121,549.
• Ryan Stevenson, 26, of West Haven, Connecticut.  He got two years probation.  Minor player.

Ricky pleads guilty to a single count of "18 USC § 1349 - Conspiracy to Commit Wire Fraud" and in exchange the court agrees to drop several additional charges of: 
18 USC §§ 1343 and 2 - Wire Fraud, Aiding and Abetting 
18 USC §§ 1028A(a)(1) and 2 - Aggravated Identity Theft, Aiding and Abetting

Anyway, Guilty plea is received, family all lines up to say what a good boy Ricky is, blah blah blah, and how he was such a good boy while he was out on bond.

Sentencing Guidelines 

Here's how our sentencing Guidelines work ...

The base crimes each have a number of "sentencing points" that they are assigned.  Then there are a whole host of modifications that can be applied based on other factors.  This score is then further modified by how many prior criminal convictions the individuals have.

Conspiracy to Commit Wire Fraud has a base score of 7.  With no criminal history, that would give a sentence of 0-6 months. But that would be a crime with no victims, no losses, and the most basic conspiracy.  All of the other factors add points. 

The following modifications are then applied.

+2 - the number of victims matter.  In this case, they are charging "ten or more victims." 

Ricky's score is now a 9.  Sentencing guideline: 4-10 months.

+2 - sophisticated means. Because this was a high-tech crime with a lot of technology and a lot of moving parts.

Ricky's score is now an 11.  Sentencing guideline: 8-14 months. 

+2 illicit authentication.  To curb identity theft and the flippant use of stolen credentials, crimes that involve stolen identities get an automatic +2. 

Ricky's score is now a 13.  Sentencing guideline: 12-18 months.

+18 - Theft of between $3.5 million and $9.5 million.  The two greatest "adjustments" in the sentencing world are Number of Victims, and Amount Stolen. This is a huge modification, however, they stole a lot of money!  Many victims lined up to say they lost 100% of their life savings.  One of them even appeared at the Sentencing hearing and said so.  He told the court he had lost everything, and had been waiting FOUR YEARS for justice to be served.  It definitely needs consideration.  

Ricky's score is suddenly a 31.  108-135 months.  That's 9 to 11 years.

-3 - Because Ricky was cooperative and accepted responsibility for his crimes, apologizing to the court and to the victims, his sentencing guideline score is dropped by three points.  That's huge, actually.

Ricky's score is now 28.  78-97 months. 

In their sentencing memo, the prosecution says they would be happy to accept the "mid-point" of that range and asks for an 88 month sentence.

The Judge Speaks

The judge in this case is The Honorable Denise Page Hood in the Eastern District of Michigan.  I appreciate that she puts a great deal of explanation in before rendering her verdict.  She shares with us each of the things she is charged with considering as she builds her decision on what sentence to impose.  All of the following is quoted from the Sentencing Transcript available on PACER, although the emphasis added is mine.  

1. "The factors I'm supposed to consider are these: The nature and circumstances of the offense andthe history and characteristics of the Defendant, and I'm satisfied that, while I don't think that -- well, I think the age of the other individuals involved really didn't have anything to do with you. What it really has to do with is whether or not you were a more mature person and maybe should have had some other indication of this wrongdoing and made a better judgment than someone who perhaps is still young and a bit naive might be. Like I know one of the people, I was convinced that person was much more naive than other individuals involved in this. You, however, aren't one of those.

"I have here also that I think that the nature and circumstances the offense are serious, because there's a lot of money stolen, and it's stolen from individuals who, number one, are unsuspecting, and, number two, some of them are like Mr. S.S., who is here in court today, that this was not, you know, some organization or anything. It was an individual and their personal money, their, as he describes it, his life savings that were involved, and I think that makes it a little bit different than stealing from a company that might have some other means of recovering that than an individual. I'm also satisfied that it seemed like kind of a we're going to go out there and just do these things. We're just going to hack. We don't have any sense of caring very much, until it's over, about people who might be involved in this and where the money might be coming from and where it might go, and so, to some extent, on the part of everybody involved, it seemed like it was kind of a relaxed look at what you were doing and just kind of like a greed thing. I mean it wasn't -- particularly in your case, it wasn't that you were destitute or anything. You had some education, and you had the ability to have a job. So it wasn't that you couldn't go out and make money on your own, and that is kind of the nature of these kind of things, but I think it's a very serious offense in this particular scheme of things.

2. I'm also to look at the history and characteristics of the Defendant, and, for that, I would note that in the scheme of people who come into court,  you're on the young end of that. You may not think you are, but you really are on the young end of those people who commit crimes within our system.

I'm satisfied that you had a decent childhood. I had some notes here that you were and athlete and well-integrated into your experiences as a youth, and, also, that, unlike some other people, you did not seem to be someone who was just, you know, isolating themselves and unliked by others and, therefore, kind of a person who might reach out to do something like this because of a bad situation that they were in. Not that that excuses that behavior, which is exactly what I told them, that it doesn't excuse that behavior.

I'm also satisfied that -- I don't know whether it's better or worse that there are hackers out there that don't know one another, and maybe that adds a little bit to the frivolousness and the unaccountability of it relative to one another. Otherwise, I don't think there's anything in your history or characteristics that is a negative to you. I had one thing I wanted to note here. Okay, I wanted to note that it does not appear that you have any physical problems or that you have any mental health diagnosis or received any mental health treatment. It does not appear that you have any substance abuse problems.

It appears that you graduated from high school and that you were able to have some employment, including an employment from July of 2019, on Paragraph 44, until – at least at the time that this report was written, and that prior to that, that you have worked -- you had been unemployed for a time but that you were also employed by the city of Port Richey, and, prior to that, in a grocery store, and for the short period of time that you've been an adult, that's a significant amount, as far as I'm concerned, of employment.

3. The other thing I want to say is that I'm to consider whether or not the sentence that I'm going to craft will reflect the seriousness of the offense. I've already spoken to that. Promotes respect for the law and provides just punishment, and I'm sure that you're aware now of the  seriousness of the offense. That may be enough to promote respect for the law. I don't know that. You know, I don't know that in these particular kind of instances whether people look at it and say, you know, I've been involved in this. It was easy. I just happened to get caught. I'm never going to get caught again because of the nature of how this is done and how hard it is to investigate and to find out what each person involved in it is doing. So I don't know that my sentence will promote respect for the law, but at least I have taken it into consideration.

4. I'm also to fashion a sentence that provides just punishment, and I know that in all of the cases during the pandemic, where people have been on bond, they have noted I've been, you know, really good, in quotes, on pretrial release, and that shows that I am rehabilitated, and, to some extent, that may be true. To the other extent, the opportunity was that you would not be on pretrial release and you would be in custody where everyone else is attempting to get out of custody because of Covid-19. So I see that people would be, to a very great extent, well-behaved on pretrial release at this time, especially when they don't want to be incarcerated. So I don't give that a lot of weight. I know it's a long time to wait, but I'm sure it is far less onerous conditions than if you were waiting in jail to be able to proceed.

5. I'm also to consider whether or not I will afford adequate deterrence to criminal conduct, and I recognize that this may have been an opportunistic crime, but it's still illegal. You still have to answer for it, and some of it, the deterrence, I think, is not only deterring yourself, meaning that something happens to you that makes you not want to do this ever again even if you think the opportunity to be caught is very small, and it's going to become less small. The Government is going to get better at uncovering this type of crime and uncovering it earlier, but I also think that we deter others by letting them know that we're not going to just let this kind of crime go unaddressed. 

Thoughts on Sentencing 

If your online accounts are like mine, almost every day I'm "force joined" to a new Telegram group where a crypto investment scammer tries to tell everyone how great their scam investment site is. This week, I started getting added to WhatsApp Crypto Investment Scams. 

I thought I'd share the experience with you, in case you were curious. 

When you are Force-joined to a WhatsApp group, the first thing that is displayed is information about who added you to the group.

Then we get our first message from "Tricia Storti" our second theoretically American admin +1 (530), American.  See? (530 is the Area Code for extreme NorthEastern California.) 

Tricia's first post introduces our Crypto Investment Scam website name and begins the process of helping us all lose our money to "FileCoin" (or is it FILcoin? they can't seem to decide.)

Just as you might be wondering, "But how will being in this group make me rich?" none other than the FOUNDER HIMSELF, the one and only BERNIE McTERNAN jumps into the conversation to explain how!

But does it really work?  Well, our straight man "~ FKK" is going to ask the burning questions that are on every potential victim's mind ... and receive honest, trustworthy answers from current investor LOLO!

You might still have doubts ... just like FKK!   "Wow is this true?"  But it isn't just totally real LOLO who has had great success.  Totally real totally unsolicited testimonial person Josh Perreault ALSO has made withdrawals successfully!  

Now we KNOW that it's real, right? Not you! You are too smart for that!  You're probably thinking "But I've never heard of these people!  What company is this?  Are they reputable?"  Funny that you are thinking this, because Totally Real Person Andrew Woolley is having those same doubts ... 

Totally Real Person JIJIT assures us that this is an American Company, and then FKK, our favorite Straight Man, asks for a website.  Conveniently, Tricia is there to demonstrate her excellent customer service by replying within two minutes!

The Amazing Tricia-the-Scammer is right there with the answer! 

But why would they do that?  For a commission ... nothing suspicious here ... these Totally Real People explain it to each other:

And eventually, after much more banter, the TRADING starts!  Tricia gives our first instruction, and our Totally Real Veteran Trader Josh jumps right in!  (Perhaps not realizing we've already killed the website.) 

But that doesn't stop us having more imaginary conversations to demonstrate how trustworthy things are.  Tricia had some exciting news today ... VIP Traders don't have to pay the 20% commission!  They keep ALL OF THE MONEY!  (But there is a $10,000 minimum investment, of course) 

How big is the group?  In addition to the 237 current members, there are also (if you choose Group Info and scroll ALL THE WAY DOWN), over 550 "Past Participants" (with all of their telephone numbers exposed as well.)

Those are the people who were Force-Joined to the group and then LEFT the group.  Hopefully they remember to hit "REPORT AND EXIT" so that WhatsApp's team knows these guys are scammers!

For our "Actors" in the play above, none of their telephone numbers correspond to a real phone carrier, except Bernie, who uses T-Mobile. 

Bernie = 346.971.2587 = T-Mobile 
Tricia = 530.435.9207 = Peerless-NSR-ATLC
Josh = 903.636.6515 = Sinch Voice-NSR-10X
Shannon = 438.577-5300 = IXICA Communications 
JIJIT = 873.920.8211 = IXICA Communications
LOLO = 403.694.7067 = ISP Telecom 
Zachary Brook = 343578.0586 = ISP Telecom 
FKK = 985.775.6255 = Sinch Voice NSR 
Andrew = 716.502.2145 = Sinch Voice NSR 
Kevin = 937.966.2921 = Sinch Voice NSR 

Sure would be sad if all of those telephone numbers and WhatsApp numbers were terminated ... 

Some of you may have heard that students in UAB's Investigating Online Crimes class have been researching Crypto Investment Scam websites.  You can find a list of some of the sites we've identified so far on URLScan.io using our tag "CryptoScam" (as of this writing we have 3600+ sites on the list -- hosting companies and registrars, please take action!) 

Mirror Trading International and a $3.4 Billion Fine

You may have never heard of the U.S. Government agency, the Commodity Futures Trading Commission, but that doesn't mean they don't have power.  Last week the CFTC announced an order of default judgment against Cornelius Johannes Steynberg of Stellenbosch, Western Cape, South Africa. The order states that Steynberg must pay $1,733,838,372 USD in restitution and an additional $1,733,838,372 as a civil monetary penalty for defrauding 23,000 Americans of 29,421 Bitcoin.  (That's $3.4 Billion USD, or R63.6 Billion South African Rand.)

I'm proud to say that this action was brought in part by the Alabama Securities Commission, who joined Texas, North Carolina, and Mississippi in taking action.  I've met their director (who just retired this week! Thank you Joe Borg for 30 years of service!) and some of their investigators and they fight hard to protect the citizens of Alabama from fraud. 

Mirror Trading International claimed that their members could earn 10% per month in interest on their investments.  A typical ad of theirs boasted of this advantage over traditional bank accounts and other investment vehicles: 

Ponzi Scam or Affiliate Program: Tomato / Tomato

This affiliate regularly posted updates supposedly showing how much money they were earning, as well as testimonials where the people they had recruited supposedly thanked them for their newfound financial freedom:

Like many other Crypto Investment Scams, the affiliates were encouraged to share videos claiming that Artificial Intelligence-based training was part of the secret of their success: 

South Africa's Court Order Outlines a Problem: Greed

While the terms of the South African court order against MTI may seem like victim-shaming, Greed is truly one of the factors involved in many of these Crypto Investment Scams.

"People all over the world, and South Africans are no exception, are bewitched and fascinated by any idea or scheme promising, in most cases, instant wealth, new homes, new cars, holidays abroad and all material possessions that can be acquired with an abundance of money. A further attraction of these schemes is the perception that the money will keep rolling in with little or no effort by the participants, the hardest part being to count one's money." 

The conclusion of that case summarized their findings as follows: 

[137] MTI's business clearly amounted to an unlawful ponzi-scheme, i.e. a fraudulent investing scam promising high rates of return to investors and generating returns for earlier investors with investments taken from later investors. 

[138] It would appear that there is no pool of member bitcoin, Trade 300 does not exist, the artificial intelligence bot never existed or traded and the remarkable trading results presented to investors were prima facie false. 

(ordered by A De Wet, Acting Judge of the High Court) 

What?  The AI Magic Bitcoin Genie isn't real?  I'm shocked!

Scammers or Victims:  Why Not Both? 

Unfortunately, many of the people who became involved in the scam are innocent victims while others made fake Facebook accounts in order to scam others into signing up.  As long as they signed up others, they had a good chance of making money, until the whole scheme collapsed.  It took about five minutes to find fifty affiliates with a simple Facebook search:

So will everyone get their money back?  Highly unlikely. 

Steynberg Arrested in Brazil

Mr. Steynberg was arrested in 2022 by the Brazilian Military Police of the state of Goias: 

https://www.pm.go.gov.br/giro-prende-foragido-internacional-responsavel-por-fraude-milionaria/

Assurances from MTI CEO Steynberg: I am not a Ponzi Scheme!

When Mirror Trading was first accused of being a Ponzi Scheme by the Texas Securities Commission, their CEO replied to queries using a form letter like this one, shared by Global Crypto in a story called "MTI Announces It Is Working With the FSCA": 

Dear Kratika,

I unfortunately only received your email this morning, Tuesday 14 July 2020.

As I have declared to the Texas Commissioner in writing, I wish to state and declare from the outset that Mirror Trading International (Pty) Ltd (hereinafter referred to as “MTI”), a privately held company registered in the Republic of South Africa, is not a Ponzi scheme (new money feeding old) or a scam, with which a holder of funds suddenly disappears.

It is also most unfortunate that because MTI is operating in the online passive income building industry, which has a notorious and demonstrated reputation for scams and Ponzi schemes, and, due to the nature and Modus-Operandi of the robust MTI referral-based business model, that MTI is automatically by default behaviour of the media and some regulators, and maybe the behaviours of some members, is being perceived by associative conclusion that MTI is but another of these.

This unfortunate and misinformed perception is far from the reality of what MTI is as a newly formed (15 month old) highly innovative referral-business and brand that the founders would like to see growing over many years into a global, iconic and heritage brand in the market trading sector.

For instance, the Texas Commissions states that …The actual value of the commissions depends on their success in recruiting new investors and multilevel marketers. … While this may apply to Ponzi schemes, this is not correct for MTI.

Daily trading returns using top regulated trading brokers determine the quantum of rewards, which can vary and if there is a negative trading day, there are no rewards. The point is that with MTI, that the funding of MTI referral payments is derived from daily trading profits and not from the funds of new members.

Another important point which differentiates MTI from Ponzi’s and scams is that members have full control over their funds (Bitcoin) at all times. Members are able to add or withdraw their funds (Bitcoin) at any time, with no complications and no fees. If you do research, you will find not a single member of the 75,000+ MTI members worldwide has ever complained or not been able to withdraw their BTC whenever they have opted to.  

It is the aim of MTI and its innovative, unique referral-based business model and MTI’s operating Modus Operandi of trading on world markets to generate real growth and returns on a daily basis, to work with and co-operate with regulators in every regard, in the process of taking MTI along a path that will see MTI fully and properly regulated.
There are three reasons for this.

1. My Founding Vision for MTI: Build a preferred iconic and heritage global brand in the financial services sector that delivers sustainable growth and value creation for all stakeholders, including for the little man in the street:
2. Professional and Compliant:  Ensure that MTI is a professionally managed business and brand that is regulatory compliant and which delivers sustainable growth and value creation for all stakeholders. My team and I are committed to this.
3. Change the reputation of the on-line passive income generating industry: We and myself personally, are extremely tired of this industry having a negative and darkly clouded reputation. And yes, some 99.9% of online passive income building services are scams and  / or Ponzi’s. I am personally very driven to be part of changing this perception once and for all, by showing and demonstrating to regulators, to the media and to consumers that such a business model can on a Bona Fida basis, exist, successfully operate and grow on an organic and sustainable basis, which is what MTI is doing.

To this end, MTI will in the coming period be placing great emphasis on engaging with and working with any regulator with a clear purpose at all times;  be fully compliant as a professionally managed company and brand that delivers sustainable growth and value creation to its stakeholders, and which intends to be around for many years to come.

MTI is already in discussion with the South Africa Financial Services Conduct Authority (FSCA) and will be meeting with the FSCA in a week’s time. MTI is also fully committed to co-operating with the Texas State Securities board and is in correspondence with them on this matter.

We trust that the above gives you some insight into MTI.

Should you wish to correspond further, please use my private email address: [REDACTED]
Your sincerely,

Johann Steynberg
Chief Executive Officer
Mirror Trading International (Pty) Ltd
South Africa

One of my techniques for keeping current on Cybercrime trends is having an "interesting" collection of international news ticklers. This story came to me via X:CyberScamMonitor via a QQ account called "onCambodia." @CyberScamMonitor is a Twitter/X account and Substack account dedicated to tracking online scam and gambling operations in Southeast Asia and documenting human trafficking and human rights abuses. Great work and a strong recommendation to follow if you wish to learn more about the links between #CryptoScams and #PigButchering.

I apologize to the original journalist as I have been unable so far to find the original to give them full credit. For reference, the Chinese article I refer to provides the source as 来源：鲁中晨报 (Source: Luzhong Morning News). The headline is: "Chinese woman was arrested after returning to China! Uncovering the financial backers of a fraud syndicate in Sihanoukville." If anyone has a link to the Luzhong Morning News version, please comment and I will update! This post is mostly just a retelling of their story in English!

The story told, in my opinion, should have the headline "Diligent Police Task Force won't stop tracking Fraudsters!" This story features the Yiyuan County Police who started with a telecom fraud case in their jurisdiction and followed it until they had wrapped up the entire organization and seized 200 million yuan from the criminals, 1/4th of it in cash, but also in real estate, luxury cars, watches, and liquour. That's over $28 Million USD! The case started with a local business who found that one of their employees had sent out 38 million yuan in just a few days. The employee was being extorted after installing a porn-dating app on his phone -- when the criminals learned where he worked they demanded that he send money from his company as well. 

 The case was taken up by the "3.01" Task Force. Yiyuan County is administered as part of Zibo City in Shandong Province of China. Police officers from county, city, and provincial level work together on the 3.01 Task Force.  (Shandong is in the east of China, across the Yellow Sea from South Korea.) The deputy magistrate of Yiyuan, Zhang Xiuguang (张秀光), takes an approach to cybercrime that reminds me of the work of the Garda National Economic Crimes Bureau in Ireland!  Zhang says "Since we established the task force, we have firmly believed that we must recover the losses and hit the core.  From catching the first culprit, we will not withdraw our troops until the case is solved!"

(map of Zibo City from medical article by Lili Liu and Ling Wang)

The case dragged on at a very slow pace, Yiyuan deputy director of public safety Ma Wencheng (马文成) described it as involving the tracing of funds from thousands of accounts and peeling back each account like peeling layers from bamboo shoots. Even with a 100 person task force, very little progress was being made, but that changed with a key arrest on 31AUG2022. The key piece of evidence as a suspicious mobile phone number. Among all of the hundreds of thousands of scraps of evidence, there was a telephone number belonging to a woman in Cambodia. Recognizing that Cambodia is the home of many telecom fraud rings, the head analyst for the task force, Lu Lu, focused on the owner of that number. The decision was made to wait for her to return to China. The police have assigned this key figure the alias Xie Xiaofang. When they learned that Xie was returning to China, the task force rushed to Zhengzhou in Henan Province and arrested her as she was leaving quarantine.

As she was questioned, Xie Xiaofang revealed that her #PigButchering group was based in the Chinatown setion of Sihanoukville, Cambodia. Her job within the organization was laundering the money, but she claimed despite her key role, she only knew middle managers in the gang, and then only by alias. The 3.01 Task Force team began tracking each person traveling to China from Sihanoukville and asking Xie Xiaofang to identify them. Within a few weeks, they had mapped out the leadership of the organization. On 17SEP2022, the team traveled to Jiangxi, Yunnan, Fujian, and other places, arresting two more key members and seven others, followed in quick succession by dozens more, eventually totaling 135 arrests. At this point, the Shandong Provincial Public Security Department thought it was time to reward their team.  The photo below shows the public ceremony where all of the local dignitaries publicly praised the work of the 3.01 Task Force, who had at this point seized 8.5 million yuan (about $1.1 million) and had key leaders of the gang in custody. 

(source: https://zibo.sdchina.com/show/4733923.html )

Earlier this month, Microsoft's Digital Crimes Unit was featured in a WIRED article by Lily Hay Newman - Microsoft’s Digital Crime Unit Goes Deep on How It Disrupts Cybercrime. In part, the article discusses MS-DCU's case against the hackers that they call Storm-1152. According to DCU, Storm-1152 used their CAPTCHA-cracking capabilities to assist other criminals in the massive creation of Microsoft email accounts, such as Hotmail and Outlook accounts. How many? How about 750 MILLION email accounts created for illicit purposes! In their announcement about Storm-1152, DCU's Amy Hogan-Burney calls out several of the websites run by the group, including Hotmailbox[.]me, 1stCAPTCHA[.]com, AnyCAPTCHA[.]com, and NoneCAPTCHA[.]com.   (I'm not familiar with NoneCAPTCHA, but it looks like it was just a redirect domain to 1stCAPTCHA.)  Amy shares that the group is based in Vietnam and names three of their operators: Duong Dinh Tu, Linh Van Nguyễn (also known as Nguyễn Van Linh), and Tai Van Nguyen.

1stCaptcha[.]com

AnyCaptcha[.]com

Some example code is still on github that illustrates how these massive CAPTCHA solvers were used.  For example "CuongPhan1408" has a 1stCaptcha written in GoLang and shows examples in his code of solving Discord account creations using "HCaptchaTaskProxyless" and using "FunCaptchaTaskProxyless" to defeat Microsoft's Live signups.  FunCaptcha is the tool created by Arkose Labs which is currently used by Microsoft to confirm that emails are only created by humans. 

Github user HecTran12 shares code that links to the now-seized-by-Microsoft website 1stcaptcha[.]com which could previously be installed with "pip install 1stcaptcha." HecTran12's FunCaptcha example solves Outlook[.]com captchas to make new Outlook accounts. 

Github user "Xtekky" shares his AnyCaptcha[.]com-based code called "Outlook Gen" which is Python code that links to the Microsoft-seized website "AnyCaptcha[.]com" to create Outlook accounts in volume.  The code has 45 stars and 15 forks on Github.

"With your help, they now have a choice between working in toxic factory conditions or on a computer." 

The U.S. Attorney's office in Delaware charged Olugbenga Lawal with being a major money launderer for a Nigerian-based international criminal organization that specialized in Business Email Compromise (#BEC) and Romance Scam.  Lawal was charged with receiving more than $3 million USD (that would be more than ₦2,8 Billion!) and sending funds to Nigeria both through money transfer, but also buy purchasing and shipping more than $600,000 in vehicles.

Olugbenga Lawal was born November 30, 1990 in Lagos, Nigeria. After attending boarding school starting at age 13, he got a bachelor's degree in Business Management from Ahmadu Bello University in Zaria, Nigeria. He taught for one year in the National Youth Core in 2013. In 2015, he stayed with an uncle in New York for three months, then moved to Chicago where he married Myjerrier Lawal and the two moved to Indiana, where he lived when he was arrested.

Early in the case, Lawal's lawyer tried to get the judge to allow him to be free pending bail. At that point there was a court hearing to determine if he had to stay in jail until the trial, or if he could be released and monitored. This type of hearing is called a Detention Hearing. During that hearing, some interesting facts came out!

From the Detention Hearing Transcript:

The Defendant’s importance in the criminal organization is demonstrated by the fact that he received money directly from defrauded victims as well as from lower-ranking members of the criminal organization. It is believe that, as a higher-ranking member of the organization, Defendant received a “cut” of the fraudulently obtained proceeds and, after taking that “cut,” helped to launder the proceeds and repatriate the funds to West Africa largely by purchasing cars with the fraudulent proceeds and shipping them overseas to other members of the criminal organization.

The criminal organization apparently has obtained and used fraudulent identification and travel documents to aid in its internet-based fraud and money laundering efforts. The Government proffers that the organization has obtained false state driver’s licenses and false passports, both to create the online personas used to perpetrate its romance scams and to register shell business entities and open bank accounts under untraceable aliases.

In short, the nature of the criminal organization and its crimes has provided Defendant with resources to flee from prosecution. Defendant, either personally or through his co-conspirators, has access to millions of dollars, fraudulent travel documents, and co-conspirators located across the country and the world. Moreover, the Defendant, who is not an American citizen, appears to be facing a substantial guidelines term of incarceration and likely deportation. The combination of the lengthy sentence facing the Defendant and his likely deportation provides the Defendant with a strong incentive to flee prosecution.

Defendant has made at least four overseas trips over the past two years. Those trips appear to include two extended trips to Nigeria, as well as two short trips to Cancun, Mexico. As noted already, Defendant has access to an un-identified amount of money that he could use to flee from prosecution, including up to $2 million dollars in cash withdrawals remain largely unaccounted for as well as potential money from co-conspirators looking to help him.

The government's primary witness in the case was a man named Mr. Hermann. Normally we do not ever get to see the evidence that the government has against a criminal, because they often enter a "Guilty" plea which causes there to be no trial where such information would become public record. Because Mr. Lawal refused to plea, he went to a Jury Trial where things did not go well for him. Since it is all in the record, let's start by hearing the Prosecutor for the Government's opening statements:

Mr. Hermann took orders from one of the leaders of the criminal organization in Nigeria, a man by the name of Ehonre Oluwaseun, who is more commonly referred to as Classic Baggie. You will hear evidence that Classic Baggie recruited Michael Hermann to open bank accounts through which to launder fraud money. Hermann in turn recruited Assane and Baines to open even more accounts. Hermann passed information to Classic Baggie and Classic Baggie insured that the scammers had -- who had contact with the victims had the correct bank account information. The scammers then instructed their victims to send money to these bank accounts, and Classic Baggie instructed Michael Hermann on what to do with the fraud money deposited into accounts controlled by Hermann, Assane, and Baines.

You will hear from both Mr. Hermann and Ms. Assane during this trial that most frequently the instructions that came to them were to send the money to the defendant, Mr. Lawal. And you won't have to take them at their word, because you're going to see text messages between Mr. Hermann and Ms. Assane that show funds being directed to the defendant again and again and again. Some portions of these messages are in English while others are translated from a dialect of French. But you will see chat after chat containing instructions to send the money to Lawal.

You will see bank records showing well over three-and-a-half million dollars moving through personal and business bank accounts controlled by the defendant, Mr. Lawal, in years where he reported minimal income to the IRS.

The evidence will show that Mr. Lawal and his co-conspirators used some of the scam money to buy cars at car auctions that were shipped overseas to Nigeria, where Classic Baggie lived. You will also hear from a witness named Opeyemi Opaleye, who received fraud proceeds from Mr. Lawal and used the cash to purchase vehicles for his own car export business. Mr. Opaleye will testify that Mr. Lawal directed dollar deposits into Mr. Opaleye's personal and business accounts in return for the deposit of the equivalent amount of Nigerian currency into Mr. Lawal's Nigerian bank account. You will see chats between Mr. Opaleye, and the defendant, Mr. Lawal, in which the two discuss the exchange of Nigerian currency or Naira for U.S. dollars. And in one of these chats, the defendant, Mr. Lawal, sent Mr. Opaleye a photo of a bank receipt in someone's lap. Well, you will hear testimony from the person who took that photo of the receipt in his own lap. He is a romance fraud victim. He will testify that he took the photo to show that he made the payment. And you will learn that soon thereafter, the defendant, Mr. Lawal, sent the same photo to Mr. Opaleye.

We do not ask that you accept the testimony of these witnesses without any scrutiny, indeed we invite you to closely examine each witness's testimony, listen closely to their testimony, consider each witness's incentives and see how each witness's testimony is corroborated by the testimony of other witnesses and documentary evidence. You will not only hear the testimony of these people, but in some instances, you will see their text communications. You will learn that many of these communications, Mr. Hermann is passing on instructions directly from his boss, Classic Baggie, the leader of the organization to send scam proceeds to the defendant, Mr. Lawal.

Classic Baggie? What sort of name is that? Well - back in 2007, Classic Baggie was very publicly known to be friends with two other famous Nigerian money launderers, named Hushpuppi and Mompha. (My readers will know how closely I followed the cases of Hushpuppi! and Mompha

• Hushpuppi and Mr.Woodbery, BEC Scammers: Welcome to Chicago!
• Hushpuppi Pleads Guilty: Sentence Estimate? 11-14 Years
• Mompha is a top 10 Business Email Compromise scammer

For a recapping of their falling-out, I'll refer you to the blog of Linda Ekeji.

The reputation of Classic Baggie, likely from paid fluff pieces, is much more favorable in Nigeria than how the Delaware court portrays him!

Keep Reading! Classic Baggie: Part 2 - How to run a Money Laundering Operation!

In Part 1 of this story Classic Baggie: A Delaware BEC Case calls him the leader of an International Criminal Organization the prosecutor in the case of Olugbenga Lawal has given his opening arguments, where he calls Classic Baggie the leader of an international criminal enterprise.

On the first day of the trial, before selecting the jury, an FBI Agent specializing in Transnational Organized Crime is brought in before the judge. This agent was supposed to testify about how West African Organized Crime works. The prosecutor and the judge discussed it before the Agent was summoned, and the judge said she would not allow the Agent to refer to it as "West African Organized Crime" in his testimony, even though the prosecutor assured her that there were unique things about how West African Organized Crime functions, because the judge believed it would tend to create a prejudice against the defendant in the minds of the jury, since the defendant is West African himself. After the jury was brought in and selected and the case began, a different FBI Special Agent, who works on a White Collar Crime Squad is brought in to testify. Here's a small portion of that testimony, which takes the nature of a Question and Answer session, with the questions being asked by the prosecutor, Mr. Wenger:

BY MR. WENGER:
Q. Did the FBI's investigation determine whether that south Florida based group was operating independently or at someone else's direction?
A. Yes, we did.

Q. What did the investigation uncover?
A. We learned that the group was operating at the direction of an individual in Nigeria.

Q. And are you aware of who that individual in Nigeria is?
A. Yes. His name is Ehonre Oluwaseun, which I can spell if you need but he's better known publicly and to law enforcement as Classic Baggie.

Q. Can you briefly describe how the investigation uncovered this group who was operating at the direction of who I am go to refer to as Classic Baggie?
A. During our investigation we seized a number of cell phones from Michael Hermann and executed a warrant from the cell phones and we were able to review text messages between Michael Hermann and Classic Baggie.

Q. Over the course of executing that warrant, did that also further the investigation?
A. Yes, it did.

Q. How did that further the investigation in terms of identifying who this group was operating at the direction of?
A. We -- I identified other members of the network who were also working for Classic Baggie.

Q. Now, over the course of the investigation, did the FBI identified bank accounts controlled by Michael Hermann, Rita Assane and Dwight Baines?
A. Yes.

Now its time to hear from the Government's witness, Michael Hermann, who is also charged in this case. His testimony was on Day Two of the trial and I've cut some portions of it. We'll start with some of his personal background and who the key players in the case are, all from the courtroom transcript of Day Two. I'm including all this extra detail especially for the benefit of my overseas readers, who may be less familiar with how U.S. court process works, I know it is long, but I think you'll be glad to have read the details!

DAY TWO - Direct Examination by Mr. Wenger

MICHAEL HERMANN, having been duly sworn, was examined and testified as follows:
DIRECT EXAMINATION
BY MR. WENGER:

Q. Good morning, Mr. Hermann.
A. Good morning.

Q. How old are you?
A. I am thirty-five.

Q. Where did you grow up?
A. I grow up in the Ivory Coast, West Africa.

Q. When did you move to the United States?
A. In 2005.

Q. How old were you then?
A. I was eighteen.

Q. When you first moved to the United States, where did you live?
A. I lived in Oklahoma City, Oklahoma.

Q. How long did you live in Oklahoma?
A. About ten years.

Q. Did you go to college?
A. Yes.

Q. Did you graduate from college?
A. Yes.

Q. Where did you go to college?
A. At the University of Central Illinois.

Q. What did you study?
A. Finance.

Q. Are you married?
A. Yes.

Q. How long have you been married?
A. About twelve years.

Q. Where were you living in the 2019, and 2020 time frame?
A. I was living in Miami.

Q. And how long had you been living in Miami at that point?
A. Probably about like two years, year-and-a-half, two years.

Q. Were you living with your wife at that time?
A. No.

Q. Where was your wife living?
A. She was in Texas.

Q. Were you separated from your wife at that time?
A. Yes.

Q. Turning your attention to 2019, what were you doing for a living at that time?
A. In 2019, I was throughout the part of the year, I was doing different things, I was in marketing, I had a marketing company and I was also an apprentice for a watch business.

Q. What was the name of your marketing company?
A. Top Slope Ventures LLC.

Q. Where you making a lot of money doing those things in the first part of 2019?
A. Not really.

Q. At some point in 2019, did you get involved in the money laundering conspiracy?
A. Yes.

Q. Are you here to testify about your involvement in that money laundering conspiracy?
A. Yes.

Q. Were you a member of that conspiracy?
A. Yes.

Q. Who got you involved in that money laundering conspiracy?
A. Classic Baggie.

Q. Is that a nickname?
A. Yes, it's a nickname.

Q. Do you know Classic Baggie's real name?
A. Ehonre Oluwaseun.

Q. Approximately when did you work -- I'm going to refer to that individual as Classic Baggie, that's how you knew him best?
A. Yes.

Q. Approximately when did you begin working with Classic Baggie to launder money?
A. Around November of 2019.

Q. And where were you living in November of 2019?
A. Miami, Florida.

Q. How long were you actively involved in this money laundering conspiracy?
A. About a year.

Q. Did you work with anybody else in the Miami area as part of this money laundering conspiracy?
A. Yes.

Q. Who did you primarily work with?
A. I worked with Rita Assane, and Dwight Baines.

Q. How did they get involved in this money laundering conspiracy?
A. They were around the vicinity, so I got involved.

Q.Before you got involved with Classic Baggie, had you ever been involved in money laundering before?
A. No.

Q. How did you know what to do?
A. Classic Baggie taught me everything I needed to know.

Q. Mr. Hermann, when you talk about he taught you everything you needed to know, who were you referring to as he?
A. Classic Baggie.

Q. How did you communicate with Classic Baggie?
A. Primarily WhatsApp messages, phone call and video calls.

Q. And as you really got started with the money laundering, how frequently were you communicating with Classic Baggie?
A. Every day, every other day.

Q. Can you please turn to what is the smaller binder in front of you with your name on the front. And flip to the document marked Government Exhibit 132(c). What is that document?
A. This is a picture of Classic Baggie.

Q. Do you recognize that individual as Classic Baggie?
A. Yes.
MR. WENGER: The government moves to admit and briefly publish Government Exhibit 132(c).
MR. SPARACO: No objection.
THE COURT: Thank you. Its admitted.

Q. That individual up there on the screen is who you would have video calls with?
A. Yes.

Q. And who you would be in communication with?
A. Yes.

Q. And who taught you how to do money laundering?
A. Yes.

Q.Where did you understand Classic Baggie to live?
A. Nigeria.

Q. Is that based on your conversation with him?
A. Yes.

Q. And your video calls with him?
A. Yes.

Q. What did you understand Classic Baggie to do in Nigeria?
A. He told me that he had a few businesses, including the construction company. And a money business where he exchanged money from across the countries and stuff, also in the car import and export car business.

Q. Through the course of your communications with Classic Baggie, does the name Olugbenga Lawal come up?
A. Yes.

Q. How did that first come up?
A. It came up when he first asked me to do small favors to him at the beginning, he had me send money to Olugbenga.

Q. And did that name Olugbenga Lawal repeatedly come up over the course of your money laundering relationship with Classic Baggie?
A. Yes, a lot.

Q. When that name would have come up, how would it come up?
A. It would come up, he would tell me to send $50,000 to Lawal with an address or something like that, send CashApp to Lawal and send me the details and things like that, yeah.

Q. Have you ever met Olugbenga Lawal?
A. No.

Q. Have you ever spoken to him?
A. No.

Q. Would you know what Olugbenga Lawal looks like?
A. No.

Q. Did you also communicate with Rita Assane and Dwight Baines about your money laundering activities?
A. Yes.

Q. And how would you communicate with them about the money laundering activities you were doing together?
A. Via text message and phone calls.

Q. Would you use any apps?
A. WhatsApp messages, yes.

Q. Is that also how you were communicating with Classic Baggie?
A. Yes.

Q. Ms. Busch, can we pull up what's been previously admitted as Government Exhibit 205? Zoom in on that chart. Mr. Hermann, is that a chart that we've gone over before?
A. Yes.

Q. And you've looked at all those government exhibits that are referenced in the right-hand column?
A. Yes.

Q. And do you understand that these are all messages that on-these exhibits were all messages obtained from phones of yours?
A. Yes.

Q. And are those names in the left-hand column contacts that were saved in either your phone or your WhatsApp app?
A. Yes.

Q. I want to first start with the top line of these rows. Who is Mike RM Plug?
A. That's me.

Q. Is that a user name, or a name you had used on your phone or your WhatsApp?
A. Yeah.

Q. How about Mike Miami?
A. That's me, also.

Q. And Michael Hermann?
A. That's me.

Q. Now I want to look at the bottom names on each of those rows. Who do you have saved in your phone as Manu New S?
A. Rita Assane.

Q. Who do you have save in your phone as Manu Newcell?
A. Also Rita Assane.

Q. Who do you have saved in your phone as Baggie?
A. Classic Baggie.

Q. Who do you have saved in your phone as D Heavy?
A. Dwight Baines.

Q. Who do you have saved in your phone as Heavy 2x?
A. Dwight Baines, also.

Q. And all those messages referenced in those government exhibits we have gone over before, were all those conversations centered on your money laundering activities with those various individuals?
A. Yes.

Q. We're going to get into more details about your involvement in money laundering in a moment. First, I want to skip ahead to the winter and spring of 2022. Were you charged in Federal Court for your involvement in this money laundering conspiracy?
A. Yes.

Q. Were you arrested on those charges?
A. Yes.

Q. About when were you arrested?
A. About March of 2022.

Q. And do you remember where you were arrested?
A. I turned myself in here.

Q. Here in this court house?
A. Well, in Delaware, but I think it was in a different court house, if it was here, I don't remember.

Q. You remember turning yourself in to a Federal Court house somewhere in Delaware?
A. Right. Yes.

Q. Did you get to go home after you turned yourself in?
A. No, bail was set, and I was put on house arrest.

Q. When you said you were not able to go home, does that mean you were not able to go home to Miami?
A. That's correct, yes.

Q. Were you kept in custody or any significant amount of time after you turned our yourself in?
A. Yeah, one day and then I was sent to Texas.

Q. Who was living in Texas?
A. My wife and my kids.

Q. Did you have any restrictions placed on you at that time?
A. Yes, I was on house arrest.

Q. Have you been living in Texas under similar restrictions ever since that time?
A. Yes.

Q. Did you ultimately decide to cooperate with the government's investigation in this case?
A. Yes.

Q. Did you later agree to plead guilty to your federal charge?
A. Yes.

Q. Can you turn to paragraph 15 of this agreement. Just briefly read it and look up when you've read that paragraph.
A. (Witness reviewing document. ) Yes.

Q. What do you understand that paragraph to mean?
A. It means that I would be responsible along with the co-conspirators to repay restitution for the sum of 3,761,066 back to the victims.

Q. So restitution was $3,761,066?
A. Yes.

Q. What's your understanding of what restitution is?
A. It is paying it back.

Q. Paying it back to who?
A. To the victims.

Q. That's the amount you've agreed to work to pay back?
A. Right.

Mr. Hermann starts recruiting more money launderers for Classic Baggie

Q. I want to turn back to the money laundering operation, and I want to begin by asking you about your relationship to some of the individuals that we already talked about. How long have you known Rita Asane?
A. Over a decade.

Q. How did you meet her?
A. I met her through a friend of her sister at the time.

Q. And what was the nature of your relationship with Ms. Asane in 2019?
A. We were romantically involved at that time.

Q. How long have you been romantically involved?
A. Probably about a year-and-a-half at that point.

Q. Why did you turn to Ms. Asane to join the money laundering operation?
A. She was close, and pretty much saw everything, just being that close, when I was talking to Classic Baggie and every time like that, so she wanted to join, she saw the opportunity also and I was like yeah, it works out, like I talked to him, he was okay with it, and she joined.

Q. Did she hesitate at all?
A. No, she was excited.

Q. Was she financially struggling at the time?
A. Yeah, we all were.

Q. Did you say you were all financially struggling at the time?
A. Yes.

Q. Turning to Dwight Baines, how did you meet Dwight Baines?
A. I met him at the beginning of 2019.

Q. How did you meet Dwight Baines?
A. I was selling some clothing online, on an app called Offer Up, and he contacted me through Offer Up and we started talking, I told him about the jeans, clothing, we started being friends and we were cool from there.

Q. Why did you turn to Mr. Baines to join the money laundering conspiracy?
A. He was already in that world, you know, so it was easy for me to have a conversation with him as well.

Q. When you say he was already in that world, can you briefly explain what you mean by that world?
A. He was already doing like small scams, like getting apartments and small things like that.

Q. Do you know if Mr. Baines had any association with the name Kyle Miller?
A. Yeah, that was his alias.

A Strange Way to Buy A Watch: How Mr. Hermann met Classic Baggie

Q. I want to focus on your relationship with Classic Baggie. About when did you first have contact with Classic Baggie?
A. I first had contact with him when I sold a watch to one of the biggest artist in Nigeria, his name is Davido, so when I sold him the watch, he got it and had a concert in Dubai, he was so excited about it, he posted on his story, I think at the time he had 20 million followers, and when he posted it, he posted I was one of the best watch dealers, and on his story he tied me in there and blew up my Instagram page, he has a big Nigerian following, and a bunch of those people followed me and out of those when Classic Baggie started following me.

Q. Was this had in the summer of 2019?
A. That happened around August of 2019.

Q. So around August of 2019, that summer, to early fall, did you continue to talk to Classic Baggie?
A. Yes.

Q. And at that time, what was the focus of the relationship between you and Classic Baggie?
A. At that time it was me being apprentice watch dealer talking to a client, he wanted to buy a watch, so we was basically talking about the whole watch thing, just send me a picture of this watch, how much is this, responding back, things like that, so it was just business.

Q. Are we talking about $10 watches, $10,000 watches, $100,000 watches?
A. No, we talking about $275,000 watches, 300,000, type of watches.

Q. You said you were working as an apprentice at that time. Can you just briefly describe the business relationship with the people that you were apprenticing for?
A. Sure. So I have been working under them for -- they're watch dealers, right, so I wanted to learn the business, so I was working with them going to the store and things like that, like learning the business for over a year just working for free and just trying to learn, going to watch events, conferences to get familiar with the business and try to get sales. So my job was to take pictures of watches, post them on social media, promote it, go out and try to network and try to get clients for them so I could make a sale and make a commission from the sale.

Q. Did you wind up selling any watches to Classic Baggie?
A. Yes.

Q. What watch did you sell?
A. I sold him a Richard Mille RN11-03 McLaren.

Q. How much money did you sell him that watch for?
A. $275,000.

Q. When did that happen?
A. That happened in November 2019.

Q. So when you were apprenticing, how much money did you make when you sold a $275,000 watch?
A. I didn't make that much on this watch in particular. They just give me like $2,000.

Q. And when you were talking to Classic Baggie about this watch purchase, how were you communicating with him?
A. At first he contacted me through Instagram, and then we moved to WhatsApp, send me his number through WhatsApp, it was easier to communicate.

Q. Did Classic Baggie write you a personal check for $275,000 to buy that watch?
A. No.

Q. Did he wire you $275,000 from a personal Nigerian bank account to buy that watch?
A. No.

Q. How did Classic Baggie pay for that $275,000 watch?
A. He had someone make cashier checks in small increments to pay for the watch.

Q. And where was that person located?
A. In Georgia.

Q. In the United States?
A. Yes.

Q. So Classic Baggie wasn't depositing those cashier's checks?
A. No.

Q. Where were those cashiers's check getting deposited?
A. To the business bank account of my boss, my partners for the watch business.

Q. Is that how you were expecting to get paid?
A. No.

Q. Is that an unusual way to get paid for luxury watches?
A. Yes, there is usually require a wire, direct wire so we can make sure we track and know everything, but he paid through cashier checks, different cashier checks for different companies.

Q. Did that raise any red flags for you or the people you were working for?
A. Yes, at the time, yes.

Q. Can you describe why that raised red flags for you and the people you were working for?
A. It was, as I said, unusual and we sent them the wire information and he replied with a receipt of a payment, but it looks like it was a deposit. So it was weird, and they had to look into it more, just get more information about this guy, the way he was paying.

Q. Can you turn to that slightly larger binder that's in front of you that has Government Exhibits 300 to 405. Can you take a moment to look at what's marked as Government Exhibits 402(a) through 402(d-1).
A. Yes.

Q. Do you recognize those documents?
A. Yes.

Q. Are these some of those phone messages we were talking about earlier?
A. Yes.

Q. Who are these phone messages between?
A. Those are messages between Classic Baggie and I.

Q. And over these couple of exhibits, what are you talking about with Classic Baggie?
A. In this I am discussing with Classic Baggie, in here he asked me, he wanted to buy three watches, I confirmed how many watches. And we basically exchanging what he's asking me to send my information to receive the payments for these watches. So I sent him the wire information for the watch business.

Q. I want to talk to you about a few of those government exhibits. If you could focus your attention first just on 402(a) and 402(b). Ms. Busch, can you please pull up Government Exhibit 402(a). And zoom in on that middle message on page 4 of this exhibit. And just the first time we're looking at one of these up close, I want to talk about a few different parts of this message. Mr. Hermann, up on the top left-hand corner where it says from, what name does it say?
A. Baggy.

Q. Who is baggy to you?
A. That is Classic Baggie.

Q. What's the date of this message on the bottom right-hand corner?
A. November 20th of 2019.

Q. And what is Classic Baggie sending you in this message?
A. He's sending me a picture of a receipt from a deposit from -- to pay for the watch that he purchased.

Q. Ms. Busch, can we please pull up Government Exhibit 402(b), which is a larger version of that attachment. Mr. Hermann, can you explain again what this receipt meant to you?
A. This receipt was deposited, that would go towards the purchase of the $275,000 watch that he sent, that was his confirmation that he sent a deposit towards that watch so he sent it to me.

Q. Again when you say he sent the deposit, did he make this deposit?
A. No, he had somebody else make a deposit.

Q. This message was dated November 20th, what's the date of that receipt?
A. November 20th.

Q. Thank you, Ms. Busch. Ms. Busch, if you could please pull up Government Exhibit 402(c) to focus on that top message. Who is this message from, Mr. Hermann?
A. Baggie.

Q. What's the date of this message?
A. November 21, 2019.

Q. And what is Baggie sending you in this message?
A. He's sending me another payment that will go towards the purchase of the $275,000 watch.

Q. Ms. Busch, could we pull up 402(c-1), which again is a larger version of that image. How much was this deposit for?
A. $82,700.

Q. Again, what accounts are these deposits being made into?
A. They are depositing the money into the Chase account for my business partners in the watch business.

Q. What's the date of this receipt?
A. November 21st, 2019.

Q. Did you have a conversation with Classic Baggie about who was depositing these checks?
A. Yes.

Q. If you could turn your attention to Government Exhibit 402(d). Just briefly read through the messages contained in 402(d). What are you talking about with Classic Baggie in those messages?
A. In these messages, I asked him the send me more information about whoever is sending the money, because we're concerned about the way that the money was being deposited into the account, and I urged him to send more detail about the person sending the money or the company, and just send more information, ID and things like that, just to verify.

Q. Ms. Busch, can you please pull up Government Exhibit 402(d), and focus on the last message of page 2. Can you explain what's going on in this message, Mr. Hermann?
A. This is a forwarded message that Classic Baggie sent me, and this is the information of the person that sent the payments to the business account for the watch.

Q. You say send the payments, do you mean the person that was depositing those cashier checks?
A. Right.

Q. And sending those receipts?
A. Correct.

Q. We're going to see this word forwarded, in the top left-hand corner on quite a few messages. Can you explain based on your use of WhatsApp what that means?
A. It means a message that has been forwarded from another person that was sent to me.

Q. Based on your understanding, would Classic Baggie have typed out the information on that message or would you have forwarded that information from somebody else?
A. Right, he had forwarded that information from somebody else.

Q. Can you just read the business name and individual name that appears on this message?
A. Sure. It is the Mullings Group LLC, and Malachi Mullings.

Q. Thank you, Ms. Busch. If we could leave out Government Exhibit 402(d), and turn to the top of page 3. Can you zoom in on that top message. What does that message mean to you, Mr. Hermann?
A. This message is a forwarded message from Classic Baggie with the ID of the individual that sent the payments, the deposit to this account.

Q. Why were you getting this ID?
A. I was getting it to verify the information that I previously was asking for to make sure that whoever is sending the money you know, is actually the person.

Q. Can we please pull up Government Exhibit 402(d-1) which again is a larger version of that attachment. What's the name on that driver's license?
A. Malachi Anthony Mullings.

Q. Is that an individual that you ever met in person?
A. Yes.

Q. And what resulted in you meeting Malachi Mullings in person?
A. I had to meet him because Classic Baggie arranged a meeting between us for him to drop me off some money.

Q. And over the course of your relationship with Classic Baggie, did you develop an understanding of what Classic Baggie's relationship was to this Malachi Mullings person?
A. Yeah, they were working together.

Q. Thank you, Ms. Busch. Now, at some point did Classic Baggie start to ask you for favors that had nothing to do with $275,000 watches?
A. Yes.

Q. Can you tell me how that started to happen?
A. That started in -- at the end of -- towards the end of 20 -- November of 2019. He asked me to pick up $25,000 from someone in Fort Lauderdale in Florida, and it was supposed to go towards the purchase of the watch, because he was making payments, and I told him that we couldn't take cash because of the way my partners accept money, it has to be straight wired, the way you have been paying is already complicated, so I can't add cash to it, it's going to be too much, he did insist that I go pick up the money, because he said it would be safe with me, than the person he had the money with, so I went and picked up $25,000.

Q. Is that a normal thing you do with people, go and pick up tens of thousands of dollars in cash and hold on to it for them?
A. No.

Q. Why were you doing this for Classic Baggie at that time?
A. At that time, I just wanted to be on his good side, have some small favors, hopefully because he looked like he had a lot of money, I just wanted to be cool with him and be on his good side, just do favors, help him out, it didn't seem like anything crazy, hold on to the money, I'll tell you what to do, I was like okay, cool.

Q. What did he wind up asking you to do with that $25,000 or so in cash?
A. He started asking me to send cashier -- deposit money orders, make money orders with it, like he told me to go to like Publix, for example, just go do money orders, $5,000 and send it to this person, do another 5,000, 2,000, send it to this person, things like that.

Q. What is Publix?
A. Sorry, it's a store, it's like a Wal-Mart or something like that in Florida, very popular.

Q. I just want to break this down a little bit. He would ask you to go to Publix, and how would you get a money order?
A. You go to the cashiers, customer service people and you just ask them, you want money orders and you give them cash and they give you money orders and then you have it, and you can send it to whoever.

Q. And Classic Baggie gave you names of people to send those money orders to?
A. Yes.

Q. And would you mail them at times?
A. Yes.

Q. Did he also ask you to send any mobile payments from that $25,000?
A. Yes.

Q. Can you turn to what is marked as Government Exhibit 402(g), 402(g-1) and 402(g-2). Mr. Hermann, if you could turn in your binder and take a look at what's marked as Government Exhibit 402(g), 402(g-1)and 402(g-2).
A. Yes.

Q. Do you recognize those documents?
A. Yes.

Q. And at a high level, what are you talking about with Classic Baggie in these documents?
A. In these documents, Classic Baggie sent me instructions to send payments to Lawal R.

Q. Ms. Busch, could you see what it looks like if we pull up 402(g), just the last two messages on that page. Is that the instruction that Classic Baggie is sending to you?
A. Yes. He sent me a screen shot of this and with a name of like a CashApp tag, I had to send money to.

Q. Could you scroll down to that next message Ms. Busch, what does that say Mr. Hermann?
A. He say kindly pay my balance in here.

Q. What balance is Classic Baggie referring to?
A. He's referring to the money that he has with me.

Q. Ms. Busch, could we pull up Government Exhibit 402(g-1), which is a larger version of that attachment that Classic Baggie was sent to Michael Hermann. What's the name on that CashApp account?
A. Lawal R.

Q. At that time, did you have any idea who or what Lawal R was?
A. No.

Q. And can you please turn to the next -- Government Exhibit 402(G-2), Ms. Busch. Mr. Hermann, what is this message, what is this image?
A. This is a screen shot that I sent back to Classic Baggie to let him know that I in fact went ahead and made the payments that he asked me to make for the sum of $3,500.

Mr. Hermann starts laundering money for Classic Baggie

Q. Thank you, Ms. Busch. Now, at this time, do you fully appreciate that you are working with someone to launder money?
A. At this time I am --

Q. At the end of November, very early December?
A. At that time, I am not in the mind frame that I'm actually laundering money at that time.

Q. Did you think something weird was going on with all these favors that Classic Baggie was asking you to do?
A. Yes, yes, for sure.

Q. Did you think maybe there was something a little off about these favors?
A. Yes.

Q. Had you ever been in the business of just sending money to different people at someone's direction before?
A. No.

Q. So can you explain how you went from doing these favors to knowingly joining a money laundering conspiracy?
A. Sure. So while this was going on, you know, after this he gave me like a thousand dollars, 1,500, something like that, that I remember, and so after that he basically -- because the first time he -- because he wanted to buy three watches originally, so he bought one from my guys and when I told him how much I made on those, it was like $2,000, he's like that is no money, spending $275,000, you're only getting $2,000, you should make more money, do you have a business account so I could buy through you directly, I said I do, but it's not an actual watch business, I have to pay to a watch business, I have a marketing company, he said that's fine, as long as you have a business account, I can pay through you, you don't have to share your money with these guys, we can figure it out together, we can make money, I was like okay, I can definitely do that, that works, so I sent him my information and supposedly doing a watch business together.

Q. Can you turn to Government Exhibit 402(h), Ms. Busch, can we pull up Government Exhibit 402(h), and zoom in on the top message of page 1. Mr. Hermann, what's the date on this message?
A. This is December 12, 2019.

Q. And looking at this Government Exhibit in its entirety, not just on that message that -the portion of the message that we zoomed in on, what are you talking about with Classic Baggie here?
A. In this message, Classic Baggie -- well he asked me -- he sent me reference on how I should send my information to him, like my business information to him because I think I sent it before and it was so disorganized, so he was like this is how you should send it to me.

Q. Is this in reference to the watch purchase you were hoping to make?
A. Yes.

Q. Did he explain why you had to send your user name and password?
A. He indicated he didn't trust -- it's my first time working with him, he wanted to make sure I wouldn't play him, I wouldn't try to do anything funny, so he asked me to send everything plus my user name and password so he could verify.

Q. Ms. Busch, could you pull up page 2 of this document, the top message. Is that the message that you sent in response?
A. Yes.

Q. And what are you sending him in this message, and him being Classic Baggie?
A. Yeah. I'm sending Classic Baggie all my marketing information, my business information for my marketing company, all of the details that he asked me, and how he asked me to send it.

Q. Based on this exchange, did you ultimately receive a large deposit into one of your bank accounts?
A. Yes.

Q. Into this bank account that's referenced in this message?
A. Yes.

Q. What bank is that?
A. Navy Federal Credit Union.

Q. Had you opened an account in the name of Top Slope Ventures LLC?
A. Yes.

Q. Do you remember how much money that deposit was for?
A. Yes, $261,000.

Q. Did that deposit come straight from Classic Baggie?
A. No.

Q. Again, did somebody else wire that money to you?
A. Yes.

Q. Did he tell you who that person was?
A. Yeah, he sent me the information of that person.

Q. Ms. Busch, can you please pull up Government Exhibit 402(i). And zoom in on the top of page 2. What name does it say there, Mr. Hermann?
A. Sally McCune.

Q. From what city and state?
A. Sandusky, Ohio.

Q. Why did you understand Classic Baggie to be sending you that name and that information?
A. He sent it to me in reference to the wire that was sent just to make sure I know where that wire came from, who sent the wire, the name, I guess, of the person.

Q. If you could turn Ms. Busch, and zoom in on the top message of page 3. Mr. Hermann, can you explain what's happening in this message?
A. In this message, I sent them a screen shot of the money appearing in my account, because he had contacted me and asked me to make sure the money was in my account. And when I saw it, I said yes it was, he said send me a screen shot of it to verify, so I sent it, that's the picture I sent him.

Q. Ms. Busch, could you pull up 402(i-1), which is a larger version of that attachment. What's the available balance that you're sending to Classic Baggie in that attachment?
A. Yes.

Q. What is the available balance?
A. It was $261,209.70.

Q. Can you explain where you took this picture from?
A. I took the picture and I sent it to him.

Q. Is that your online log-in for Navy Federal Credit Union?
A. Yes. Yes.

Q. If you could briefly take out that other small binder in front of you Mr. Hermann, and take a look at what's been marked as Government Exhibit 100.
A. Yes.

Q. Do you recognize that document?
A. Yes.

Q. What is it?
A. This is a bank statement from Navy Federal Bank account.

Q. And what is the name on that bank account?
A. Top Slope Ventures, LLC.

Q. Is that your bank account?
A. Yes.

Q. The bank account you opened?
A. Right. MR. WENGER: The government moves to admit and publish Government Exhibit 100. MR. SPARACO: No objection. THE COURT: Thank you. It's admitted. (Government Exhibit no. 100 was admitted into evidence. BY MR. WENGER:

Q. Ms. Busch, if you could zoom in on the top of page 1. What's the statement period for this document, Mr. Hermann?
A. December 1st, 2019, to December 31, 2019.

Q. Ms. Busch, if we could turn to page 2. Strike that. Page 3. And zoom in on the first December 13th entry. What happened to your bank account on December 13th, Mr. Hermann?
A. On December 13th, I received a wire for $261,000.

Q. And what was the balance in your account before you received that wire?
A. $262.14.

Q. Did Classic Baggie buy a watch with that $261,000?
A. No.

Q. What did he have you do with all that money?
A. He had me send to car business to make payment for car and various things.

Q. I want to turn your attention back to this December 13th, mid December time frame. Before that money hit your account, what did you think it was going to be for?
A. For a watch.

Q. How quickly did you learn that it was not actually for a watch?
A. The next day.

Q. At that point, did you start to have anymore red flags raised in your mind?
A. Yeah, for sure.

Q. Was that the first time you had received a very, very large amount of money directed to you from Classic Baggie?
A. Yes.

Q. Did you think this was all above board at that point?
A. Did I think it was what?

Q. Above board, legit?
A. No, I definitely felt weird about it, but I was also excited because I never seen that much money before, it was nerve racking, but also excited at the same time.

Q. Turning back to what he actually had you do with that money, you said he had you write a cashiers check to a car company?
A. Yeah.

Q. Do you remember how much that cashiers check was for?
A. $122,000.

Q. Could we please pull up what's marked as Government Exhibit 402(k-2), and zoom in on the bottom message. Is this a message between you and Classic Baggie?
A. Yes.

Q. What are you sending him in this message?
A. This message I am sending him a picture of the cashier check that he had me make, and just sending it to him so that he knows that I actually did it.

Q. What is the date on this message?
A. It is December 17, 2020, -- I mean 2019, I'm sorry.

Q. Ms. Busch, could you pull up Government Exhibit 402(k-3), which is a larger version of that attachment. Is that the cashier check you obtained at Classic Baggie direction?
A. Yes.

Q. How much money is that cashier check for?
A. $122,312.

Q. Who is made payable to?
A. Bespoke Motor Group.

Q. Would that name come up time and time again over the course of your relationship with Classic Baggie?
A. Yes.

Q. What do you understand was going to happen with that $122,000 check?
A. He was going to buy a car with it.

Q. Ms. Busch, could you please pull up Government Exhibit 402(o). Zoom in on that top message. This message between you and Classic Baggie?
A. Correct, yes.

Q. What's the date on this message?
A. December 28, 2019.

Q. And we'll fill in some of these gaps, by this time are you fully invested in the money laundering conspiracy?
A. Yes.

Q. You know what's going on?
A. Yes.

Q. There are no tricks going on?
A. Right.

Q. So can you walk us through what this message means and why you were sending it to Classic Baggie, and just start with that top line, deposit, what payment means, what commission means, what balance means?
A. Okay. So he sent $261,000. This is basically an accounting of everything that was done with the money that he sent. The commission was ten percent of the whole thing, and 90 percent to be sent back to him in various ways. So payment one, payment two, all those payments, everything, the instruction that he sent, whether it's a cashier check or like wire or whatever it is, this is basically outlining everything and so he knows exactly what was done with the money, what was left and everything like that, like the money order, there is a fee $75,000, it was $10,000, so basically everything that was done, had to be documented so he knows exactly what was done with the money so you know, there is no confusion, it tells you his balance so he knows what he has left and what he wants to do with it.

Q. Is this generally over the course of the relationship with Classic Baggie how you would document and account for all the money coming in and going out?
A. Yes. Yes. He required that.

Q. And every payment listed, was there a specific instruction that came to you from Classic Baggie about how much money to get and who to send it to?
A. Yes.

Q. You talked about your admission of ten percent on that $261,000 wire. So how much money was that?
A. $26,000. 26,100.

Q. Is that the most money you had ever made in your life at that point?
A. Yes.

Q. At least at one time?
A. Yeah.

Q. Was it the easiest way to make money?
A. Yes.

Q. How did that feel?
A. I had $200, so to have $26,000 at once, it's life changing for me, yeah, I felt like I was rich.

Q. And did you talk to Rita Assane and Dwight Baines about this?
A. Yeah. Yeah.

Q. Did you guys get excited about the prospect of what could happen here?
A. Yeah, for sure. We went out to eat, you know, celebrated, all that stuff.

Q. Did you begin to realize exactly what was going on?
A. Yeah.

Q. After getting that $261,000 wire, did you continue to work with Classic Baggie to receive money at his direction?
A. Yes.

Q. And to move it at his direction?
A. Yes.

Q. To who he asked you to move it to?
A. Correct.

Q. Did you continue to receive anymore large deposits directly into your own bank account?
A. No.

Q. So is this when Rita Assane and Dwight Baines got more actively involved?
A. Yes.

Q. In the days following that $261,000 deposit?
A. Yes.

Q. Can you explain why you got them involved at that time?
A. It was first Classic Baggie wanted more accounts, more business accounts to be opened, more business accounts so he could send money to. And I just couldn't do it, it was too much for me and it was easier also for me to delegate it, I also was excited to work, because I saw the money, just put me on, I want to work, I'm ready, I will do it, so it's easy for them to join and just get started. And so that's kind of how he got -- that's how he really got started really.

Q. Were there any added benefit to you to having them get involved and open up bank accounts?
A. Yeah, yeah, because first I didn't have to do it myself because it's definitely nerve racking believe it or not, to go to the bank and have to do a cashier check and just not know what is going to happen, I didn't have to go to the bank anymore and I could still share the profit, the ten percent between all of us, it was definitely a benefit to me, I was helping them out so they were also making money, so that was also a benefit.

Q. Was your name on all those accounts?
A. No, their name was on them.

Q. Was that also a benefit to you?
A. Yes.

Q. Can you explain at a high level what Rita Assane's role in this organization came to be?
A. Sure. She was in charge of opening up LLC's. Of course the more LLC's you have, the more business bank accounts you can open, and the more money you can receive. So that's what she was doing, and also she had to receive money and send money to whoever she was supposed to send money to according to -- from the instructions that were sent to us.

Q. The instructions sent to you by Classic Baggie?
A. Yes.

Q. Did Dwight Baines have a similar role?
A. Yes.

Q. Who were the primary LLC for businesses that Rita Assane used for this organization?
A. KLAM Properties LLC and KLAM Entertainment LLC.

Q. What were the primary business or businesses that Dwight Baines used as part of this operation?
A. Baines Properties LLC.

Q. Once you had Rita Assane and Dwight Baines involved, what did your role become?
A. I was more of almost like a liaison, I would get information from Classic Baggie, like the instructions and I would just forward it to either Baines or Rita.

Q. Now, were you left to your own devise to figure out how to do this or did Classic Baggie give you specific instructions on what to do?
A. He gave me very specific instructions on what to do.

Q. Can you explain some of the instructions that Classic Baggie gave to you?
A. He would tell me, for example, like to open up business bank account instead of personal bank account, what bank to open the account with.

Q. I want to briefly pause right there, why did he tell you to open up business bank accounts instead of personal bank accounts?
A. Yeah, he did say that business bank accounts is a lot easier to move money. I guess, you know, if you receive a large sum of money in or take it out, take it out of your account, from a business perspective, it was easier and the bank would not request anything. Whereas, if it's a personal bank account, when you receive a big amount of money, or you go to take it out, it gets questioned because this is personal, personal people don't move money like that, businesses are more lenient, the money in basis to do.

Q. Did he also advise to you at what particular banks to open accounts?
A. Yes.

Q. What did he tell you about that?
A. He said that bigger banks are easier for some transaction, and then some small banks are also good for some type of transactions.

Mr. Hermann confronts Classic Baggie about his source of funds (and learns about Romance Scams)

Q. At some point while accounts are getting opened and you, Rita Assane and Dwight Baines are getting off the ground, do you have a conversation with Classic Baggie about exactly where all this money was coming from that you were directing your way?
A. Yes.

Q. Can you tell me about that conversation?
A. Yeah. It came about when one of the accounts was on hold, frozen for like -- for a certain reason and we didn't understand why. And the bank started asking questions which at first everything was fine and then it just became more rowdy, you have to close it, you have to send some information, there are some fraud things going on so we became concerned --

Q. I want to briefly pause you, just to orient the jury to when this conversation was taking place, was this kind of also in mid December when this was all getting started?
A. Yes, yes, yes, so it was around December, and so when that happened, first it wasn't my account at the time, it was Rita's account, so she was concerned, and she was like need to try to figure out what's going on here because he told us everything is supposed to be fine, and now they're calling her and things like that. She started to be a little bit scared, so I had to have a serious conversation with him because he made us feel like everything is good, this is his own account or -- at first he said something about it was -- it's business partners like the Saudi and the one that sent money, he had businesses in the U.S., we were comfortable, even though it was a little funny. But when the accounts started being on hold and frozen, the bank is calling, then it's like is it really your stuff, you got to tell me what's going on here, this is not my personal account, I'm involved with other people, I want to know what's going on, otherwise it's not going to fly, so you have to tell me what's going on.

Q. Let's get to that in a second. But within a week or so of getting your first large deposit into your bank account and working with Classic Baggie, all these issues with the bank started coming up?
A. Yes.

Q. And red flags were being raised by the bank?
A. Yes.

Q. Within a week?
A. Yeah.

Q. So tell me more about this conversation with Classic Baggie where you confronted him about where this money was really coming from?
A. So when I asked him, he basically explained to me that he had everything under control because the people that are sending the money are actual people who send the money to people -- okay, the people that send the money will not recall the money because they have them under control. So and so when I ask him to elaborate more, he told me that it was his people that are in the love relationship with him.

Q. What do you mean by -- can you explain about his people being in the love relationship with them?
A. So he told me there was a love thing, so a love scam, right. And so the people that he works with have these people under control. That basically are the partners or the lovers, and instruct them to send the money to us so we can send the money back to them. The reason why the bank account wouldn't freeze or anything could happen is because the person that is in love is actually going to the bank and sending the money to us, so there is no reason for them to recall it or for anything to happen. It wasn't stolen money, somebody goes into an account and hack it and send it to you where you can get in trouble, so they will fix it, it will only be a problem, you have to focus on working because it will get taken care of. But the explanation that he give me in detail was more like his people that he's working with basically have the people that send us the money like in control, like they control them, they'll work with them, they're in love with them, and so they basically send us the money and everything will be fine.

Q. And did Classic Baggie describe these people who are in love, about what type of people they were?
A. Yeah. They were older people that had money. And they think they in love with this person that is behind a computer, and they asking them for favors, and the favors turned into money, and that's when they start sending money to help them out.

Q. Did you have a conversation with Classic Baggie about whether those favors were based in the truth or based in lies?
A. Yeah. I mean, it was tricky, you know, he did explain that those are the things they do online, they basically find older people that have money and get them out of their money, trick them out of their money and have them send us the money and take our percentage I guess and send the rest to them.

Q. Were you doing anything for these people sending you, Rita Assane and Dwight Baines money?
A. No.

Q. Now, you talked about being comforted because Classic Baggie said the money wouldn't get recalled or anything, this wasn't stolen money. Could you talk in a little bit more detail first by what you mean by the money won't get recalled and why that comforted you?
A. Yeah, he did -- well the reason why it comforted me and us altogether, is because the first part is never going to come back where like the person -- he explained that it wasn't stolen, so that is good enough first of all, because the person actually goes to the bank, if it's Sally or whoever, they sit there and actually sent us the money. So that was, okay, at least it's not stolen, they're not going to come after us or whatever, but the second thing it was that if anything happened, he could fix it, that was another way to -- you know, that we felt also comfortable.

Q. And when you say the money wasn't stolen, do you mean that the money was not taken without the sender's knowledge?
A. Right, right. Right.

Mr. Hermann Explains How Classic Baggie's Operation Worked

Q. Over the course of your working relationship with Classic Baggie, did you gain an understanding of how his operation worked?
A. Yes.

Q. Was that based on conversations with Classic Baggie?
A. Yes.

Q. And doing things at his direction?
A. Yes.

Q. Can you explain at a high level how you understood his operation to work?
A. Yes, sure. For the sake of I guess, administration, I will call the people doing scam, the actual, what I call victim, and fraudsters, just to -- so everybody follow and understand the way I understand. So Step 1, is that the fraudsters create an online profile, like a dating profile. With the dating profile targeting a certain number of people, older people with money, they get to talk to them, get them to fall in love with them and get to ask for certain favors and those favors are you know, money, small gift and things like that. And so after the clients -- I mean not clients, the victims agree to --

Q. Stop right there, you just used the terms clients. Is that a term that you had used with Classic Baggie?
A. Yeah.

Q. Is that how he would refer to what you have described as the victims?
A. Yeah. You refer to them as clients.

Q. That was the terminology you would use, clients?
A. Right. Right. I would say that's my partner's clients, things like that. But I wanted everybody to follow so I said victim and fraudsters. And so they would create the profile, get them to fall in love with them. And after they fall in love with them, then they can ask them for favors including money and they would tell them they have like certain issues or whatever, they need money for investment like whatever it is, they want to invest in a business or an estate, things like that, and the client then sends money. That's Step 1. The Step 2 is when the client is getting ready to send the money --

Q. Quick pause. Step 1, was it ever explained to you how long it might take for Step 1 to be completed, how long it took to convince someone to send money for an online relationship?
A. That I'm not a hundred percent sure, I couldn't say something I don't know, but I'm assuming it might take a few months or a few weeks, it's the older people, too, that's the reason for the target because of their need for companionship from what I understand.

Q. You were about to explain Step 2?
A. Step 2 now that they prep them, they're ready to send the money because they're in love and they want to help their lovers which is fraudsters. Step 2, now they're getting ready to send money, there is no account to send the money to, they can't send to them because a lot of times they're not in U.S. or Nigeria sometime, they might be in the US, they don't want association with that bank account. Step 2 is when we come in, they find people like me or Rita or whatever to open bank account where they can send the money to, and the money can be -- you know they can do whatever it is. Step 2 is to get the bank accounts, which they will find people like me or whatever, get them to open a business bank account and send the money to. And then Step 3 is how they recover the money back to them, so we keep the ten percent, and the 90 percent goes back to whoever organized the whole account or whatever it is, and so he can go back to the people that actually started the fraud which is the fraudsters. So that's what I understood the whole thing to work.

Q. Do you have an understanding based on your conversation with Classic Baggie about how he got some of this money back in Nigeria?
A. Yes. And he got it in few different ways, either it will be through let's say, it will be through buying a car, like he'll buy a car in the U.S. and ship it, the car will be bought with the money that we have in our bank account for example, and the car gets shipped to Nigeria, and when it gets to Nigeria, they sell it and he recovers his money that way. Originally he said that he had a money transfer business where people, for example, give him money in Nigeria, 10,000, whatever amount and then he would give them the money in equivalent in the U.S., so he will also -- and the money that he will give in the U.S. of course will be in our bank account and you would tell me or you know, just send so much amount of money to this person and you would do it. So that's how he also recovers the money that way.

Q. Did Classic Baggie ever tell you how maybe people worked for him as part of this operation?
A. Yeah, he told me over 20 people in the U.S. and multiple others outside of the country.

Q. Did Classic Baggie ever tell you whether he had any friends or relatives in America?
A. He told me he had a girlfriend in the U.S.

Q. I want to shift your attention and talk a little bit about the day-to-day logistics of how you, Rita Assane and Dwight Baines laundered money for Classic Baggie. Can you first describe the different ways that you, Rita Assane and Dwight Baines received money?
A. Sure. We received money through multiple different ways, either it will be a check that will be sent to us in the mail, or it will be a wire that will hit the account. Or it will be a check deposited into the account, those are the various ways.

Q. Let's focus on these checks getting mailed to you for a second, did you know any of these people sending checks?
A. No.

Q. How did they know how and where to send checks to you?
A. So, Classic Baggie, I will send -- he will ask for addresses, whether its business address or whatever address, and we will send it to him, so he will then send that information to the fraudsters or the love, whoever, you know, and they would take that, those checks -- not checks, the address and forward it to whoever needs to send the money.

Q. Did it work the same way for wire transfers, did he know the people transferring money by wire into these bank accounts?
A. No, not directly, no.

Q. Do you know how they got the bank account information for your bank accounts and Rita's bank accounts and Dwight Baines's bank accounts?
A. It would be through Classic Baggie.

Q. Was Classic Baggie the only person you gave your address and the bank account information to?
A. Yes.

Q. So now I want to turn your attention to after the -- after a check was received as part of this operation, can you explain what would happen next?
A. After a check is received, the first thing is that we had to send the picture of the check to Classic Baggie so just to -- he knows -- so he knows that we actually receive a check so we have to send a confirmation. That was a requirement. After you send a confirmation, you have to go to the bank and deposit the money into your bank account and he would tell us which one to deposit it into, because he had access to all the big bank account, he said I know you have money coming in this account, don't put the money here, put the money into this account instead. So he would say something like that, and you would put the money in the account, you would send a receipt that it's been deposited, and it takes two days to pay, and after that, he would send instruction on what to do with it.

Q. After the money became available either through a check clearing, or a wire deposit made into an account, can you explain the instructions you would receive from Classic Baggie about what to do next?
A. Yeah, so after the check clears, he would send me, you know, the name, address, or wire info, or you know, account number with the amount of money that he wanted to be sent to whoever, and then we just do it.

Q. And would you personally be doing this or did you forward those instructions on to other people?
A. I would forward it to either to Rita or Baines.

Q. Can you explain some of the different ways that Classic Baggie asked you to distribute money to other people?
A. The different ways would be again, through money orders cashier check, or wire.

Q. For the cashier checks, how would you get it to the people you were instructed to get it to?
A. The cashier check would be either, either you have the bank account so you deposit directly to the bank account or you mail it to them.

Q. What was the primary means that you used to mail these cashier checks?
A. FedEx.

Q. What did you have to do or what were you instructed to do after a FedEx shipment was made at Classic Baggie's direction?
A. After a FedEx shipment was made, you have to take a picture of the receipt with a tracking number and send it to him so he knows that it's actually been done.

Q. Was that something that would happen every time a FedEx shipment was made?
A. Yes.

Q. Typically, who would be taking the picture of that FedEx receipt?
A. It would be Rita or Baines, and they would forward to me, and I would forward to him.

Q. Did you keep track of the money that was getting deposited into the bank accounts opened by Rita Assane and Dwight Baines?
A. Yeah.

Q. Were all those deposits directed your way from Classic Baggie?
A. Say that again, I'm sorry.

Q. Were the deposits being made into those bank accounts all directed to you by Classic Baggie?
A. Yes, correct.

Q. What was your understanding of the source of all that money?
A. After a while, we knew that it was from these victims.

Q. Now, over the months, maybe a year you were working with Classic Baggie, were you instructed to send money to just a couple people or to a whole bunch of people and businesses?
A. A whole bunch of people.

Q. Was there one person that Classic Baggie instructed you to send money to more frequently than anybody else?
A. Yes.

Q. Who was that?
A. Lawal.

Q. Did you ever ask Classic Baggie why you were sending so much money to Lawal?
A. Yes.

Q. What did he tell you?
A. Well, I remember exactly when that happened because it was a payment that we had to send to him that was -- that had taken time because it was a smaller bank and they wouldn't release the money, and he thought it was our fault so he basically called me to curse me out, like you need to be moving faster than this, you know, this person need his money, Lawal needs his money, and he was like that's his money, you know. And basically, he said if we don't move fast enough, no money is going to come, money is not going to keep coming because you're moving too slow, he's the one sending the money so you need to hurry up and get the money out of the way.

Q. And the way Classic Baggie described his money, who is the his in that sentence?
A. Lawal.

Q. And all of that money that was described as Lawal's money, where was that money coming from?
A. From the victims.

Q. And is there a word that Classic Baggie used to describe his relationship with Mr. Lawal?
A. Yes, it was his partner.

Q. His partner and what?
A. His partner, and you said.

Q. You said his partner in what?
A. In the romance fraud thing they had going on.

Q. Can you turn your attention to Government Exhibit 402(q), in that larger binder in front of you. Ms. Busch, if you could please pull up Government Exhibit 402(q). Zoom in on that top message, please, Ms. Busch. Can you briefly state who these messages are between?
A. This is a forwarded message between Classic Baggie and I.

Q. What was the date of this message?
A. January 6, 2020.

Q. And what did you understand it to mean when that term forwarded appears on the top left-hand corner?
A. It was basically a message that I was forwarded from Classic Baggie, from another person to Classic Baggie and he sent it to me.

Q. Can you read what is contained in this message?
A. Sure. Olugbenga Lawal, 3470 Highfield court, Indianapolis, Indiana 46222.

Q. Ms. Busch, can you scroll down to the bottom message of page 1. What are you asking Classic Baggie in this message?
A. I'm asking him how much to send to that address that they send.

Q. Ms. Busch, if you turn to the last page of this exhibit. Zoom in on the bottom message. What does that state?
A. Do 10K, 10,000 money order.

Q. Based on your reading of these messages between you and Classic Baggie, what do you understand Classic Baggie to be asking you to do on January 6th of 2020?
A. He's asking me to send the $10,000 money order to Lawal, Olugbenga Lawal at the address in Highfield Court in Indianapolis, Indiana.

Q. Please turn to the portion of this binder that is the 300 series of exhibits, and turn first to Government Exhibit 301(a). Look up at me when you have gotten yourself to 301(a).
A. Yes.

Q. If you could just briefly take a moment to look through 301(a) through 315, just to get an understanding of who these messages are between.
A. You said 301(a) through 315?

Q. Yes.
A. (Witness reviewing. ) Yes.

Q. And who are these messages between?
A. These are messages between Rita Assane and I.

Q. And is there any common theme to most of those messages?
A. Yeah. It is our forwarded messages for the most part that I sent to Ms. Rita Assane from Classic Baggie.

Q. Ms. Busch, could we please pull up Government Exhibit 301(a). And if you could zoom in on the bottom message. Can you explain what is happening in this message, Mr. Hermann?
A. Sure. Again, this is a forwarded message from Classic Baggie that I sent over to Rita with instructions to send $20,000 cashier check, and a $7,200 money order mailed to Lawal Olugbenga at 3470 Highfield Court Indianapolis, Indiana 46222.

Q. What's the date of that message?
A. January 14, 2020.

Q. Thank you, Ms. Busch. Mr. Hermann, can you turn to Government Exhibit 303.
A. Yes.

Q. What's the date of this message?
A. January 24, 2020.

Q. And what's going on in the message in Government Exhibit 303?
A. This is another forwarded message from Classic Baggie that I sent over to Rita Assane with instruction to send $54,000 to Lawal Olugbenga at 3470 Highfield Court Indianapolis, Indiana 46222.

Q. Ms. Busch could you please pull up the top message of Government Exhibit 303. Is that the message you were just referring to?
A. Yes.

Q. Ms. Busch, can you scroll down to the second message? That contains the amount, $54,000?
A. Correct.

Q. Can you please turn to Government Exhibit 305?
A. Sure.

Q. What's the date of this message?
A. This is January 31st, 2020.

Q. Ms. Busch, could you please pull up Government Exhibit 305 and zoom in on the top message? Mr. Hermann, what do you understand the messages to mean in Government Exhibit 305?
A. This is another forwarded message from Classic Baggie that I sent over to Rita Assane with instruction to send Lawal Olugbenga at the address 3470 Highfield Court Indianapolis, Indiana 46222 for a sum of $20,000 in a cashier check.

Q. Can you scroll down to that second message. Please turn to Government Exhibit 306, Mr. Hermann. Thank you, Ms. Busch. Take a moment to read through these messages.
A. (Witness reviewing documents. )

Q. What's the date on these messages, Mr. Hermann?
A. February 4th, 2020.

Q. And what did you take away from the messages you exchanged between yourself and Ms. Assane in this exhibit?
A. In this exhibit, we are discussing checks that used to be going to Lawal with the amount of $13,200, for the amount with the address of Lawal at 3470 Highfield Court Indianapolis, Indiana 46222, so that's another payment for $13,200.

Q. Ms. Busch, would you please pull up Government Exhibit 306 and zoom in on page two, the second to last message. What are you instructed Ms. Assane there?
A. I'm instructing her to send $13,200.

Q. Can you scroll down to the last message, that is the address you're instructing her to send it to?
A. Yes.

Q. Lawal Olugbenga?
A. Yes.

Q. Can you zoom out to this whole page. This looks a little bit different than the other messages. We didn't look at messages in foreign language just now, but are some of these messages in a dialect of French?
A. Yes.

Q. And have we gone over instances where those messages have been translated?
A. Sure.

Q. For certain select messages?
A. Yes.

Q. And when we have done that, have we gone over whether you agree or not with the translations?
A. Sure, yes.

Q. These aren't translations you did, correct?
A. No.

Q. Have you generally agreed with the translations as they have appeared on the documents that have been translated?
A. Yes.

Q. Thank you, Ms. Busch. Mr. Hermann, can you turn to Government Exhibit 307. Ms. Busch, if you could pull up the bottom message of Government Exhibit 307. Take a look at this Government Exhibit, Mr. Hermann and tell me what's going on in these messages.
A. Sure. In this message, this is also forwarded message from Classic Baggie that I sent over to Rita Assane, and this is more instructions to send, in this case, $50,000 to Lawal Olugbenga at the address 3470 Highfield Court Indianapolis, Indiana.

Q. What is the date of this message?
A. February 6, 2020.

Q. Can you scroll down to the top of page 2. That's where you -- the amount you understood you had to send to Lawal Olugbenga?
A. Correct.

Q. If you could turn to Government Exhibit 308(a). Ms. Busch, if you could just zoom in only on the top message of 308(a). Mr. Hermann, what do you understand this message to mean?
A. This is a message that I sent to Rita Assane, basically saying he want cashier check from the Chase account, $3,500 mailed to Lawal.

Q. Who is the he in that message?
A. Classic Baggie.

Q. I don't see that as a forwarded message, where would you have gotten that instruction from?
A. I got it from him.

Q. Him being Classic Baggie?
A. Classic Baggie, yes.

Q. And you agree with that English translation of your message?
A. Yes. Yes.

Q. Can you turn to Government Exhibit 308(c). Ms. Busch, can you please pull up Government Exhibit 308(c), and zoom in only on that middle message. What's the date on that message, Mr. Hermann?
A. February 11, 2020.

Q. Can you read the English translation of that message?
A. Sure. It says because really we ship too much to this Lawal.

Q. Why did you send that to Ms. Assane?
A. I sent that because we were sending way too many shipments or cashier checks to that same address, it kept coming up and we're sending it without real name, real address and everything like that, so we're concerned at some point there is going to be some issues, so I'm telling her to be careful, we need to use a different name or not put our own name on that shipment because it became too much, too frequent.

Q. Turn to Government Exhibit 310. Can you briefly read through the first and second page, and tell me what these messages mean?
A. These are more forwarded message that -- well, more instructions that are sent to Rita with Lawal Olugbenga's address to send $50,000.

Q. Ms. Busch, can you please pull up the top message on the first page of Government Exhibit 310? Why are you sending that name and address to Ms. Assane?
A. I sent it from instruction from Classic Baggie to send more money to Lawal.

Q. Ms. Busch, can you scroll down to the next message? What is Ms. Assane writing here?
A. Yes.

Q. What is Ms. Assane writing here?
A. Oh, $50,000.

Q. Can you go to the next message, Ms. Busch. And go to the top message on page 2. What did you respond?
A. I responded yes.

Q. And what did you mean when you said yes?
A. Yes, $50,000.

Q. Can you turn to Government Exhibit 311? What do you understand these messages to mean, Mr. Hermann?
A. These are forwarded messages from Classic Baggie that I sent to Rita with instruction to send $87,000 to Luxe Logistics LLC, to the PNC Bank account, and I sent also the account number and address.

Q. Where did you get all that information from?
A. From Classic Baggie.

Q. Ms. Busch, can you scroll down to the next message? Is that why you're referring to sending $87,000?
A. Yes.

Q. Mr. Hermann, can you please turn to what's marked as Government Exhibit 312(b). Ms. Busch, if you could please pull up the bottom message through 12(b). That indicates a forwarded message. Who would that have been forwarded from?
A. From Classic Baggie.

Q. Can you read what that says on that message?
A. My own address 3512 North Dukane Way Indianapolis, Indiana 46224.

Q. And what is the date of that message?
A. This is February -- this is April 3rd, 2020.

Q. Now, did you live at 3512 North Dukane Way?
A. No.

Q. Did Classic Baggie live at 3512 North Dukane Way?
A. No.

Q. Who did you learn was associated with 3512 North Dukane Way?
A. Lawal.

Q. Please turn to Government Exhibit 313. Ms. Busch, if you could pull up the top message of Government Exhibit 313. Who did you forward this message from?
A. From Classic Baggie to Rita.

Q. What is the date of this message?
A. April 4th, 2020.

Q. Can you please read this message?
A. Sure. Help me send the money order to my new address, 3512 North Dukane Way Indianapolis, Indiana 46224.

Q. Ms. Busch can you scroll down to the second message. What does that message say?
A. Lawal Olugbenga.

Q. Ms. Busch, can you please scroll to the next message on the top of page 2? What does that message say?
A. 10K money order.

Q. What were you instructing Ms. Assane to do during these messages?
A. Instructing her to send a $10,000 money order to Lawal Olugbenga at the new address that was provided to us.

Q. Can you turn to Government Exhibit 315? And could you briefly describe while Ms. Busch pulls up the top message, what's going on in these messages?
A. Sure. This is another forwarded message from Classic Baggie that I sent over to Rita, instructing her to send $5,000 money order to Lawal so --

Q. Can you scroll down to the middle message?
A. Lawal Olugbenga 3512 North Dukane Way Indianapolis, Indiana 46224.

Q. Can you read that message, Mr. Hermann, put that up on the screen?
A. Sure. You can mail money order to Lawal Olugbenga 3512 North Dukane Way Indianapolis, Indiana 46224.

Q. Where did you forward that message from?
A. From Classic Baggie.

Q. Now, we just looked at quite a few messages between January 2020, and the April of 2020 and we may look at one or two more. That every single instruction that you ever sent to Ms. Assane concerning Mr. Lawal?
A. Yeah. I mean, not, is it every single instruction? Yeah, for the most part, yeah.

Q. For the most part that was the number of times you were instructing Ms. Assane to send money?
A. Right. Correct.

Q. Mr. Hermann, can you turn your attention to what's marked as 405(a). Can you just let me know when you have reached 405(a).
A. Yes.

Q. Now, are these messages between different people in this exhibit?
A. Yes, this is messages between Dwight Baines and I.

Q. And Ms. Busch, if we could please pull up the bottom message of Government Exhibit 405(a). What are you -- what does this message mean?
A. This is instruction that I sent to Dwight Baines, basically from Luxe Logistics LLC, to send 19,247.

Q. Is this the example of the type of instruction you would also send to Dwight Baines as part of your money laundering operation?
A. Yes.

Q. Thank you, Ms. Busch. All this money, the $50,000 checks, the $13,200 checks, the $10,000 in money orders, what was the source of every dollar of that money you were instructing people to send to Lawal?
A. What was that question again?

Q. What was the source, where did all the money come from that you were sending to Lawal?
A. It was from the romance fraud victims.

Q. That was your understanding?
A. Yes.

Q. I want to shift gears just a little bit. Were you ever made aware that Rita Assane or Dwight Baines had problems getting the money out of the accounts that had been deposited?
A. Yes.

Q. And we talked about some of those issues?
A. Yes.

Q. Would you bring those issues to Classic Baggie's attention?
A. Yes.

Q. Would you have conversations with him about it?
A. Yes.

Q. What could he do about it?
A. He could possibly fix it sometimes, sometimes he couldn't, but we had to write it to his attention if something happens.

Q. How could he fix it, was he calling the banks?
A. No.

Q. Could you explain how that happened, how he could ever fix a problem you were having with one of your bank accounts?
A. Well, first we have to tell him if anything happens because then he would think that we did it or we trying to steal his money. But we had to tell him because he could contact the people that sent the money to try to contact the bank or you know, something like that and fix the problem.

Q. Did you ever have issues with -- either you, Rita Assane, or Dwight Baines have issues with withdrawn money by a woman that had been sent and deposited into your accounts by the name of Debra?
A. Yes.

Q. Did you bring those issues to Classic Baggie's attention?
A. Yes.

Q. Can you flip in your binder to what is marked as 402(k-4) through 402(k-9). Please take a moment to look at each of those exhibits in 402(k-4) through 402(k-9) and look up at me when you have had a chance to do that.
A. (Witness reviewing documents. ) Yes.

Q. And are those conversations between yourself and Classic Baggie?
A. Yes.

Q. And what are you discussing over the course of those Government Exhibits?
A. In these messages, we discussing pretty much, it's a situation that happened where $60,000 was stuck, frozen or on hold from the bank, and we couldn't get the money out what I contacted him for so he could help and try to figure out exactly what happened, what's going on. And in here, he is sending me the conversation between the victim and the fraud center in this situation to try to fix the situation, trying to fix the issue.

Q. Ms. Busch, can you pull up Government Exhibit 402(k-4) and go right on the middle message. Is that what you're describing when you said Classic Baggie sent you a screen shot of the conversation between the victim and their lover?
A. Yes.

Q. Could we please pull up the larger version of that attachment, Government Exhibit 402(k-5). Can you explain what exactly you understood this conversation, who you understand this conversation to be between?
A. Yes. So this is a conversation between the actual victim and the lover, here she is mentioning that they need an invoice, I guess the bank needed an invoice, to, you know that we had to make an invoice from KLAM Property that shows that the $60,000 she sent is actually legitimate to make sure those are her pattern or it matches whatever she is saying, whatever she sent.

Q. So Classic Baggie had that message to send to you?
A. Yes.

Q. And what did you do -- thank you, Ms. Busch -- as a result of this conversation with Classic Baggie?
A. I made an invoice.

Q. And Ms. Busch, could we please pull up Government Exhibit 402(k-8). And zoom in on that bottom message. Does that reflect you sending an attachment to Classic Baggie?
A. Yes.

Q. Ms. Busch, could you pull up 402(k-9), which attachment contained on that message. Is this the invoice we were just talking about?
A. That's correct, yes.

Q. Who created this invoice?
A. I did.

Q. Who did you send it to?
A. That is Classic Baggie.

Q. What was the purpose of this invoice?
A. Is to resolve the issue of the $60,000 that was on hold.

Q. What's the name in the to line of this invoice?
A. Debra Ann Czodli.

Q. Did you understand that to be the victim who message you were sent by Classic Baggie?
A. Correct.

Q. I want to talk a little bit more and turn your attention back to the role that cars played in the money laundering operation you did with Classic Baggie. And we touched on this a little bit earlier in your testimony. We talked about the name Bespoke?
A. Yes.

Q. Can you explain whether that name is an entity you were instructed to send money to over and over again?
A. Yes. Bespoke was one of the first checks that was issued under Classic Baggie's instruction, the $122,000, it was sent to Bespoke.

Q. Did he send you more instructions to send money to Bespoke after that?
A. Yes.

Q. What other types of car dealerships or places that sold cars would be instructed to send money to?
A. We got to make checks payable to auction places, car auctions, and other regular dealerships to buy different cars.

Q. And do you remember the name of any of those car auction houses?
A. Sure, one of them was IA
A. And another one was Copart.

Q. What was your understanding of what was happening with all these checks that you were making payable to car auction houses and car dealerships?
A. My understanding is that they bid on those cars early, buy them, win the bid, and then we have to go cut the check, whatever amount you tell me to, and just pay them so the car can be paid off so you know, it didn't sit on the auction or whatever. So they already bid on and everything, everything is taken care of, they say pay it so we can pick it up and ship it and do what we had to do.

Q. Where did these cars get shipped?
A. For the most part, Nigeria.

Q. That's based on conversations you had with Classic Baggie?
A. Yes.

Q. Again, what money were you, Rita Assane, and Dwight Baines using when sending these checks to the car auction houses and the car dealerships?
A. We were using the romance money that was deposited into an account.

Q. At some point were you contacted by the FBI in relation to all this money laundering activity?
A. Yes.

Q. Do you remember that first time you were contacted by the FBI?
A. Yes.

Q. About when was it?
A. It was around May of 2020.

Q. Did you tell Classic Baggie that the FBI had contacted you?
A. Yes.

Q. Can you tell me about that conversation you had with him?
A. Sure. I remember I was with Rita and we called him freaking out, like, you know, they contacted us and everything like that, like what to do, are we going to be in trouble, things like that. And he basically calmed us down and said that you know, it's going to be fine, get rid of anything evidence wise that you have and he's going to try to keep everything under control on his end, as far as the client goes, if they don't talk, nobody will get in trouble, just to get everything and calm everyone else.

Q. Did you attempt to follow those instructions?
A. Yes.

Q. Did you go into phones and delete messages?
A. Yes.

Q. A lot of messages?
A. Yes.

Q. Messages between yourself and Classic Baggie?
A. Yes.

Q. Messages between yourself and Dwight Baines?
A. Yes.

Q. Messages between yourself and Rita Assane?
A. Yes.

Q. Did Classic Baggie ask if you had talked to the FBI?
A. Yes.

Q. What did you tell him?
A. I told him I didn't.

Q. Was that the truth at the time?
A. Yeah, at the time it was.

MR. WENGER: At this time I have no further questions, Your Honor.

Please check back for Classic Baggie: Part 3 - The Romance Scam Victims Testify

 If you are just joining us, we are reviewing the court transcripts of a Business Email Compromise / Romance Scam Money Laundering case.  Part One reveals "Classic Baggie: A Delaware BEC Case calls him the leader of an International Criminal Organization" and Part Two was called "Classic Baggie: Part 2 - How to run a Money Laundering Operation."

Today, we'll share the stories of three of the romance scam victims in this case. I would normally address them by their surnames as Mr. X or Mrs. Y out of respect, but to help protect their anonymity, I'm using only their first names.

Sally From Ohio

Sally was a 74-year old Ohio woman. Her husband of 42 years passed away in February of 2016. Three years later, Sally joined several online dating websites, including Match.com. In August 2019, she received a message from "Harry Oppenheimer" who was a 79-year old man living in Chicago, a dual citizen of the US and Switzerland, and a semi-retired aeronautical engineer. They talked daily by phone, text, or email and Sally believed she would spend the rest of her days with him.

In September 2019, Mr. Oppenheimer began to ask Sally for financial favors. He claimed he was selected as an independent contractor to rebuild a fleet of airplanes for KLM Royal Dutch Airlines, who had wired him $3.5 Million Euros into his Swiss bank account at Neue Privat Bank. His attorney, Phillip Richardson, said that he had to fly to Switzerland to unfreeze the funds. He provided Sally with a bank statement showing his account held 5,239,800.38 Euros.

In order to unfreeze the account, his attorney needed him to bring a "refundable deposit" of $240,000.

The Email from the attorney read:

"I really abhor putting your hopes up, but I can guarantee we can resolve this muddle amicably by resulting into making the payment of the refundable $240,000 security deposit. This will help in securing the money laundering certificate, as well as qualify Harry Oppenheimer to be cleared by anti-terrorist and money laundering departments. It will also hasting up the process of the funds release. Please be advised that this is a mere suggestion as I still need to contact authorities involved in this, those Harry worked with/for, to get all necessary documentation in place. I also need to get in touch with the IMF money laundering department to be fully guaranteed that."

A second request came on 04DEC2019 after Sally had sent the $240,000, stating that an additional $511,000 was also needed,and included a promisary note that Sally "will be refunded and paid" once Harry was able to gain full access to his funds "in the amount of $5,239,800 in NPB."

On 13MAR2020, a new document came from the "International Monetary Fund."

"Per your last request, having thoroughly examined the situation on ground, the board has decided that we will not be held responsible in any way for the misconduct of your former attorney, Phillip Richardson. You solely appointed him your representative with all parties involved granting him full power of attorney. In conclusion, the contractor's funds that were initially set to be released on the 16th of January 2020, shall now be rescheduled for April 2nd, 2020, provided that Harry Oppenheimer completes the final payment of $200,000 before the deadline."

Sally wired $511,000 on or about 06DEC2019 to "Debbie" who Mr. Oppenheimer represented was the wife of an attorney named Charles Schneider. (This wire was recalled by the bank.)

Sally also wired $261,000 on 13DEC2019 from a Navy Federal Credit Union account in the name of Top Slope Ventures, LLC. (We saw in Part 2 that Top Slope Ventures is the name of Michael Hermann's watch-selling business.)

She also wired $150,000 on 26MAR2020 to a Citibank account in the name of KLAM Properties.

She was also instructed by "Attorney Phillip Richardson" to wire funds to a bank account associated with the Mullings Group LLC at Delta Community Credit Union.

Richard From Delaware

Richard is a 66-year old man who lives in Delaware, married, but separated from his spouse for four years. He worked selling medical devices in 2019 and 2020, the period of interest for this case.

Richard met Samantha Smith online in October 2019, on the dating website Silver Singles. Samantha was a Gemologist who had a degree in the same from the University of New Zealand. She was currently living in Istanbul, Turkey, where she was working on a project related to mining precious stones, but her permanent residence was Norfolk, Virginia.

They began talking regularly through text message and email. She sent photos of herself to Richard via email, and he received a video of her describing her project in Istanbul. Samantha had an attorney named Sousa Darius, who began calling him on the phone several times a week. To validate his identiy, Sousa Darius sent Richard a copy of his Turkish passport.

Samantha had claimed that her project was a success and that tshe had been able to mine a quantity of Tanzanite stones. In order to sell them, however, she had to receive a certificate of completion from the Turkish government, and later had to pay taxes on the stones, prior to selling them.

Richard had to go to an M&T Bank branch near his home to arrange for wire transfers, which he refused to do until he had a notarized contract from Sousa, proving he would get the money back.

In the contract, Richard commits to transfer 22,000 Euros to a bank account designated by Samantha Smith, and that in return, he would receive 8% of the gross funds, or 144,000 Euros from the "Project Bank Account."

Richard produced bank statements that showed he had wired $25,000 (the equivalent at that time to 22,000 Euros) to "Delores R. Shawhan" based on the instructions he received from Attorney Sousa. Richard also transfered $26,624.37 from his pension account at Chase Bank to himself to cover that wire.

A second contract was for Richard to send Samantha $40,000, for which he would receive 1.5% of the gem sales, or 270,000 Euros (from the supposed sale of 1.8 Million Euros for the Tanzanite.) This $40,000 was also sent to Delores R. Shawhan. (Richard transferred himself another $41,514.37 from his Chase Bank retirement account to cover that wire.)

A third request came, promising him he would receive 455,000 Euros from the "total contract sum" if he would send $100,000. He did the wires, again to Delores R. Shawhan, and again moved funds from his Chase Pension account (this time $127,738.) Part of these funds, $30,000, were sent via wire to Baines Properties.

At one point, Attorney Sousa informed Richard that Samantha was imprisoned, and needed additional funds, again. When Richard pushed back, Sousa drew up a Power of Attorney and promised Richard that he would be given the ability to draw funds to repay himself directly from a Trust Fund that Samantha Smith's father had set up for her at Europa Off Shore Bank.

To cover these additional payments, Attorney Sousa modified their contract so that it now promised 9 40,000 Euros from the "total contract sum" if he would pay $166,000. [this analyst's understanding is that the $166,000 was cumulative, including previous payments sent.] Which he did. He sent an international wire transfer for $33,000 to "Charles Globe Teskitil Tecaret Sirketi Limited" which was who Attorney Sousa told him to send the funds to.

Later he received documents from Europa Off Shore Bank via email proving that the funds were really available and providing him a PIN that he could use to confirm this himself. When he logged in to the Europa Off Shore Bank, he could see that more than $9 million were in the balance of the account but there wasn't a way that he could find to transfer any of the funds to himself.

When he contacted Europa Off Shore Bank's Customer Support via email, he was told that he could not withdraw the funds because there were fees that had to be paid first. Dormant Account Fees totaling $88,950, Reactivation Fees totaling $52,000, and a Tracking Code fee of $45.

To help cover these fees, he sent a cashier's check in the amount of $42,500 which the Europa Off Shore Bank had agreed would be enough to allow them to open the account. After receiving the check, Europa Off Shore Bank informed him that there were still issues which must be resolved in person, and that he needed to fly to Amsterdam to do so.

To wrap up Richard's testimony ... he made six payments, totaling $205,500, which he says he would not have made had he known the gem mining project did not exist and that there was no Europa Off Shore Bank.

(The next witness is a Financial Crimes Examiner, Thomas Michael Trusty, from JP Morgan Chase ... who testifies about deposits being made to Mr. Lawal's account that he was asked by Bank of America to review)

Frank from California

This story may sound rather familiar. Frank is a 75-year old man from California. He and his wife separated after 33 years in 2017. In 2020, Frank made a profile on Silver Singles and was approached by a woman who wanted to develop a relationship with him. Samantha Hope Smith was a gemologist from New Zealand. Her moniker on the site was "Pretty Gorgeous" and they met on the platform in March 2020, but she quickly asked to move their conversation off the dating website. She claimed that unseemly individuals were contacting her on Silver Singles and that she was canceling her subscription but wanted to stay in touch with him.

Samantha was from New Zealand. In one of her first emails she explains:

"I have a mixed upbringing, my papa is from Florida, and my mom is from New Zealand. I was born in Florida. In my teen years, we lived in New Zealand. We lived in the best side of town, a nice house in Wellington by the lake. I grew up with mountains, creeks, hills, and basically nature at its finest."

She would later send a copy of her Florida drivers license to Frank.

For 16 days, from March 8, 2020 until March 24, 2020, they had "long very emotional sort of conversations telling each other about ourselves, trying to find common ground, and many of the emails were very, very lengthy." He was romantically interested in her.

Frank says that Samantha was in Istanbul, Turkey where she was mining Zultanite. But it turns out, she needed a Zultanite gemstone certificate from the Turkish government, and they were expensive. It was going to cost $316,500 to process the certificate.

About the same time, Samantha decided to fly to Reno and sent her itinerary to Frank. He was supposed to meet her there at the airport.

Turns out Samantha the Zultanite miner had something else in common with Samantha the Tanzanite miner. She had an online bank account that she wanted Frank to access for her. "AffinityAllied[.]com" with the account number 1867364926. She had $2 million in the account and needed Frank to send her $300,000 from that account to help cover the Gem Certificate.

There were other asks for funds as well. The court read into evidence this email from Samantha to Frank:

"Good morning, Frank. I had a restless night. I wish you were around to make me feel much better. I appreciate your concerns and your suggestions yesterday towards me, and I can't wait to be back home and get to know more about you. Loan or no loan, I still want to meet and be with you. I understand you not being comfortable in loaning me over $16,000 when you haven't met personally, I may not feel the same way too, but I think I would help if I were to be in your shoes. I want you to know that this project means a lot to me, as I have invested so much of my money and time. I am almost done before this happened. I did plan for extra expenses, I have to utilize the money I was meant to use to pay for the fee in the past, due to extra expenses, that is why I asked you to help me transfer money from my account, again thanks for helping me out. I still have about 5,000 in my balance as you know."

He decided to send her the money. He received "very specific instructions" to send the money to Samantha's relative who had an account at Huntington National Bank in the name "Luxe Logistics Transportation LLC."

He wired the money from his Charles Schwab account. Before the transfer was made an employee of Charles Schwab called him and "her last words to me," Frank says, were "are you sure you know these people do you really want to send this in that there are a lot of fraudulent schemes out there." Frank says the second he got off the phone with the Schwab agent, he was on the Internet looking for Luxe Logistics and he found them in Los Angeles.

About this time, Frank received an email from Samantha informing him that she had her Zultanite professionally appraised and that it was valued at $17,650,000.

But Frank had already determined that Luxe Logistics was a fraud and he cut off communications. He made five phone calls to Charles Schwab that same night and was able to get the wire stopped.