Glossary term
Business email compromise (BEC)
Business email compromise (BEC) is a scam that targets businesses and individuals who make legitimate requests to transfer money.
Read more
Significant cyber incident
Operation reWired business email compromise sweep, Nigeria and international arrests, 2019
Operation reWired was a four-month sweep against business email compromise (BEC) schemes, announced by the US Department of Justice and the FBI on 10 September 2019.
In short
Operation reWired was a four-month sweep against business email compromise (BEC) schemes, announced by the US Department of Justice and the FBI on 10 September 2019. It led to 281 arrests, including 167 in Nigeria and 74 in the United States, and the seizure of nearly 3.7 million US dollars. The Justice Department said many of the criminal groups behind BEC scams originated in Nigeria and have spread worldwide.
What happened
On 10 September 2019 the Justice Department announced Operation reWired. It said the operation began in May 2019 and ran over four months. The Justice Department, Homeland Security, the Treasury, the Postal Inspection Service and the State Department took part, and the FBI said 39 of its 56 field offices joined.
The operation targeted BEC schemes. These are scams in which criminals intercept or hijack wire transfers from businesses and individuals, often by posing as a boss, a supplier or another trusted person. The Justice Department said the same criminal groups also target individuals such as real estate buyers and the elderly, and use romance and lottery scams.
The result was 281 arrests in the US and overseas. The release lists 167 in Nigeria, 18 in Turkey and 15 in Ghana, with further arrests in France, Italy, Japan, Kenya, Malaysia and the UK. The Justice Department said 74 arrests were in the US and 207 overseas. The Nigerian Economic and Financial Crimes Commission (EFCC) coordinated and carried out actions in Nigeria.
The release describes many BEC scams as the work of transnational criminal organizations that originated in Nigeria and have spread worldwide. It does not name one group and it does not say all 281 people were Nigerian. Charges are allegations until proven in court.
Timeline
-
2018
The FBI runs Operation WireWire, a similar effort that led to 74 arrests and the seizure of 2.4 million US dollars.
-
July 2018
The IC3 reports 12.5 billion US dollars in exposed BEC loss between October 2013 and May 2018.
-
May 2019
The coordinated enforcement action begins.
-
June 2019
Among the cases listed, an indictment is dated 18 June and arrests follow on 20 June in a money laundering case in Florida.
-
10 September 2019
The Justice Department and the FBI announce 281 arrests, 74 of them in the US and 167 in Nigeria.
-
10 September 2019
The IC3 publishes its alert on BEC as a 26 billion US dollar scam, with data to July 2019.
-
13 September 2019
FBI Houston reports 19 people charged in the Houston area, 12 of them arrested.
-
30 May 2022
INTERPOL reports a separate operation, Killer Bee, with three arrests in Nigeria for malware-enabled BEC fraud.
How the attack worked
Getting a foothold in email
The IC3 describes BEC as a scam in which the subject compromises legitimate business or personal email accounts through social engineering or computer intrusion. It reports that some companies received phishing emails with a spoofed email log-in page, which let the attacker collect staff credentials. The Justice Department adds that a BEC scam may not involve a real compromise at all.
Posing as a trusted person
The attacker impersonates a key employee or business partner. The FBI gave an example from an earlier case: two men working from the UK and Nigeria emailed a Connecticut company’s executive, appearing to be from the CEO, whose email account had been spoofed. The company sent several wire transfers totalling more than 500,000 US dollars.
Moving the money
Funds go to accounts the criminals control. The Justice Department says money mules, who may be witting or unwitting, receive the money, keep a fraction and wire the rest on. Mules are recruited through romance and work-at-home scams. The IC3 says banks in China and Hong Kong stayed the main destinations, with more transfers to the UK, Mexico and Turkey.
Where it was caught
In the cases listed, banks froze about 3.6 million of a 5 million US dollar fraud, and the operation recovered or disrupted about 118 million dollars in wire transfers, according to the FBI.
- Phishing or spoofingAttackers get into an email account or spoof one, sometimes with a fake email log-in pageTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- ImpersonationThey pose as a CEO, employee or supplier and ask for a payment or a change of account details
- Wire transferThe victim company or person wires money to an account the criminals control
- Money mulesMules receive the funds, keep a share and pass the rest on, often abroad
- Police actionArrests, account freezes and asset seizures follow, as in Operation reWired
ATT&CK techniques
Who says who was behind it
Attributed by the US Department of Justice, 10 September 2019: many BEC scams are carried out by members of transnational criminal organizations that originated in Nigeria and have spread throughout the world.
Attributed by the FBI, 10 September 2019: arrests in the operation were made in Nigeria and several other countries.
No single group is named in the sources opened. The Justice Department release says some cases involved Nigeria-based schemes and also lists cases with money mules based in the US. The sources do not give the nationality of all 281 people arrested.
Impact
Arrests, as the Justice Department states them: 281 in total, 74 in the US and 207 overseas, including 167 in Nigeria, 18 in Turkey and 15 in Ghana.
Money: nearly 3.7 million US dollars seized (Justice Department). The FBI adds that the sweep disrupted and recovered about 118 million US dollars in fraudulent wire transfers.
Cases listed: one Nigeria-based scheme affected hundreds of victims in the US with losses above 10 million US dollars; another began with a 3.5 million US dollar transfer misdirected from a health care provider; a fraud of about 5 million US dollars from a community college and an energy company saw about 3.6 million frozen by banks.
Wider scale: the IC3 counted 166,349 BEC incidents and about 26.2 billion US dollars in exposed loss worldwide from June 2016 to July 2019. US victims reported about 10.1 billion from October 2013 to July 2019. The scam was reported in 177 countries. The IC3 reported nearly 1.3 billion dollars in loss in 2018 alone, nearly twice the year before.
Exposed loss includes actual and attempted loss. These figures are for BEC overall, not only for Nigeria-based actors.
Government and regulator response
- 10 September 2019: The Justice Department and the FBI announced Operation reWired and the 281 arrests. The Deputy Attorney General thanked partners including the EFCC for actions it coordinated and executed in Nigeria.
- 10 September 2019: The IC3 published an alert on BEC with advice: verify account changes through a second channel or two-factor authentication, check full email addresses, watch for misspelled domains, and contact the bank at once to recall funds.
- Before the operation: The Justice Department formed the BEC Counteraction Group to help US Attorney’s Offices coordinate BEC cases.
- 13 September 2019: FBI Houston said 19 people were charged in its area and 12 arrested, with local district attorneys handling state charges.
- Partners: Police in Ghana, Turkey, France, Italy, Japan, Malaysia, Kenya and the UK, including the National Crime Agency, gave significant assistance.
- 30 May 2022: In a later, separate case, INTERPOL reported that the EFCC arrested three suspects in Nigeria in Operation Killer Bee, which targeted malware-enabled BEC fraud.
Lessons
-
Verify payment changes on a second channel
The FBI case agent said to pick up the phone and verify before sending money. The IC3 advises a second channel for any change of account details.
-
Fraud networks cross borders, so does the response
Arrests in 10 countries and help from police in many more show that no single country could stop this alone.
-
Money mules are the weak link
The Justice Department says mules receive the funds and pass them on. Cutting off mule accounts and freezing quickly helps recovery.
-
Speed matters for recovery
Banks froze about 3.6 million of a 5 million US dollar fraud in one case. The IC3 tells victims to ask their bank for a recall at once.
-
Not every BEC case involves a hack
The Justice Department says some cases involve no real compromise of an email account. Training and process controls matter as much as technology.
-
Staff with payment power are the target
The release says targets are often employees with access to company finances. Treat them as a high-risk group.
What to check in your own organization
-
Callback rule
Do you require a phone call to a known number before changing bank details or paying a new account?
-
Two-person approval
Do large or unusual wire transfers need a second approver who did not receive the request?
-
Email authentication
Are look-alike domains and spoofed sender addresses flagged on inbound mail? The IC3 advises checking the full email address.
-
Mailbox sign-in alerts
Do you alert on new log-in locations, new forwarding rules and sign-ins that follow a fake log-in page?
-
Payroll change process
Are direct deposit change requests verified through a second channel? The IC3 reported 1,053 such complaints in 18 months.
-
Bank recall contact
Do finance staff know the bank contact and steps to request a recall of funds right away?
-
Reporting route
Does your team know how to report BEC to the national fraud reporting center, such as the IC3 in the US, and keep the evidence?
Where it happened
- Industry Financial services Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.
- Country Nigeria Nigeria is one of Africa's largest digital economies, and its own cyber agency says government websites have been defaced and hit by ransomware. Africa
Questions
What was Operation reWired?
A four-month US-led enforcement operation against business email compromise, announced on 10 September 2019. It led to 281 arrests, including 167 in Nigeria.
Did it only target people in Nigeria?
No. Arrests were made in the US (74), Nigeria (167), Turkey (18), Ghana (15) and in France, Italy, Japan, Kenya, Malaysia and the UK.
Which group was behind it?
No single group is named. The Justice Department said many BEC scams are run by transnational criminal organizations that originated in Nigeria and have spread worldwide.
How much money was recovered?
The Justice Department said nearly 3.7 million US dollars was seized. The FBI also said about 118 million dollars in fraudulent wire transfers was disrupted and recovered.
What is business email compromise?
A scam in which criminals use a compromised or spoofed email account to trick staff into sending money to accounts they control. It may not involve a real hack.
Was this the last action?
No. In May 2022 INTERPOL reported a separate operation, Killer Bee, with three arrests in Nigeria for BEC fraud that used malware.
Sources
- Justice Department release: 281 Arrested Worldwide in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes (10 September 2019, archived copy) US Department of Justice
- Operation reWired (10 September 2019, archived copy) Federal Bureau of Investigation
- Nineteen Charged in Houston Area as Part of International Operation Targeting Individuals in Business Email Compromise Schemes (13 September 2019, archived copy) FBI Houston
- Business Email Compromise: The $26 Billion Scam (10 September 2019) Internet Crime Complaint Center (FBI)
- Business E-mail Compromise: The 12 Billion Dollar Scam (12 July 2018) Internet Crime Complaint Center (FBI)
- Online scamming fraud: three Nigerians arrested in INTERPOL Operation Killer Bee (30 May 2022) INTERPOL
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.