BEC Scammers Adventures on the Run

 Last week the case of Valentine FOMBE was finally brought to a close. FOMBE was sentenced to 144 months in Federal prison and ordered to pay $325,856 in restitution to victims of Business Email Compromise scams that he conducted from 2016 to 2018.  The various court documents present nearly as many puzzles as the sentence answers. Chief among them, what happened to the co-conspirators? and why have they not also been sentenced? 

The indictment against FOMBE, OWOLABI, and ADEOYE demonstrates that they conducted Business Email Compromise #BEC scams against businesses in California, Tennessee, Michigan, Hawaii, Illinois, and California, as well as Check fraud against the Home Equity Line of Credit #HLOC accounts of some residents of Florida, Hawaii, and California.

The scams ran from 2016 until 2019 using many shell accounts established by FOMBE and his crew. FOMBE is from Cameroon and came to the US in 2013. In May 2016 he began conspiring with Bernadette ATTIA and Gbenga OWOLABI to conduct BEC scams. Homeland Security Investigations stated that the attempted losses were $2,036,064 from at least 22 victims and actual losses were $547,310.23 to 11 victim individuals and businesses, with many other identity theft victims.

The indicment and assorted court documents are full of communications between the parties such as this one, where an unnamed co-conspirator and FOMBE discuss opening a new PayPal account and a "Sunny" (which is a SunTrust bank account.) 

OWOLABI shares an invoice for $49,671.90 via Whatsapp and receives directions for how to wire the funds to an account in the name JBS Holding at Woodforest bank. Another JBS Holding account was at SunTrust and received $86,116.51 from another BEC victim. 

ADEOYE is listed in the indictment as having opened a mailbox at a store in Lutherville, Maryland in the name of one of the Ohio BEC victim companies, and on the same day, opening a Bank of America business checking account in the company's name.  ADEOYE sent those details to OWOLABI via WhatsApp and one week later a $96,000 check from one of the victims was deposited into the account. He did the same for Ohio Company 2, and that BofA account soon received a $57,000 wire from another victim and later $50,500 from yet another victim. 

The shell companies created by FOMBE and his crew included:

• ABC Auto & Credit Solutions - $80,450.89 intended loss - $15,801.18 actual
  (bank accounts at Capital One and SunTrust)
• Stars S. Peoples Republik LLC - $262,580 intended loss - $$9,257.34 actual 
  (bank accounts at SunTrust) 
• Swift Transfer LLC - $248,400.62 intended loss - $98,555.16 actual 
  (bank accounts at BB&T and SunTrust) 
• Best Alter Solutions - $8,034.86 actual loss 
  (bank accounts at PNC Bank and TD Bank) 
• Bianka Ventures - $128,765 actual loss 
  (bank accounts at SunTrust)
• Xena Ventures - $290,662.27 intended loss ( $0 actual as funds recovered) 
  (bank accounts at SunTrust) 
• Mbi Fuo B. Attia - $66,019 intended loss - $50,000 actual loss 
  (bank accounts at SunTrust)
• JBS Holding LLC - $417,752.36 intended loss - $81,151.47 actual 
  (Bank accounts at Woodforest National Bank and SunTrust) 
• Vincent's Mass Gutters - $386,100 intended loss - $90,745.22 actual 
  (bank accounts t Bank of America) 
• PSP Holdings - $130,750 intended loss - $65,000 actual 
  (bank accounts at SunTrust)

(BEC intended losses - many wires were reversed/recovered - actual losses $490,559.19)

    

(Check fraud intended losses - Actual losses was $56,751.04)

The total actual losses for the case were $547,310.23, of which FOMBE would be held responsible for $325,856 in his eventual sentencing. 

FOMBE: A Bad Place To Park

The case actually started when FOMBE was stopped by the U.S. Park Police while idling along the BWI highway in a car with Texas Buyer temporary plates that were altered. FOMBE had 18 credit and debit cards in a variety of names, as well as driver's licenses with his photo and two other names (Mark Johnson and William Adewale). This led to Attia's apartment being searched, who was also found to have documents and cards in other names, including a fake passport with her photo and another's name. 

There was prior history, however. In the government's sentencing memo they describe it as "The Defendant's fraudulent conduct did not stop with this wire fraud and money laundering conspiracy. Every ounce of the Defendant's existence was fraudulent." 

While FOMBE was living in the Arbors at Arundel Preserve, his landlord accused him of fraud and terminated his lease.  He had claimed to have a $6,000 monthly income from ABC Auto & Credit Solutions, which was false, and paid his rent with credit cards that were not in his name. He abandoned the property leaving behind two fake ids and ten bank cards all in the names of others, as well as bank statements for numerous accounts related to his fraud. 

After purchasing a Porsche for $40,000 with ill-gotten funds, he traveled to North Carolina and rented a car where he staged an accident to try to total the Porsche and claim insurance. He was charged with insurance fraud in North Carolina.

While living at Avalon Russett apartment in Laurel, Maryland, FOMBE was again going to be evicted and again abandoned the property, this time leaving behind 50 blank credit cards, two mag-stripe readers and a credit card writing machine. The land lord also found multiple credit cards in the names of people not on the lease. 

 On 25SEP2019, when the police came to execute a warrant at FOMBE's house, his wife, Ossele Massaba, texted him "the police here" and he fled the country. When Fombe's wife was returning to the US in May 2022, her phone was searched and was found to have a photo of Fombe on a Honduran passport in the name "Rosnell Eduardo Martinez Garcia." This was used to find that "Rosnell Garcia" was living in the UK, where he was arrested 06AUG2022.

During that time abroad, FOMBE lived in Mexico, Honduras, and the UK, and conducted an additional $1.7 Million in fraud against the US Government through an Unemployment Insurance scam. He sent instructions and identities to Massaba, who filed 88 claims in Maryland using the email Email6543@yahoo.com and received $535,172 in UI benefits. They filed an additional 108 claims using Mail9850@yahoo.com. Altogether, Maryland paid them $1,708,256.  (These fraud filings are not part of the current case.)

Zack Abolaji Adeoye

Zack Adeoye was already known to Maryland police before this case came up. 

In March 2019, the local newspaper "Trib Live" shared the headline "Maryland man arrested in Hempfield in $112k computer sting." According to that article, Adeoye, "a native of Nigeria who now lives in Upper Marlboro, MD" went to a FedEx facility to pick up a shipment of 28 MacBook Pro laptops valued at $112,454.  He was arrested and held in the Westmoreland County Prison after failing to post $100,000 bail. Undercover state troopers had been tipped off that Adeoye had set up a bogus line of credit claiming to be the CFO of an Illionois firm that had ordered the laptops. He had already successfully gotten away with 30 laptops, but undercover agents were in place when he went to pick up the second shipment. Adeoye entered the facility by showing a fake FedEx employee badge. State Trooper spokesperson Steven Papuga told the Trib that Adeoye had a previous record for Identity Theft in the state. 

ADEOYE first appeared in court related to the current case on 11OCT2019 and was released on 15OCT2019 with electronic monitoring and an order not to use the Internet and that all Internet-capable devices must be removed from the home. He was arraigned on 12NOV2019 and entered a NOT GUILTY plea. His conditions of release were modified to allow him to leave the home for religious services.

On 02OCT2020 "superseding information" was filed by the court detailing more actions of his crimes and he changed his plea to Guilty.  He was scheduled to be sentenced on 21MAY2021. And 19JAN2022. And 19APR2022. And 02DEC2022. As of this writing, he has not been sentenced. 

Just after his guilty plea, a photo of ADEOYE was posted greeting him on his 50th birthday using his full name, Abdulrasak (from which, Zack) Adeoye "Zacophonic" and praising him for his "fatherly role on your brothers."  

Even after his guilty plea, Zack continued in business, creating a new corporation, "Zacophonic Home Inc" on 12JUL2022 using his Upper Marlboro, MD address. 

The Tragedy of GBENGA OWOLABI

The third party in this case, Gbenga Owolabi, barely appears in the court record after the indictment.  There is no record of him appearing in court or having been arraigned.  On 18NOV2019, the court mentions that some $13,055 in U.S. currency was seized from his apartment at 1624 Bluestone Street, Apartment E, in Hanover, Maryland following a search conducted on 25SEP2019. 

As is often the case, it is difficult to tell what occurred when Owolabi fled to Nigeria. 

According to local media OWOLABI had moved to Canada where he studied Information Systems at Humber College in Toronto.  He later moved to Maryland where he worked as a Financial Analyst for Alpharma Inc before moving to Cyhosting Corporation, which he founded in May 2000. He also ran Tanatek Inc, a website design company, and according to the Nigerian press, served as its CEO until his death.

A profile of Olugbenga Owolabi ran in Neusroom in his hometown.

In 2016, OWOLABI started building a hotel called Tana Suites in Abaa, Oyo State, Nigeria, which was completed and opened in December 2021.  He returned to Nigeria on 20JUL2022 and when he arrived at his hotel on 28JUL2022, he and a 21-year old female employee were kidnapped. There were two other abductions close in time to this date.  On 16JUL2022, a farm supervisor, Christopher Bakare was kidnapped and released after paying a ₦5 million ransom, then 22JUL2022, the owner of Titilayo Hospital was abducted and released on 26JUL2022 after also paying a ransom. 

OWOLABI's brother led the negotiations and eventually raised ₦5m ransom, although the kidnappers were demanding ₦50m ransom, believing OWOLABI to be a wealthy American. 
As a sign of how the Nigerian economy has crashed recently, 50 Million Naira in August of 2022 would have been $120,000 USD.  Today it would be $36,000.

The Alabaa of Abaa (a local tribal authority) found a volunteer to deliver the ransom on motorcycle. When he arrived, the gunmen killed the driver as well as Gbenga Owolabi and his hotel emplooyee Racheal Opadele.  The autopsy showed that Owolabi had been extensively tortured before being killed. 

The U.S. government received permission to attend the autopsy at LAUTECH Teaching Hospital and identify the body, and escorted the body back to Maryland for burial, where it was first also re-identified at the Delaware State Military Hospital.

Olugbenga David OWOLABI was kidnapped on 28JUL2022 and killed 02AUG2022. While the Nigerian police originally charged his brother, Femi Owolabi, with the kidnapping and murder, who confessed to the deed.  Later, the family helped him to recant of his confession, and the crime has instead been assigned to "Fulani herdsman" - a favorite boogie man of Nigerian culture. 

Maryland Busts $9.5 Million #BEC Money Laundering Ring

 

Three indictments have been unsealed in Maryland that document an extensive network of shell companies that were used to wash at least $9.5 Million in funds from at least fifteen #BEC (Business Email Compromise) cases across the country.  

In the first indictment, those charged (with an example address from their respective shell companies): 

• Adanegbe Gift Osemwenkhae - 8304 DEBORAH ST, CLINTON, MD 20735 (this property is listed as owned by Kat Osemwenkhae, who uses the email  kateivie@yahoo. Adanegbe is also listed as  controlling "Ivie LLC"  from the same address.) 
• Faizou Gnora - 12825 LOCBURY CIR, #B, GERMANTOWN, MD 20874
• Emily Gil Arias - 4107 DAHILL RD, SILVER SPRING, MD 20906
• Fatoumata Boiro - 16202 PENTERRA WAY, BOWIE, MD 20716
• Lawrence Ogunsanwo - 308 WILLOW HILL PLACE, HYATTSVILLE, MD 20785
• Lakeisha Parker - 2044 NORTH BENTALOU ST, BALTIMORE, MD 21216
• Martin Ogisi - 8405 CHEVY CHASE LAKE TERR, 701 CHEVY CHASE, MD 20815
• Blondel Ndjouandjouaka-* - 3323 TEAGARDEN CIRCLE, APT. 202, SILVER SPRING, MD 20904
• Kevin Colon - 8714 HAYSHED LANE, APT 302, COLUMBIA, MD 21045
• Lorena Perez Herrera - 9466 GEORGIA AVE #1277, SILVER SPRING, MD 20910

* - Blondel is my favorite of this gang, claiming both Computer Science and Criminal Justice degrees and claiming to work in Cybersecurity including as a Phishing Analyst. 

• Yahya Sowe - 1012 Good Hope Dr, Silver Spring, MD 20905
• Victor Killen - 28 Capricorn Ct, Derwood, MD 20855
• Areal El-Lovieta Harris - 29219 Middleham Ct, Hanover, MD 21076 
• Gedeon Agbeyome - 25 years old, also mentioned in the case, was arrested in 2020 possessing a credit card skimmer and many cards. Like several others in the case, he studied Computer Science at Montgomery College, Maryland. He was also arrested in Alabama in April 2023) 

We didn't see the alias "Papa Kwam" in use, but his Facebook account is in the name "Don Kwame." 

All three cases make reference to one another, with the exception that Gedeon's 2-page indictment for Aggravated Identity Theft is stand-alone.  While he is not named as a defendant in case #2, he is referred to throughout that case.

Victim Organizations  (many/most are Business Email Compromise)

a) an environmental Trust 

b) an urban redevelopment program 

c) a Medical Center 

d) a transportation company 

e) an apartment complex company 

f) a K-12 school district in Montana

g) a private liberal arts college 

h) the Delaware River & Bay Authority 

i) a Colorado real estate agency 

j) Larimer County, Colorado 

k) an RV dealership 

l) a health care center with 17 locations 

m) a real estate / property management firm 

n) a real estate company in Texas 

o) Vigo County, Indiana 

The indictment makes clear that the defendants' Shell Companies DID NOT:

- have physical operations

- have business premises 

- engage in legitimate business activities 

- earn gross revenues

- incur cost of goods sold 

- incur administrative expenses associated with business operations 

- report wages for employees to the State of Maryland 

- have significant numbers of employees 

A little hint for those who screen business accounts.  If one runs an Automobile Dealership from a residential neighborhood and has never purchased a car and has no employees, it is unlikely to be a thriving business that you would want to bank! 

The Shell companies listed in the indictments include: 

Gifted LLC; Blue Skye Realty; Faiz Automobiles LLC; First Realty Management LLC; FB Morgan LLC; Smart Logistics LLC; Parker Transports LLC; Blaxstone Enterprises LLC; Satisfied Health Care LLC; KC All Pro HVAC Service LLC; Colon Enterprise LLC; Lorena Perez Herrerra LLC; YS Estate and Properties; Victor's Trucking and Pull LLC; Vieta Collection; The Justin Company LLC; [ID-theft victim] Company LLC

That list of companies is not the full extent of the shell corporations operated by the accused.  As an example, Faizou Gnora had many businesses: 

- First Realty Management LLC, 12825 Locbury Cir, #B, Germantown, MD 20874 

- Faiz Express Trucking LLC, 369 W. Side Dr, 102, Gaithersburg, MD 20878 

- Gnora Capital LLC, 6800 Wisconsin Ave #1086, Chevy Chase, MD 20815 

- Premier Strength Training LLC, 12825 Locbury Cir, Apt B, Germantown, MD 20874 

- Faiz Automobiles  LLC,  12825 Locbury Cir, Suite B, Germantown, MD 20874

- Faiz Express Trucking LLC, 225 S Whiting St Apt 307, Alexandria, VA 22304-7132 

Her "Faiz Express Trucking" company is listed with the Department of Transportation, which gives the Alexandria address for the company, but notes Faizou's Gathersburg address for the point of contact. 

 

The companies listed in the indictment had the following accounts use for money laundering:  

Bank of America - 3 accounts

Capital One Bank - 6 accounts 

Citibank - 6 accounts 

JPMorgan Chase - 3 accounts 

PNC Bank - 7 accounts 

M&T Bank Corporation - 2 accounts 

Navy Federal Credit Union - 2 accounts 

SunTrust/Truist - 6 accounts 

Wells Fargo - 5 accounts 

Woodforest Bank - 6 accounts 

As a further example of how tightly connected these cases are, all of the bank accounts listed in the second indictment are also found in the first indictment.  Based on the charges in the two indictments, between 17NOV2020 and 21OCT2022, the crew moved at least $7.2 Million between their shell companies as described below. 

The big unanswered question to me is - THEN WHERE DID THE MONEY GO?  Based on the seizures, very few of the funds were still in the possession of the laundering crew.  So who recruited them?  And where did the funds go when they left their control?  We MUST keep pulling the string and find out! 

I was curious why DCIS was one of the investigating agencies here.   The DOJ Press release says that: "As a result of a law enforcement operation on February 7, 2024, 10 defendants were arrested at locations throughout Maryland and three search warrants were executed related to an alleged money laundering conspiracy involving more than $9.5 million in proceeds from fraud schemes. Law enforcement agents from the Homeland Security Investigations Mid-Atlantic El-Dorado Task Force, the Environmental Protection Agency Office of Inspector General, IRS Criminal Investigation, and the Defense Criminal Investigative Service participated in yesterday’s searches and arrests. Additional defendants are currently fugitives."

The only person among the defendants that I see is military so far is Areal Harris: 

Identification Documents: an Obsolete Fraud Countermeasure

When I'm talking to bankers and other fraud fighters, I often mention how easy it is for a criminal to obtain a Drivers License bearing any information they desire. I was reminded of this again as I saw the sentencing of Desmond Nkwenya from Brookhaven, Georgia this week. The DOJ press release from the Eastern District of Virginia released 09FEB2024 was entitled "Four Members of Bank Fraud Ring Sentenced." When I read the press release, my eyes went immediately to Desmond Nkwenya, because I was already familiar with that name from a larger case in the Northern District of Georgia that had been announced as "10 charged in business email compromise and money laundering schemes targeting Medicare, Medicaid, and others."

When VoyageATL magazine interviewed Desmond Nkwenya the story was about the young man from Cameroon who was making it in Atlanta under his recording label "Danyvails Entertainment." But since 2016, Nkwenya had actually been making it under another business: Creating counterfeit driver's licenses to enable a multitude of romance frauds and scams.

(photo from VoyageATL)

Anyone who is using the presentation of a Drivers License as a proof of identity theft needs to understand just how simple it is to purchase a D/L online with the photo, name, and address of the purchasers choosing.

In the new case, Brianna Mills, a 28-year old bank teller in Loganville, Georgia would pass bank information to her boyfriend Stanley Desirade, of Lanham, Maryland. Desirade would use the customer information to order drivers licenses from 37-year old Desmond Nkwenya. Desirade would then give the driver's licenses to Terrell Hale, of Rockville, Maryland, who had provided Desirade with photographs of his walk-in crew. At least 25 customers data was used to create at least 100 fake identification documents which were then used to steal $660,082 from the bank customers. They attempted also to steal an additional $1,008,134 but those additional transactions were denied. Desirade was sentenced to six years in prison on 29SEP2023. Mills got an 18 month sentence on 25AUG2023. Hale was sentenced to four years in prison on 21JUL2023.

On 09FEB2024, Nkwenya was sentenced to 30 months in prison, 3 years supervised release, and ordered to pay restitution in the amount of $325,080.

Nkwenya started advertising his ability to create counterfeit drivers licenses in or before 2016. Desirade actually found him through an ad he placed on Craigslist (using another alias.) Nkwenya was not only creating the counterfeit driver's licenses. He also was able to create Mastercard debit cards that appeared to have been issued by the abnk where Brianna Mills was employed.

That other case, which included defendants in South Carolina and Georgia, was related to stealing $4.7 million from Medicare, Medicaid, and private health insurers, and $6.4 million from private and individuals, in a variety of Business Email Compromise and Romance Scam scenarios. Desmond's primary role in this case was also to create identity documents to be used in a variety of frauds.

Desmond Anu Nkwenya of Brookehaven, Georgia was arrested in Texas on his first BEC/Fake ID case on 17NOV2022.In that earlier case, Nkwenya opened shell companies in Georgia in the names JBS Commercial LLC, Raissen Group LLC, and Danyvails Entertainment LLC. He then opened bank accounts at Bank of America, Wells Fargo Bank, PNC Bank using fake drivers licenses, including one in the name Jada Kingston and a Georgia Driver's License in the name Harold Ball. In one example BEC case, $2,328,842 was stolen from the victim by tricking them into send funds to the wrong accounts. $308,650 of those funds were deposited into one of Nkwenya's accounts at Wells Fargo, followed by an additional $57,000 on 01JUL2021 and another $25,000 on 12JUL2021. Desmond also caused his fake "Danyvails Entertainment" account to receive a PPP loan of $47,950 after claiming to have nine employees. He also received a $119,875 PPP loan for another company and their imaginary employees.

Biliamin Fagbewesa of South Carolina - used a stolen identity to open bank accounts in the name of his shell company, Matadam Medical Equipments, and receive $1.4 Million in proceeds from Medicaid. He had a Delaware driver's license with his likeness and a stolen identity's data which he used to open accounts at First Citizens, Truist, Wells Fargo, and TD Bank, and used those accounts to receive both Medicaid fraud funds, and Business Email Compromise funds.

Patrick Ndong-Bike of Atlanta, Georgia - used false Tennessee driver's licenses in the names and contact details of John Arino, Kendrick Odom, and Michael Pulliam, but bearing his image, to open shell companies and then bank accounts for those companies at Regions Bank, Bank of America, Wells Fargo Bank, JPMorgan Chase Bank, and Truist. He used these accounts to receive at least $2,400,000 from multiple Medicare fraud and Business Email Compromise fraud victims. These included a BEC scheme against a hospital in Ohio where a $754,136 Medicare payment was redirected to Ndong-Bike's accounts instead.

Cory Smith of Atlanta, Georgia - opened bank accounts using false identities and received and laundered at least $57,000 in funds from a BEC scheme against a private company.

Chisom Okonkwo of Atlanta, Georgia - received at least $830,000 in BEC fraud schemes, withdrawing at least $535,000 and laundering it through a variety of methods, as well as purchasing herself a luxury automobile with some of the funds. Okonkwo was sentenced on 24JAN2024 to 3 years in prison and ordered to pay $478,538 in restitution. She created alias identities in the names Patrician Young, Desirey Aguilar, Stacy Jack, Lisa Larkin, and Janice Peck, as well as stealing the identities of two real individuals from New Jersey and California and using false driver's licenses to access their accounts. In one case she provided the New Jersey victims name, date of birth, social security number, and a driver's license using her image but the victim's data, in order to purchase a $51,562 Mercedes Benz after acquiring credit in the name of her victim. She did the same with another identity theft victim, acquiring a lease at an the Roxboro in Georgia in the name of the California resident. She lived in the building using the stolen identity from 28NOV2020 through 23MAY2022 before abandoning the apartment owing $15,246 in back rent and fees. She created several shell companies, based in Lawrenceville, Georgia, including A[]Jewelry and Crystals, Young Interior Design, and Larkin Interior Innovation and opened bank account in the names of her aliases and companies at Truist, SunTrust, and Regions Bank. These accounts were used to receive the proceeds of multiple BEC victims, including an automative company in Texas whose payments were diverted to Okonkwo's accounts on three occasions for $268,868, $100,000, and $45,000. Okonkwo also applied for and received Economic Injury Disaster Loans from the Small Business Administration claiming that her company, Larkin Interior Innovation, had five employees and gross revenues of $150,000, none of which was true.

Olugbenga Abu of Atlanta, Georgia - used false identities including in the name "Kingsley Perete" to open bank accounts that received $95,000 in BEC fraud proceeds. Also received $341,000 in a real estate mortgage loan based on patently false information and forged documents, including false W-2 documents and false bank statements. Abu was sentenced to 24 months in prison and ordered to pay $105,500 in restitution.

Trion Thomas of Stone Mountain, Georgia - used false identities to open bank accounts which were used to received $93,000 in Medicare payments that were diverted in a BEC fraud scheme.

Malachi Mullings of Sandy Springs, Georgia - used false identities to create companies and open bank accounts which were used to receive and launder millions of dollars from BEC and Romance Scam programs, including BEC schemes against two state Medicaid programs. In one situation, a Romance Scam victim sent a $200,000 Cashier's Check to Mullings which was then used as part of the payment for a 2017 Ferrari 488 Spider which Mullings purchased in Atlanta. Another Romance Scam victim sent payments of $28,369, $12,000, $20,000, $15,000, $30,000, and $17,000 to Mullings.

Adewale Adesanya of Jonesboro, Georgia - used false identities, including a fake Nigerian passport in the name "Timi Graig" to open a shell company, Blue Springs, and then to open bank accounts at Bank of America, BBVA, JPMorgan Chase, Wells Fargo, Truist (then BB/T), Regions Bank, and Navy Federal Credit Union. These accounts were used to receive funds from BEC Scams, including scams against Medicaid and Medicare, as well as funds from Romance Scam victims. He was eventually sentenced to 48 months and ordered to pay $1,582,510 in restitution. He used some of these funds to purchase two Lexus LX 570s and a Mercedes GLE 350.

Sauveur Blanchard of Richmond, Virginia - used false identities to create multiple shell companies to receive funds stolen from Medicaid programs via BEC schemes. Mr. Blanchard was acquitted of all charged by Judge Robert Payne on 10AUG2023, and I can't wait to read the transcripts to understand why!