Why do criminals need to launder money?
If you sell a lot of drugs on the street to make a lot of money, that money is vulnerable. It's vulnerable to getting stolen by your rivals. It's vulnerable to getting surveilled by the police. Money is innately suspicious.
Also, it's vulnerable to inflation—that's the other thing about having cash! Cash doesn't make any interest; it just sits there. So, you want to try and get that cash into some kind of financial institution. And of course, as soon as you turn up at the bank with a million dollars in cash, they can ask very awkward questions.
What exactly is 'smurfing?' And why might this old school money laundering method be a problem on social media apps?
With 'smurfing,' what you can do instead is divide it between 1,000 friends. You give them each $1,000 and they each deposit $1,000 into the bank. The bank probably won't ask any questions. These are fairly small amounts of money, but then you get your friends to send those small amounts into your account, and presto, you've got your million.
This is called smurfing, because of the cartoon with little blue characters. You know you're using an army of anonymous individuals.
What's caught people out, traditionally, with this smurfing is that most people don't have 1,000 friends. Creating a sort of army of smurfs, unless you're an incredibly gregarious and convincing person, is difficult. So, the reason you might use social media is you can put a post on Instagram or Snapchat and you can say, 'Hey, would anyone like quick buck? Give me your bank account details, and I'll transfer some money through, and I'll give you a share of it.'
Social [media] is a way of recruiting enough of those little characters to distribute the money and make sure the amounts are small enough that the bank's not going to get suspicious.
It seems tech innovators can unintentionally create fertile ground for money launderers.
Yeah, absolutely. In a lot of cases, technology unwittingly enables money laundering, and that's because tech and money laundering have strangely similar situations they want to create in the world.
If I'm a money launderer, I want somewhere there's lots of money sloshing around. I want loads of money so I can hide my criminal money in the noise. Second thing I want is an international [place to withdraw money]. I want to be able to put my criminal money in [a bank in] Los Angeles and withdraw it in London. And I want [the international place to have] no regulation. I do not want regulators and cops sniffing around.
And if you're going to set up a tech startup, what do you want? You want a marketplace where there's valuations all over the place, [like with] Uber and Airbnb. It's open market. You want areas that aren't regulated, because that's where you can set up my tech startup and can gain market share.
It's not that technologists want to enable money launders, it's just the two end up having a lot in common. And so, when [innovators] come up with new technology, it's at the cutting edge of finance, and money launderers look and think, 'Well, that's great, because the cutting edge of finance is where [there are no] cops because they struggle to keep up with that.'
In the case of Coin Ninja, a crypto company, employees had no idea that their boss was using his other crypto company, Helix, to help money launderers on the dark web. Do you think there are a lot of people who are accidentally working for money laundering outfits?
There will be a lot of people who are working for organizations that have a big problem with money laundering activity. It's not that [these companies] are set up solely for that activity. It's just that their bosses and the people who run and create these companies would rather look at the profit margin than look at the possible ways their services are being abused. Now, at a lower level, there'll be people who work in HR and marketing and [who handle] accounts who've got nothing to do with any of that. I don't know how far I shift culpability down toward those people.
In the case of Coin Ninja, I don't think any of the people in that company had any suspicion. There was no suspicion because Helix, the service previously set up by Coin Ninja's boss, was doing the laundering. I think those people are probably as innocent as it goes and certainly had a crazy day [when their boss was arrested].
You've written about romance scams where a criminal uses a fake identity to get people to trust them, enter into a fake online relationship of some sort and then steal from them. The FBI has reported over $650 million lost to such scams, with some of the most notable coming out of Nigeria, right?
This is a systemic financial predation on the U.S. and communities in Europe. The idea that this is a few people somewhere in Nigeria ripping off a few old people somewhere [is wrong], this is a systemic organized crime campaign that is draining wealth.
There are some I've seen interviewed in Nigeria who would say the international community has stolen from Nigeria. Wealth has been taken out of African countries like Nigeria by Western malpractice. And so, there's this idea that this is almost payback. I don't personally agree with that. But I find it an interesting point. Nonetheless, what you've got is a situation where there's a vast organized crime empire that is draining the bank accounts of people, a few tens of thousands [of dollars] at a time, and it's adding up to billions [globally].
Is there a fraudster out there who you'd most like to interview?
[Just recently] I sent what I think is my sixth or seventh letter to Ghaleb Alaumary, who ended up laundering millions for North Koreans in tandem with an Instagram influencer 'Hushpuppi.'
[Alaumary is in prison serving over 11 years.]
[Also,] the North Korean hackers he was working for are incredibly bright, gifted individuals. I really want to speak to a North Korean hacker because I think it would be such a fascinating conversation for them to have, because they can see our side.
Has reporting on money laundering and other cybercrimes—like massive hack heists—made you a target online? How careful are you with your own online info?
I'll check out people's email addresses and stuff. I probably do it at a bit of a higher level. But fundamentally, the things that I do are having my data backed up somewhere safe and being suspicious of messages—those two things everybody should be doing for themselves.
Because I've covered so many victims of hacking and cybercrime and so on, in a way, I'm at a bit of an advantage in that I know the kind of tactics that will be used: Phishing emails and messages on Facebook or WhatsApp where somebody comes to you with something urgent or there's something tempting.
Just receiving those messages isn't enough to get you into trouble. You have to interact with them, so you have to click on the link or open the attachment or give them your details or your password. So, as soon as any message arrives in my inbox, I'm innately suspicious. I get people emailing me saying, 'Would you like to do a talk for us at this conference immediately?' I'm not going to open any attachments or links that sent me, and I'm going to check them out before I interact with them.
