How The FBI Nailed Nigerian Influencer For BEC Fraud

Inside details into the FBI’s investigation of Abbas Ramon Olorunwa also known as HushPuppi were released in a 28-page affidavit signed by Special Agent Andrew Innocenti late last week.

The investigation reveals how the outsized Nigerian Instagram influencer conspired with other scammers all over the world to execute huge BEC attacks and redirecting hefty payments meant for organizations into private bank accounts in countries like Romania, Bulgaria, and United Arab Emirates.

Never underestimate the power of link analysis and good old fashioned investigative work to piece the puzzle together and that is exactly what the FBI did to link Hushpuppi to his many crimes.

He Financed His Opulent Lifestyle Through Fraudulent Wire Transfers and Money Laundering

While investigating, the FBI noted that HushPuppi’s social media account depicted a lavish lifestyle with many pictures of him posing in front of luxury cars and jets.

He financed that lifestyle, according to them by 2 schemes – engaging in fraudulent wire transfer scams called Business Email Compromise and Money Laundering activities.

Relying on data that they were able to analyze from a few iPhones that belonged to Hushpuppi, they were able to download communications between Hushpuppi and several other scammers involving fraudulent wire transfers.

This evidence helped them link him to the crimes that he is being accused of.

They Linked His Email to His Instagram Account

The FBI subpoenaed records from HushPuppi’s verified Instagram account to find out the phone numbers and the emails that they could associate to him.

When they received the information back, they were able to find his email and his phone number.

Email – [email protected]

Phone – +971502818689

This was important because both the email and phone were verified as real by Hushpuppi.

From this information, they were also able to locate all of the IP addresses that he had used when he posted all his opulent photos all over the world.

They Then Broadened out And Linked Him Up To Other Accounts

Based on the records received from Instagram, they then broadened the net and started searches to his other accounts.

From there they located his Snapchat Account where he used the same email and a newly discovered phone number. Phone – +971502818689

And they were able to locate several Icloud accounts that he had setup from various Apple Devices (iPhones) that he had purchased. For several of those he used another email [email protected].

This helped them locate other emails and PII that HushPuppi had associated with his identity. [email protected] as well as his address 1706 Palazzo Versace, in Dubai, U.A.E

They Then Linked His Email, IP and Phones To BEC Fraud Cases

After locating all this information, it was good old fashioned detective work that helped them link HushPuppi to multiple cases of Business Email Compromise and money laundering.

They linked his [email protected] account to many communications and fraudulent wire transfers. They linked other phone numbers he used and his iCloud account to other illicit transactions as well.

  • They linked one of his phone numbers +971543777711 to solicitation of money mules that were tasked with receiving the illicit wire transfer funds and assisting in money laundering.
  • In February 2018 then linked two communications about 2 fraudulent wire transfers for $250,000 and $2,397,000
  • In October 2019, they linked his same email to a fraudulent transfer for $922,857 and another fraudulent transfer for $396,050 from CIBC.
  • They linked his email to money laundering of $14.7 Million to 2 seperate EU bank accounts for $5 Million each.

During the investigation and analysis of emails, they also picked up on other communications that linked his nefarious deeds to the crimes.

Money laundering communications

“On February 10, 2019, co-conspirator 1 told Abbas, “Brother, tonight is my deadline to submit anything more,” and then asked, “Do u want add one more or just stick to that one u gave me ?” The next day, Abbas responded and provided account information for another bank account in Bulgaria.

BEC Fraud Communications

“In addition to participating in those fraudulent schemes, Abbas and co-conspirator 1 discussed additional BEC frauds and or other fraudulent schemes in 2019. These included schemes where Abbas and co-conspirator 1 sought to fraudulently obtain millions and at times hundreds of millions of U.S. dollars and UK pounds sterling.

“On March 10, 2019, co-conspirator 1 requested a bank account in the U.A.E. from Abbas into which approximately $5m could be deposited from a victim in the United States. Co-conspirator 1 told Abbas that the “job” would be “Monday am USA time,” and after some discussion, wrote, “Brother, I need it now or we will lose our chance pls”.

“Abbas responded by providing bank account information for an account at Commercial Bank International in Dubai, U.A.E.

“On April 30, 2019, co-conspirator 1 told Abbas, “Brother, I have 4 companies in the UK ready to switch bank accounts on file but the account has to be open beneficiary”.

“After some discussion, co-conspirator 1 further stated, “I have a room working for me, we have leads and company contracts. My guy are changing accounts on file for 100m contracts and there payment are once or twice a week 1-5m. I have four ready to switch up,” it was disclosed.

They Located His Passports and Other Documentation

The FBI affidavit also indicated that Hushpuppi may have tried to flee the country to avoid prosection.

He applied for various Nigerian passports and one from St Kitts and Nevis. He was able to get the passports because people that make significant investments in the Caribbean nation are given one.

It was the FBI’s belief that he was going to use these passports to escape justice for his crimes.

Frank McKenna is the Chief Fraud Strategist for PointPredictive and a Fraud Consultant based in San Diego California