Online fraud, scams and money mules

Detective Park begins the third lesson by playing the class a recording. It is not Grace's call, which was never recorded, but a call made to a volunteer in a fraud prevention program who kept a scammer talking for eleven minutes. The caller is polite, then urgent, then hurt that he is not believed, then angry. He gives a name, a badge number and a court file number. He says the volunteer's grandson is crying in a holding cell. He tells her not to hang up and not to call anyone, because the line must stay open for the judge. When the volunteer says she will call her son first, the caller says that would put the grandson in more trouble. Linh Tran says it sounds rehearsed. Park says it is: the callers work from scripts, and the scripts are tested.

This lesson covers the frauds officers see most often, how they are built, and how the money moves afterwards. Understanding the mechanics matters for three reasons. It tells the officer what evidence to look for. It helps the officer explain to the victim what happened, which many victims badly need. And it shows where the scheme can be interrupted, which is often more valuable than an arrest.

How social engineering works

Most fraud is social engineering: manipulating people into acting against their own interests, rather than defeating technical security. The techniques are old and well studied. Fraudsters claim authority, posing as police, lawyers, bank staff, government agencies or technical support. They create urgency, so the victim has no time to think or check. They use emotion: fear for a grandchild, the excitement of a prize, love in a romance, or embarrassment. They isolate the victim, telling them to keep the matter secret, to stay on the line, or not to tell the bank the real reason for a withdrawal. And they ask for payment by methods that are fast and hard to reverse, such as wire transfers, gift cards, cash handed to a courier, or cryptocurrency.

Grace's case used every element. The grandson created emotion. The lawyer created authority. Bail had to be paid that afternoon. A supposed court order created secrecy. The money went by wire. Park tells the class that many victims, Grace included, feel they should have seen through it, and that the investigator's job includes telling them truthfully that these schemes are designed by professionals to overwhelm careful people.

Common frauds officers see

Desjardins and Park go through the frauds that make up most reports. Emergency or grandparent scams use a family member in trouble. Romance scams build a relationship over weeks or months on a dating site or social media, then ask for money for travel, medical care or a business emergency. Investment scams, now the largest category of losses, offer high returns from cryptocurrency, foreign currency trading or fake platforms that show growing balances until the victim tries to withdraw. A growing variant combines romance and investment: the scammer builds trust and then coaches the victim into investing on a fake platform.

Impersonation scams claim to be from a government agency, a bank's fraud department or police, telling the victim that their account is compromised or that they owe taxes or fines. Technical support scams use pop-up warnings or calls to persuade victims to give remote access to their computer. Merchandise and rental scams advertise goods or apartments that do not exist. Job scams offer easy work from home, and some of those jobs are money mule recruitment. Business email compromise targets organizations: an offender takes over or imitates an executive's or supplier's email account and redirects a payment to a different bank account. Phishing messages, by email or text, try to steal passwords or card details, often as the first step of a larger fraud.

Technology that supports the scams

Several technologies show up repeatedly. Caller ID spoofing lets a caller display any number, including a local number or the real number of a bank or police service. A displayed number is therefore not evidence of who called; the call records held by the phone company may show the true route the call took into the network, which can sometimes be traced back toward its source. Voice over internet protocol services let call centers abroad make calls that appear to come from local exchanges.

Artificial intelligence tools can now clone a voice from a short recording, such as a video posted online, and generate convincing speech. Park says that in some recent grandparent scams the 'grandchild' sounded exactly like the real one. In Grace's case there was no way to know: she said the voice sounded upset and blurry, and the caller quickly handed over to the 'lawyer'. Fraud prevention advice has adapted, recommending that families agree on a code word and always hang up and call back on a known number. Generative tools also produce polished phishing messages and fake websites at scale, removing the spelling mistakes that used to give scams away.

How the money moves

Following the money is often the most productive line of investigation, because banks and payment services keep good records and must report suspicious activity. Fraudsters therefore try to move money quickly through several layers before investigators can act. The typical pattern has three stages. First, the victim's money lands in an account or wallet controlled by the network, often a money mule account. Second, it is split and moved on, to other accounts, to cash withdrawals, to cryptocurrency, or abroad. Third, it reaches the organizers, often converted into assets or mixed with legitimate business income.

A money mule is someone who receives and moves the proceeds of crime for others. Some are fully knowing participants paid a commission. Many are recruited through fake job offers for 'payment processing agents' or 'financial assistants', or through romance scams, and may not at first realize what they are doing. Some are students or newcomers who sell access to their bank accounts. Others are themselves victims whose identities were stolen to open accounts. Grace's two wires went to a business account at a bank outside the country, opened a few weeks earlier with forged incorporation documents. Within hours the money was split into smaller transfers to accounts in two more countries. The account holders were never identified, which is why the victimology course found no prosecution connected to her loss.

# Following one wire through a layering pattern (amounts in dollars)
wire = 9200
first_hop = {"account A": 4600, "account B": 3000, "cash withdrawal": 1600}
second_hop = {"account A": {"crypto exchange": 4400, "fee kept": 200},
              "account B": {"account C abroad": 2850, "fee kept": 150}}
assert sum(first_hop.values()) == wire
traced, fees = 0, 0
for acct, out in second_hop.items():
    for dest, amt in out.items():
        if dest == "fee kept":
            fees += amt
        else:
            traced += amt
            print(f"{acct} -> {dest}: {amt}")
print("cash taken out early:", first_hop["cash withdrawal"])
print("kept by mule accounts as fees:", fees)
print("traced onward to the next layer:", traced)

account A -> crypto exchange: 4400
account B -> account C abroad: 2850
cash taken out early: 1600
kept by mule accounts as fees: 350
traced onward to the next layer: 7250

The example shows why speed matters. At the first hop, the whole 9,200 dollars sits in identifiable accounts and can often be frozen if the receiving bank is told quickly. At the second hop some has been withdrawn as cash, some kept as fees by mules, and most has moved to an exchange or another country. Every hop needs another request, often to another institution and sometimes another country. Banks in the United States can sometimes recall a wire if the receiving bank acts quickly, and the FBI's IC3 runs a Recovery Asset Team that works with banks to freeze funds in fresh wire frauds; police and prosecutors can also seek seizure warrants for proceeds of crime. After a few days, recovery becomes unlikely.

Cryptocurrency

Cryptocurrency appears in a growing share of frauds, both as the bait in investment scams and as the way money is moved. Victims may be told to deposit cash into a cryptocurrency ATM, to buy coins on an exchange and send them to an address, or to install a fake trading app. Cryptocurrency is often described as anonymous, but most major cryptocurrencies are better described as pseudonymous. Every transaction is recorded permanently on a public ledger called a blockchain, showing the addresses involved and the amounts. What the ledger does not show is who controls each address. Investigators use blockchain analysis tools to follow funds from address to address and to spot when they reach an exchange. Regulated exchanges must verify their customers' identity, so a legal order to an exchange can link an address to a person. That is why fraudsters try to move funds through services designed to obscure the trail.

Park says the practical lesson for patrol officers is to record the details precisely. A victim's report that they 'sent bitcoin to the scammer' is not enough. The investigator needs the wallet address the victim sent to, the transaction identifier, the date and time, the amount, the exchange or ATM used and any receipts. These details let a specialist trace the funds months later. Getting a single character of a 34-character address wrong makes the trail impossible to follow.

Disrupting fraud

Because so many offenders are abroad, much of the value of police work in fraud lies in disruption and prevention rather than arrest. Freezing money at the first hop returns it to victims. Identifying and warning money mules, and closing their accounts, removes the pipes the network needs. Reporting spoofed numbers and fraudulent websites to phone companies and hosting providers gets them shut down. Arresting local couriers, as in Mercer's case, removes the network's ability to collect cash in that area for a time and can produce phones and messages that identify others. Public warnings, especially when they describe the current script, help families recognize the call before money is lost. Park's unit visited every bank branch in Port Ardent after Grace's case, and Mercer's teller was one of the people trained.