A gang of three men which ran a phishing scam worth an estimated £59m have been sentenced to a total of 21 years in jail after being caught red-handed with thousands of bank customers’ personal details, as well as tens of millions of email addresses.
In the case, brought by the Met Police Central e-Crime Unit (PCeU), the Serious Organised Crime Agency (Soca), and the US Secret Service, Romanians Inout Caraman and Adrian Iorgovean and Nigerian Sunday Godday Etu were traced to the UK, staying in a luxury hotel in London.
They were found to have servers containing details of 30,000 bank customers – 12,500 of which were in the UK. They also had 70 million customer email addresses to be used in phishing scams.
Their activities first came to light when intelligence sent to the PCeU revealed that 2,600 phishing pages that mimicked the web pages of banking websites had been set up to gather data from users based in the UK, US, China and Russia.
The PCeU then worked with counterparts from the US and France to secure the servers, which were based in the countries. The Financial Fraud Bureau said £59m worth of fraud targeting 12,500 UK victims had been prevented, and the figure would have been higher if details of international victims were taken into account.
At sentencing, Caraman seven years and two months and Iorgovean received five years and seven months for pleading guilty. Etu received eight years after pleading not guilty.
Investigating officer DI Jason Tunn, of the MPS PCeU, said the convictions were a notable success against the cyber gang: “These convictions have struck a major and decisive blow against this global cyber crime gang. Quite what they have managed to steal is yet to be determined but their conviction has prevented them from systematically defrauding thousands more bank customers across the world.
“This is by far the biggest case the PCeU has dealt with to date and is likely to be the biggest cyber phishing case so far in the UK.”
