All it took was access to a lawyer’s email, and suddenly, almost $532,000 was in the wrong hands.
This business email compromise (BEC) scam began simply: A criminal in Los Angeles named Ochenetchouwe Adegor Ederaine, Jr. gained access to a real estate lawyer’s email and sent fake messages to a buyer, according to the U.S. Department of Justice. Soon after, the purchaser sent that six-figure payment to a bank account controlled by Ederaine — one of 23 he had set up at various California financial institutions using six different false identities.
He used this same kind of attack over and over between March 2016 and November 2017 before federal authorities caught up with him. The scheme worked for as long as it did because the criminal didn’t compromise just any email accounts — he carefully selected his targets to maximize his chances for success.