Fraud Detection, Investigation, and Resolution: Finishing the Job Fraud and Terrorist Financing: the Growing Relationship

FRAUD DETECTION, INVESTIGATION, AND RESOLUTION: FINISHING THE JOB FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP

The international community has made the fight against terrorist financing a priority. Terrorists are increasingly using low value, high volume fraud activity to fund their activities, and the partnerships with organized crime are growing rapidly. This session will discuss the correlation between fraud and terrorist financing and the fraud methods that are being used to finance worldwide terrorist acts.

MALEKA ALI, CAMS Manager/Education & Consulting Banker’s Toolbox Los Angeles, CA

Maleka Ali has over 25 years of experience servicing the financial community. She joined Banker’s Toolbox in 2005, where she is currently the manager of Consulting and Education. Prior to joining Banker’s Toolbox, Maleka worked at several financial institutions in Southern California. Her experience includes operations/BSA management, fraud/risk control, product development, marketing, and training, along with participation in the creation of two new “denovo” financial institutions. She has also served on task forces for several mergers, acquisitions, and system conversions. She is CAMS certified and has developed and implemented BSA programs, along with comprehensive risk assessments, at several financial institutions. At Banker’s Toolbox, she has trained over 500 financial institutions on BSA/OFAC compliance and how to effectively manage BSA/fraud risk and utilize automated monitoring systems. Maleka was a faculty member on BSA/AML fraud at America’s Community Bankers’ National School of Banking in Connecticut, and has served as a guest speaker and workshop instructor at their national compliance conferences. She has also been a guest speaker at several national conferences, as well as many financial and corporate compliance organizations, addressing the subjects of BSA/AML/OFAC compliance, risk assessment management, fraud and, identity theft.

“Association of Certified Fraud Examiners,” “Certified Fraud Examiner,” “CFE,” “ACFE,” and the ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. The contents of this paper may not be transmitted, re-published, modified, reproduced, distributed, copied, or sold without the prior consent of the author.

©2012 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES Introduction The international community has made the fight against terrorist financing a priority. Terrorists are increasingly using low value, high volume fraud activity to fund their activities, and their partnerships with organized crime are growing rapidly. This session will discuss the correlation between fraud and terrorist financing and the fraud methods that are being used to finance world-wide terrorist acts.

After the death of bin Laden, there were big sighs of relief. ”We got him!”…”It’s finally over!” But, is it really over? There will probably be more attempts of terrorist activity on U.S. soil in our future. We have to be proactive instead of reactive.

In order to minimize the risk that your organization might be assisting terrorists in their goal of another successful attack, it is important to understand the problem and determine any due diligence that you might be able to implement.

Terrorist financing is not adequately understood and is extremely difficult to identify. The best chance that we will have to prevent terrorists from succeeding is to disrupt their ability to raise, move, and access money. Terrorists must have effective financial infrastructures, and they will require financial support in order to achieve their goals.

All financial institutions, regardless of size, location, and product offerings, are vulnerable to servicing individual criminals, groups of criminals, and criminal organizations, and are also equally vulnerable to facilitating terrorist financing.

The role of the back office (i.e., operations, compliance, and accounting) has expanded in the fight against money

23rd Annual ACFE Fraud Conference and Exhibition ©2012 1 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES laundering and terrorist financing. Financial industry professionals not only play an important role in defending against the threat posed by criminal enterprises, but also play a role in safeguarding us from terrorism.

An FBI assessment issued January 11, 2007, identified the following groups as threats to the United States:  Al-Qaeda  Groups aligned with al-Qaeda  Homegrown cells  Shia extremists  Palestinian terrorist groups  Domestic terrorist groups

Terrorist network groups currently still pose the biggest security threat to the United States. In the immediate aftermath of 9/11, the three primary terrorist networks were:  Al-Qaeda  Hezbollah  Hamas

The most widely known terrorist group is the al-Qaeda network. Their former leader, Osama bin Laden, who unlike other terrorist leaders did not come from the military, was not a religious figure or a spokesperson of the poor and oppressed. He was a rich man who built al- Qaeda’s financial system from a network originally designed to provide resources to the mujahedeen fighting the Russians in Afghanistan.

On May 1, 2011, Osama bin Laden was killed in a targeted attack. This obviously was one of the most significant counterterrorism operations in U.S. history since bin Laden had become the face of terrorism. There were many documents recovered during the attack, including five

23rd Annual ACFE Fraud Conference and Exhibition ©2012 2 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES computers, ten hard drives, and more than a 100 storage documents. A multi-agency task force reviewed the files retrieved, which assisted in the prompt warnings of plots against trains and other targets and triggered a small number of operations overseas, including arrests of suspects that were named or described in emails bin Laden received.

The files found on bin Laden’s computers described an organization that was weighed down by mounting financial hardships. They suggested using kidnapping as a fundraising tool and showed that bin Laden was directly involved in managing the finances for the organization. The files also highlighted his obsession of attacking the U.S. homeland and assassinating President Obama.

Al-Qaeda also uses the Internet as a tool for online recruiting, communication, and also as a means of using fraud to raise money for their activities.

Inspire is an English-language Internet magazine published by al-Qaeda that provides guidance in detail for planning and implementing terrorist attacks.

In its fourth issue, Anwar al-Awlaki, an al-Qaeda top spiritual advisor and recruiter, encouraged his followers to fund more attacks through crime by stealing from non- Muslims to fund their activity. Since then, both al-Awlaki and Inspire editor Samir Khan were killed in a drone missile attack on September 30, 2011.

Thanks to hard work and initiative over the last several years, the al-Qaeda network has been disrupted, but it hasn’t been destroyed. As long as terrorists retain access to a financial network, they remain a threat to the United States.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 3 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES Since 9/11, threats from other areas have become more evident. The threat has expanded to include regional terrorist groups, domestic terrorist groups, homegrown cells, and lone wolf threats.

Organized Crime and Terrorist Activities Funding for terrorist activities comes from monetary support from wealthy individuals or groups, charities, fraud, and the terrorist-organized crime nexus.

The partnership and links between organized crime and terrorism continues to grow. The DEA has linked 19 terrorist organizations to global drug trade, and believes up to 60 percent of terrorist organizations are also connected to illegal narcotics trade. As terrorist organizations become more involved in drug trade, hybrid organizations are emerging.  On December 16, 2009, three associates of al-Qaeda were arrested in Ghana as part of a DEA investigation. They were charged with conspiracy to commit acts of narco-terrorism and conspiracy to provide material support to a foreign terrorist organization.  Between September and December 2009, al-Qaeda associates conspired to assist drug dealers in transporting hundreds of kilograms of cocaine from West Africa through North Africa into Spain. Assurance was given that al-Qaeda would protect drug shipments.

Organized crime groups are incorporating characteristics and methods of operations from terrorist groups, and terrorist groups are adopting strategies learned from organized crime. This evolution makes both groups stronger, more flexible, and more dangerous.

Motivation Profit or greed Idealism

Goals Seek economic Seek political ends ends

Engage in Yes Yes Corruption

Structure May be network May be network and cell based and cell based

Geographies Require safe Require safe havens havens

Membership Needs to recruit Needs to recruit new members new members

Specialists Yes Yes

Group Identity Important Important

Threat of Yes Yes Violence

Target Selection Select targets that Select symbolic pose a threat to targets the group

Publicity Avoid public Seek public attention attention

Use Money Yes Yes Laundering as an Essential Operating Tool

Funding Capacity, Mechanism, and Cycle In order to understand how financial institutions fit into the overall scheme of a terrorist plot, it is important to

The Funding Capacity The funding capacity includes the source and availability of funds. They need to raise the funds necessary to accomplish their goals. They also need to have a means to launder that money, so they will have to effectively place and store that money in our financial systems. The funds then need to be available when they need them so that they can move the funds to where they need to be to support the various terrorist cells and to fund their operations.

The Funding Mechanism The funding mechanism might include a formal or informal financial system. The formal financial system is our network of banks and other financial institutions, and might even include money service businesses. Terrorists are obviously drawn to jurisdictions that have inadequate or limited bank supervision, anti-money laundering laws, and/or ineffective law enforcement, especially those with lots of bank privacy. Their informal systems will include charities and hawalas.

For years, charities have been an important source of funds for terrorists. Some of those whose donations go to terrorism know what the money will be used for; however, many others believe their money will help legitimate charitable organizations.

A hawala is a very old, underground banking system that allows money transfer without actual money movement or any wire transfer. There is really nothing essentially illegitimate about the hawala system, and it

An example of a hawala is as follows: A customer in one city will give their local hawaladar money that they want to send to a recipient. The local hawaladar then contacts his counterpart across the globe, who distributes money out of his own resources to the intended recipient. The two hawaladars will track among themselves who sent what, but because of the volume of transactions flowing through the system in both directions, the two hawaladars hardly ever have to worry about settlement.

The trust between the hawaladars, who often are related through family or ethnic associates, allows them to carry each other’s debts for long periods before finding a way to clear them.

The nature of the system leaves behind few, if any, written or electronic records for use by investigators trying to follow a money trail, thereby making it susceptible to abuse by terrorists and other criminals.

The Funding Cycle The funding cycle consists of the following steps:  Raise the money  Move the money  Store the money  Spend the money

This is a continuous cycle, and if we can interrupt any of the processes within the cycle, we also stand a good chance of shutting down the plot as well.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 7 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES We will concentrate below on moving and raising the money using criminal/fraudulent activities.

MOVING THE MONEY Terrorists will use drug-trafficking money laundering practices to move their funds that are more common among criminal organizations, such as cash smuggling, the black market peso exchange, and trade-based money laundering.

One of the oldest methods is smuggling. They will move funds via cash smuggling or even transfer assets into the form of precious metals and gemstones, which can easily and anonymously be transferred across borders, then be transferred back to cash across the globe.

To fully understand the complexity of the black market peso exchange, which law enforcement believes began in Colombia, you need to understand the parties involved, how they interact with each other, and how and why the exchange process began.

Drug sales in the United States generate enormous amounts of U.S. dollars, but Colombian drug cartels needed pesos in Colombia, not U.S. dollars. They needed to physically move the money back to Colombia and exchange the dollars for pesos. During the 1980s, the crooks would simply deposit the cash into U.S. banks and wire-transfer the money to Colombia. However, as U.S. investigators began to tighten up controls within the banks, the drug traffickers had to find other ways to move their money. So, the drug cartels started to use peso brokers for help.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 8 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES Peso brokers are informal bankers that have been used for years to get around government currency restrictions and import tariffs. Colombian businessmen and individuals who needed dollars would turn to a peso broker, who offered U.S. dollars and never asked for importation documents. With the use of peso brokers, goods could be smuggled into Colombia and heavy import tariffs were avoided.

Drug cartels funneled their huge amounts of U.S. dollars in the United States to these peso brokers, who in turn would sell them to Colombian businessmen. The brokers would send the dollars on behalf of the Columbian businessmen directly to pay for American goods. After the goods were sold for pesos in Colombia, the Colombian businessmen could pay the peso broker back for those dollars. The peso broker would take a heavy cut and transfer the rest of the pesos to the drug cartels.

According to the Financial Action Task Force (FATF), trade-based money laundering is the process of disguising proceeds of crime and moving value through the use of trade transactions to legitimize their illicit origins.

They will use false documentation which misrepresents the contents and/or volume of cargo, multiple invoicing, fabrication of shipments, and fresh-air invoicing (falsifying trade weights by overstating or understating quantity). Money is moved out of the United States by undervaluing exports and/or overvaluing imports. Money is moved into the United States by overvaluing exports and/or undervaluing imports.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 9 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES RAISING THE MONEY Terrorists will use many different criminal fraudulent activities to raise funds and spread terror. Bribery and corruption are accepted business practices. Criminal/fraudulent methods used include: basic fraud, drug trafficking, human trafficking/smuggling, counterfeit goods/currency, stolen goods, violent crimes, kidnapping, extortion, cyber fraud, and money laundering.

Their tools will include: Internet, credit/debit cards, prepaid cards, illegal money remitters, informal value transfer systems, shell companies, offshore havens, wire transfers, and other electronic mechanisms.

Law enforcement, regulators, and financial services professionals need to look ahead and identify and assess future trends, and develop mitigation to minimize their exploitation by crooks and terrorists.

New payment services are emerging in response to market demand from consumers and online businesses, and have also become favorite payment vehicles for online fraudsters and terrorists as well. New payment mechanisms include: online payment services, prepaid cards, credit/debit cards, gift cards, phone cards, mobile payments, online virtual world transactions, and digital currency exchange providers and dealers.

They might be transferred to/from an unknown third party, avoid border restrictions, and as transactions become mobile, transactions might be instantaneous.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 10 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES Prepaid cards may be loaded with money. Some are reloadable and can be easily transported to another place for money laundering, bulk cash smuggling, or even to support terrorism. Wallets are generally not checked for prepaid cards when moving across borders, so they become an easy method to bring money across an international border without detection.

If a terrorist cell wants to carry out an attack in the United States, a credit card obtained in Europe might be handed to another cell member traveling to the United States to execute an attack. Bringing a wad of cash into the country would violate cash reporting laws, but there is nothing illegal about carrying cards. Cards can even be mailed internationally.

Terrorists link cards to mobile phones, then wire money over a wireless network to fellow cell members in another country.

Terrorists have learned to use and manipulate the Internet and will use it to their advantage in areas from credit card fraud to raise funds, to money laundering to move and store funds.  Imam Samudra, the mastermind behind the Bali bombing, wrote a document while in prison encouraging the use of hacking to steal money electronically.  Ali Al Marr, an al-Qaeda facilitator for post 9/11 activity in the United States, was an expert at exploiting the Internet for fraud.  Younes Tsouli, a/k/a Irhabi, used email and radical websites for propaganda and

Stuart Levy, former Under Secretary for Terrorism and Financial Intelligence in the Treasury Department, said, “They [crooks and terrorists] are intelligent people, and they are going to be innovative, but it requires us to be innovative as well, because we now have to adjust our actions on all levels—law enforcement, regulation, and education in the private sector—to stay one step ahead.”

Case Studies Case Study One  Terrorist cell in UK used credit card info. stolen via phishing attacks and laundered through online gambling sites to finance website promoting martyrdom through terrorist violence.  Credit card info. was put on black market, which the terrorist cell used to establish a network of websites that enable communication among terrorists.  Sites also provided info. on topics such as computer hacking, bomb-making, and hosted videos of beheadings and suicide bombings in Iraq.  In 2007, three men, Waseem Mughal, Younis Tsouli, and Tariq al-Daour, were sentenced to jail for encouraging others to commit acts of terrorism.

Case Study Two  In what has been described as Australia’s largest homegrown terror case, credit cards played a part in a plot to blow up the Melbourne Cricket Grounds during the 2005 Australian Football League Grand Final.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 12 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES  Twelve men went on trial in April 2008, accused of plotting the act, which was thwarted by authorities.  One witness described how he purchased plane tickets and a mobile phone for the suspects using stolen credit card data. The witness said he bought the stolen card info. from taxi drivers for $10 each.

Case Study Three  In Columbus, Ohio, Somali native Nuradin Abdi told U.S. investigators that he provided stolen credit card numbers to a man accused of buying gear for al-Qaeda. Abdi collected the credit card numbers through his cell phone business.  The card information was then used by an acquaintance that was in the process of buying a laptop, GPS watch, laser range finder, and other equipment.  Abdi is accused of planning to blow up a Columbus, Ohio, area shopping mall along with other al-Qaeda operatives, including an admitted member of the terror group Iyman Faris, currently imprisoned for a scheme to sabotage the Brooklyn Bridge. Abdi attended a guerilla training camp in Ethiopia.

Case Study Four  Lebanese Canadian Bank (LCB) is based in Beirut, Lebanon, and maintains 35 branches in Lebanon and a representative office in Montreal, Canada.  They were accused of facilitating money laundering activities for the Joumaa organization, an international narcotics trafficking and money laundering network. On February 11, 2011, LCB was designated by the U.S. Treasury Department as an entity of primary money laundering concern. LCB was used by the Joumaa organization to move hundreds of millions of dollars monthly in cash

23rd Annual ACFE Fraud Conference and Exhibition ©2012 13 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES proceeds from drug sales into the financial system. Hezbollah received financial support from the criminal activities of the Joumaa organization. Managers from LCB were also linked back to Hezbollah officials.  Joumaa organization: January 26, 2011, Ayman Joumaa, along with nine individuals and 19 entities attached to his drug trafficking and money laundering activities, were designated as Specially Designated Narcotics Traffickers (SDNTs) by OFAC. Ayman Joumaa ran a complex money laundering scheme. He moved narcotics from Colombia and Panama through West Africa to Europe. He then moved the bulk cash proceeds from the drug sales from Europe into Lebanon, where it was deposited into LCB. This money was then wired to used-car dealers in the United States to buy cars. The cars were then shipped to West Africa or other overseas destinations where they were sold. In another twist, Joumaa would also wire money to collaborators in Asia who purchased consumer goods that were shipped for sale to countries in Latin America.

Mitigation and Investigative Tools Prepaid card monitoring and mitigation  Collect purchaser information.  Monitor all large purchases.  Aggregate by purchaser.  Track all purchases in cash.  Aggregate cash purchases by same purchaser.  Aggregate and review buyers with a high volume of purchasers.  Determine whether the volumes make sense.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 14 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES ACH Monitoring and Risk Mitigation  Identify and monitor the ACH transactions of all high-risk customers.  Identify customers with frequent and large ACH transactions.  Increase your due diligence for international ACH transactions.  Identify and ACH transactions that the bank originates to foreign financial institutions, particularly to high-risk geographic locations.  Create methods to track, review, and investigate customer complaints regarding fraudulent or duplicate ACH transactions.  Run volume reports to identify customers with unusual or large volumes of ACH or ATM activity, and ensure that ACH transactions (i.e., amounts, frequency, origin, or destination) are consistent with nature of business or occupation of customer.  Review logs to aggregate purchases on prepaid cards by purchaser and those purchased in cash.  Scan your institution’s transactions for keywords that might indicate activity that warrants higher due diligence, such as PayPal, global pay, e-gold, gambling, dirham, goldxcash, click2exchange, or other online service providers.  Run velocity reports to identify accounts with high turnaround transactions of cash, ACH, or ATM transactions. Terrorists might transfer money via ACH and then immediately remove in cash. Does the volume of this activity make sense for your customer?  Run spike reports to identify accounts with unusual spikes in their account activity.

23rd Annual ACFE Fraud Conference and Exhibition ©2012 15 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES Conclusion The financial services industry possesses financial intelligence that is critical in assisting law enforcement in the fight against terrorist financing. Financial institutions need to be prompt and detailed when reporting suspicious activity so that law enforcement has time and the necessary information to track down terrorists before they are successful in carrying out their plans.

The key to being prompt is to understand how innovated the terrorists are being in raising and moving their money so that we can implement targeted monitoring for suspicious activity.

The emphasis needs to be on being proactive over being reactive. Financial institutions and auditors need to set internal controls to identify fraud that might also be financing terrorist plots. Rely on your investigative and analytical intuition and experience to provide financial intelligence to law enforcement that is detailed and prompt. Then, law enforcement can use the suspicious activity reports filed by institutions to perform trend analysis and tie into possible terrorism cases.

By following the money, we can target the crooks and money launderers in order to catch the terrorists.

Financial Action Task Force: www.fatf-gafi.org/

FFIEC BSA/AML Examination Manual, Appendix F: Money Laundering and Terrorist Financing “Red Flags”: www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_106 .htm

www.justice.gov/dea/pubs/pressrel/pr121809.html

www.treasury.gov/press-center/press- releases/pages/tg1057.aspx

www.dw.de/dw/article/0,,15612492,00.html

www.bloomberg.com/news/2011-12-15/hezbollah- laundered-money-through-used-car-sales-drug-running-u-s- says.html

http://en.wikipedia.org/wiki/Columbus_Shopping_Mall_bo mbing_plot

http://aml-cft.blogspot.com/2008_05_01_archive.html

http://en.wikipedia.org/wiki/Younes_Tsouli

http://query.nytimes.com/gst/fullpage.html?res=9907E2D8 163FF931A25752C0A9609C8B63

http://en.wikipedia.org/wiki/Imam_Samudra

http://archive.org/stream/911_final_report/911_Full_Report _djvu.txt

23rd Annual ACFE Fraud Conference and Exhibition ©2012 17 FRAUD AND TERRORIST FINANCING: THE GROWING RELATIONSHIP NOTES Annual Threat Assessment of the Director of National Intelligence, January 11, 2007

Treasury’s Office of Foreign Asset Controls

Financial Crimes Enforcement Network

International Narcotics Control Strategy Report

United Nations Security Council Counter-Terrorism Committee and Monitoring Group

International Monetary Fund and the World Bank Anti- Terrorist Financing Programs

Targeting Terrorist Financing in the Middle East by ICT