Florida Women Caught Up in Cyber Crime Against Kentucky Government Agency by Ukrainian Hackers

July 6, 2009 by David S. Seltzer

As a South Florida cyber crime criminal defense lawyer, I was interested to read an interesting analysis by the Washington Post’s Security Fix blog July 2 of a recent cyber crime against the government of Bullitt County, Kentucky. According to the blog, criminals in the Ukraine stole $415,000 from the county’s payroll account last week through an elaborate scheme that relied partly on hacking and partly on the cooperation -- or naivete -- of Americans used as “money mules.” While criminal charges have not yet been brought, the article interviewed two anonymous Florida women who said they were fooled into acting as mules -- one of whom is now almost $9,000 overdrawn by the scam.

The Ukrainians used a malware program to get access to the computer belonging to the Bullitt County treasurer. Using that, they were able to get access to the bank account and create 25 “employees” who were really the money mules. They then wired money in amounts around $10,000 to each of the mules, sometimes more than once. The mules’ job was to send the money on to the Ukrainian scammers via wire transfer, keeping a percentage as a fee.

However, the mules’ status was not always made clear to them, according to the article. The blogger spoke with two anonymous women, both Florida residents, who said they were initially hired from CareerBuilder.com to correct bad grammar and spelling in documents sent by “Fairlove Delivery Service.” One of the woman, a Miami resident, said she was later offered a job as a “local agent” helping the company get its money to overseas clients faster. Her job was to accept the Kentucky deposits into her personal bank account and wire the money to the Ukraine. She got suspicious and only wired about a third of the money, which turned out to be wise -- after Bullitt County discovered the scam, her bank account was frozen.

The other Florida woman had a similar story, but sent along all of the money as requested. Unfortunately for her, her bank honored Bullitt County’s request to reverse its deposit, which means her trust was repaid by an overdraft charge of nearly $9,000. The bank said she would be expected to repay the money. The article said authorities have not yet finished their investigation, so it’s not clear yet whether she may also face criminal charges. The article finishes with some tips for Internet users on how to avoid scams like this, including advice on avoiding the Trojan malware that affected the Bullitt County computers as well as being wary of online-only job offers.

That might sound like obvious advice to a Fort Lauderdale cyber crime criminal defense attorney -- but it clearly wasn’t obvious to these women, who could pay a high price for their credulousness. (In fact, in this economic climate, it might be easier than ever to scam job-seekers who are desperate for work.) In addition to the financial consequences they now face, they could be criminally charged as accomplices to a crime against Bullitt County, while the ringleaders remain free in the Ukraine. It’s hard to second-guess investigative work that’s still underway, but as a Miami-Dade cyber crime criminal defense attorney, I do not believe they should be held to the same standards of culpability as the original hackers.