Like most 18-year-olds, “Carlos” is never far from his phone, using it to catch up on his social media feeds and scroll through friends’ pictures. Unlike most teenagers though, he posted photographs depicting a level of affluence unlikely for someone who left school after GCSEs and is now a junior employee at a central London restaurant.
The pictures showed a life of excess – Carlos and his friends holding wads of cash, clad in designer clothes, Rolex watches on their wrists, and driving around London in a Mercedes.
But the truth behind the photographs was that this prosperous-looking lifestyle was funded by a very modern crime. The teenagers were all involved in cyberfraud, acting as fixers for online hackers who would deploy them either as “money mules” – using their bank details to shift money in elaborate frauds – or for convincing others to hand over their details for use in the scams.
The frauds are everyday and commonplace, and cost banks and consumers hundreds of millions of pounds. People are persuaded, via a threatening text message, that, for example, they owe money to the taxman. Or they might be told they risk being convicted of a crime they know nothing about if they don’t pay a fine.
Behind these frauds are individuals and gangs based in Britain and abroad; they often use equipment and techniques bought from the dark web – part of the internet that can only be accessed with clandestine software.
“I know people who do this in Liverpool and others in Manchester,” said Carlos when he talked to the Observer on a street a short distance from his south London home. “It has to be everywhere in the country.”
Now 18, Carlos started at 15 as a “middle”, working for an internet hacker to recruit gang members and ensure discipline among them. For a teenager, the amounts he earned were extraordinary. In his best week, he took home £6,000, money he had to conceal from his family, but flashed about on social media as a way to encourage other teenagers to join up.
For the hackers at the top of the pyramid, the rewards are even greater. Carlos and his peers earned about 40% of what was stolen in the frauds while their “boss” took home the rest. The hackers are frequently part of much wider criminal gangs which use the frauds as just another income stream.
The scale of cybercrime has ballooned in recent years. The latest data from UK Finance, the voice of the banking industry, put the amount stolen by criminals in the first six months of last year at £616m. Of this, £207.5m went in scams where people were duped into authorising a payment to an account controlled by a criminal.
Officially known as authorised push payment (APP) fraud, it includes cases where criminals hack email accounts and convince consumers to send large sums to criminal accounts. It is these recipient accounts that have originated through people like Carlos – the money mules.
Every year, banks are closing tens of thousands of accounts opened by young people lured – by promises of riches on social media – into this type of criminality. Last year, Police Scotland wrote to secondary schools across the country warning parents and teachers that criminal gangs were targeting teenagers.
Within the gang there is a strict hierarchy, according to Carlos. The hacker – or “plug” – is at the top of the chain, and below him or her is a group of middles, like Carlos, who act as intermediaries between the hacker and the lowest group on the chain, the “runners”, who provide the account details and can be as young as 13.
Runners and middles who provide the most account details – by either opening new bank accounts or supplying details from family members – progress faster up the chain and gain the more trust from the hacker, according to Carlos.
Runners often earn only a paltry amount, amounting to 1% of what is stolen or even just a new pair of trainers. “Sometimes though, we don’t give them anything – they are harmless anyway,” said Carlos.
The more runners a chain has, the more hacks it can carry out.
New recruits are enticed by seeing the spoils of fraud advertised online. Offline, all involved have to remain modest in appearance, according to Carlos. “If you are only 15 and gaining £6,000 a week, you need to learn how to not put that on display in real life in front of your family and teachers,” he said. Most of the runners are still at school and have no idea what the accounts are being used for.
In his experience, gangs can make between £4,000 and £80,000 a week. Overall, he made some £25,000, but has little to show for it. “El dinero fácil se va fácil,” he says – easy come, easy go. The money he earns he spends – on clothes, watches, £4,000-worth of gifts for a former girlfriend and small presents for his family.
The plugs who run the fraud are mostly local and self-taught. Personal information about potential targets can be bought on the dark web, as can kits to initiate a fraud. Once a person has been convinced to transfer money, they’re told to pay it into an account belonging to one of the runners, from where it is quickly transferred to the hacker’s account.
“We make sure that for each fraud attempt, we possess the victim’s phone number,” said Carlos. “If they receive a message about a transfer made from their account and they want to block it, they’d be unable to alert their bank as we would be calling their number non-stop to keep the phone busy, giving us enough time to withdraw the money.”
Once an account is found to have been used in a fraud, it is blocked by the bank, so a new account is needed for each theft. Carlos’s account and one opened by his cousin were shut down after being used, which alerted his family to what he was part of. But leaving a gang is not easy – it can bring threats of aggression, robbery and death. One runner who refused to pass on money to a plug had his home burgled and his furniture destroyed.
A report for fraud prevention body Cifas last year found that one in five people thought being a money mule was a “reasonable activity”. The organisation sees a spike in cases at the beginning of university terms as students get involved.
What many fail to realise is how this is linked to organised crime, said Amber Burridge, Cifas’s head of fraud intelligence. “People do not understand, or maybe choose not to understand, that money muling is a form of money laundering and a criminal offence,” she added. “The use of social media there is a great example of how easy it is to lure an audience into getting involved in these activities.”
Carlos left his gang after, he says, he saw the consequences of his actions – such as his cousin’s account being blocked – and escaped without retribution thanks to having a wide group of friends who would defend him if he was threatened by the hacker. Now his earnings from the restaurant are paid either by cheque or into a parent’s bank account.
The runners, plugs and middles who run the hacking operations are still active around his south London home, he says, and a large number of his friends are involved. But no one has yet been charged in connection with the fraud.
Carlos’s name has been changed
