Feds Ramping Up Convictions for Business Email Compromise Scams

Federal law enforcement agencies are cracking down on perpetrators of business email compromise (BEC) scams and just made another conviction, The Record reports. The Feds doled out a 10-year prison sentence to a man from Georgia for laundering more than $4.5 million.

In 2020, the Georgia man, Malachi Mullings, devised a way to launder loot that he’d acquired by sending emails to credulous businesses that gave him protected information, a cyberscam known as business email compromise (BEC). Mullings opened 20 bank accounts for a sham company, and ran the dirty cash through one account after another until it came out clean, in his opinion.

Mullings got most of the cash by submitting forms to a federal agency “for the purpose of changing the bank account information on file for Medicaid payments to certain hospitals,” according to a criminal complaint filed against him in 2022. He’d gotten hospital employees to sign those forms by sending emails in which he posed as a trusted colleague. That netted him more than $3.8 million. Additionally, he extorted a victim in an internet romance fraud for $260,000.

The BEC scams had gained the attention of the Department of Justice around the time Mullings was laundering the money. The DOJ filed against him in 2022 as part of a multi-state effort to crack down on cyberattacks targeting state and private health insurance providers. Mullings was one of 10 people charged with thefts totaling more than $11 million.

The FBI has blamed nearly $3 billion in losses in 2023 to business email compromise, which makes BEC the second-most-damaging form of internet crime reported by Americans last year.

The Record reports that federal prosecutors have secured convictions in several BEC cases besides Mullings’ recently, including Niselio Barros Garcia, of Florida, who had an MO similar to Mullings and got a four-year sentence for laundering more than $2.3 million; and Corey Lee, from Milwaukee, who laundered over $1.2 million stolen from four businesses in BEC scams. Lee was found guilty of two counts of money laundering and two counts of engaging in financial transactions with money derived from criminal activity. He has yet to be sentenced.