From Cork to Nigeria: Gang of cybercriminals caught out by their own technology 

Trying to launder a million pounds through 57 bank accounts probably took up 30 mins of their day that day… what else were they doing?


On Wednesday, two ‘low-level’ Cork-based operatives were jailed for their part in a pandemic unemployment payment (PUP) fraud masterminded by the head of the Nigerian crime gang, known as Black Axe.

The gang had planned to secure up to €1m from their elaborate fraud, but in the end only managed to get €183,000.

They harvested emails of HSE staff, and people were sent bogus jury summonses requesting further information. That was then used to set up bank accounts from which the PUP claims were made.

During the trial of Oluwagbewikeke Lewis and Bashiru Aderibigbe, it emerged that snaring the fraudsters’ cyber crimes was, ironically, aided by technology.

A web of WhatsApp recorded phone messages gave gardaí a unique insight into the workings of Black Axe as it targeted PUP payments. They were heard discussing how they would launder up to €1m.

A Nigerian interpreter assisted officers from the Garda National Economic Crime Bureau to translate what was on the recordings, and they were also able to identify a number of the parties, including a man believed to be the leader of the criminal organisation — a man known by the nickname ‘The Chairman’.

This is a term of respect used among people involved in such gangs.

Detective Superintendent Michael Cryan confirmed that the nature of the fraudulent activity going on in the case had all the hallmarks indicating that it was the work of the Black Axe.

What was of particular interest to gardaí was the phone evidence that showed that one of the two Cork-based defendants was in direct phone contact with a person he referred to as ‘The Chairman’. Det Supt Cryan remarked that gardaí would not usually expect a low-level footsoldier in the organisation to have direct access to such a senior figure.

In one call, there is a conversation about how €1m fraudulently claimed in pandemic unemployment payments would be laundered.

In another, there is talk of how €30,000 of the proceeds of the Cork-based fraud was being laundered through accounts in Germany.

In another voice clip, one of the gang members was addressed by the nickname ‘Ebony3’.

The phone containing this valuable information in the investigation was seized by Detective Garda Kieran Crowley during what was a relatively routine act of stop-and-search policing in the Midleton area.

Having signalled for the driver of a Mercedes to stop, the detective noticed that the driver was acting nervously and he decided to conduct a search for suspected drugs. No drugs were found. However, what was seized became a key part of the PUP fraud investigation.

Two false passports were discovered, two fraudulent bank documents were seized, and two phone SIM cards were located. The SIM numbers would correspond with numbers provided for the setting up of bank accounts for the fraudulent PUP claims. Most significant of all, however, was the seizure of a mobile phone.

Instead of communicating by text message, the criminals had used WhatsApp voice messages instead. These would prove vital in linking the two defendants with each other, linking them with other criminals, and providing vivid accounts of the modus operandi of the gang.

At the time this phone was seized in Midleton, Detective Garda Trevor Conroy, from Wexford and on secondment to the Department of Social Protection, had been examining patterns in suspicious PUP claims. A pattern was emerging where a sizeable number of HSE or Tusla staff appeared to be making PUP claims while continuing in full-time employment in the first months of the pandemic. In fact, these health workers were oblivious to the claims that had been filed in their names and the payments made to accounts set up fraudulently from Cork.

It was later established that their email addresses had been harvested and had been used to dupe them into providing further personal information that would advance the fraud.

Det Gda Conroy was at this time gathering compelling evidence from an analysis of PPS numbers that PUP claims had been made by people who would not have been entitled to it.

A total of 74 PUP claims were observed in this fast-developing investigation. It was quickly becoming clear that this was a systematic scam, and the monies were being paid into 57 bank accounts.

By this time, the on-the-ground police work in Midleton and the investigation into patterns of claims going on by gardaí on secondment to the Department of Social Protection were all being coordinated under the Garda National Economic Crime Bureau.

Had the case against the two men living in Cork gone to trial, it is estimated that its duration would have been measured in months rather than weeks.

The evidence would have been technical in nature, and more than 70 witnesses would have had to give evidence from the prosecution side.

Defence lawyers were at pains to point out in mitigation that their clients’ pleas of guilty to the charges against them saved the State the considerable cost of putting together enormous books of evidence, and the even costlier onus of running the trial for a number of months — not to mention the huge demands that would have been made on the 12 jurors who would have been selected to hear the case.

On the matter of jury selection, this was one of the most novel and criminally-enterprising aspects of the fraud that was carried out.

Emails from the hacked information on various HSE and Tusla staff members were used to send out fraudulent jury notices, telling recipients they had been called for jury service — but that first they should confirm their name, date of birth, PPS number, and mother’s maiden name.

HSE and Tusla staff were targeted on the assumption that they would be working through the pandemic and would not be making a pandemic unemployment payment claim.

As was widely known, many of these employees were also working full tilt in the course of the pandemic. A few basic questions, that did not seek financial information of any kind, were unlikely to raise the suspicions of what were some very busy people.

The information the criminal gang harvested from the replies to the bogus jury emails were then used to set up bank accounts in online prepaid financial services and with An Post. Further bank accounts were set up to keep the money moving and, in effect, to launder it.

While fraud investigations typically involve detailed paper trails to follow the money, other policing strategies were involved, including the painstaking analysis of CCTV that could be gathered in coordination with the documented timing of withdrawals from the suspect accounts.

This proved extremely fruitful in this investigation: Bashiru Aderibigbe was seen on security cameras on 22 occasions making withdrawals from the target accounts, in the course of which he pocketed €11,270 in cash from 13 different bank accounts.

It was ultimately established in this way that in these 13 accounts, Aderibigbe had access to over €56,000 in cash from the fraudulent PUP claims.

For instance, on August 8 last year, Aderibigbe was seen on CCTV at the Crestfield centre in Dooradoyle in Limerick City making one of the withdrawals.

One of the strongest pieces of evidence against his co-accused, Oluwagbewikeke Lewis, was the phone seized from him and the audio WhatsApp messages between Lewis and Aderibigbe and other parties.

One piece of audio referenced plans to obtain up to €1m and attempts to get more bank accounts through which to launder it.

When arrested, Aderibigbe made no comment during interviews with gardaí.

Lewis was later arrested, and he also made no comment to the majority of questions he was asked. 

Examination of WhatsApp messaging made it clear that the two co-accused have been friends for several years. 

Detectives were satisfied from their analysis of the audio messaging WhatsApp that Lewis had direct contact with the director of the criminal organisation who was referred to as ‘The Chairman’. 

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s