Further facts emerged on Friday detailing the crimes allegedly committed by Ramon Olorunwa Abbas, popularly known as Hushpuppy.
Theportcitynews exclusively obtained an affidavit by an agent of the Federal Bureau of Investigation, FBI, Mr Andrew John Innocenti before a UNITED STATES DISTRICT COURT for the Central District of California, presided over by Hon. Rozella A. Oliver, U.S. Magistrate Judge.
Innocenti, a Special Agent with the FBI has been employed since March 2015 and is currently assigned to the Los Angeles Field Office, High-Tech Organized Crime Squad, where he primarily investigates cyber-enabled fraud and business email compromise (“BEC”) schemes.
Between August 2015 and December 2018, Innocenti was also assigned to a cyber-crime squad in the Chicago Field Office, where he investigated cyber-related crimes, including BEC cases, and has participated in numerous computer-crime investigations.
Criminal Complaints against Hushpuppy
Special Agent Innocenti in his affidavit in support of a criminal complaint against, and the arrest warrant for, RAMON OLORUNWA ABBAS, also known as (“aka”) “Ray Hushpuppi,” aka “Hush” (“ABBAS”), said the accused violated 18 U.S.C. § 1956(h), a section of the United State’s law that deals with Conspiracy to Engage in Money Laundering.
The FBI agent said his affidavit showed sufficient probable cause for the requested complaint and arrest warrant and does not purport to set forth all of the knowledge of the government’s investigation into the matter.
The affidavits further revealed that the Nigerian national who was living in the United Arab Emirates (the “U.A.E.”), before his arrest and extradition to the US frequently showcased himself designer clothes, wearing expensive watches, and posing in or with luxury cars and charter jets on social media.
“The FBI’s investigation has revealed that ABBAS finances this opulent lifestyle through crime and that he is one of the leaders of a transnational network that facilitates computer intrusions, fraudulent schemes (including BEC schemes), and money laundering, targeting victims around the world in schemes designed to steal hundreds of millions of dollars. ABBAS participated in these fraudulent schemes and money laundering in coordination with multiple coconspirators, including the persons referred to herein as Coconspirator 1 and Coconspirator 2”, the Innocenti said in his affidavit.
“First, messages found on the iPhone of Coconspirator 1 (reviewed pursuant to a federal search warrant issued in this District) reflect that ABBAS, Coconspirator 1, and Coconspirator 2, with others, committed a BEC scheme that defrauded a victim in the United States of approximately $922,857.76, including approximately $396,050 that ABBAS, Coconspirator 1, and Coconspirator 2 laundered while Coconspirator 2 was in Los Angeles, California.
“Second, ABBAS and Coconspirator 1 conspired to launder funds intended to be stolen through fraudulent wire transfers from a foreign financial institution (the “Foreign Financial Institution”), in which fraudulent wire transfers, totaling approximately €13 million (approximately USD $14.7 million), were sent to bank accounts around the world in February 2019. Coconspirator 1 conspired with the persons who initiated the fraudulent wire transfers and also conspired with a number of others, including ABBAS, to launder the funds that were intended to be stolen. ABBAS, specifically, provided Coconspirator 1 with two bank accounts in Europe that ABBAS anticipated would each receive €5 million of the fraudulently obtained funds.
“Other communications between ABBAS and Coconspirator 1 indicate that, in addition to these schemes, ABBAS and Coconspirator 1 conspired to launder tens, and at times hundreds, of millions of dollars that were proceeds of other fraudulent schemes and computer intrusions, including a fraudulent scheme to steal 100 euros from an English Premier League football club.
Identification of ABBAS
The affidavit stated that further analysis of Coconspirator 1’s iPhone and other online accounts showed that Coconspirator 1 operated and tasked money mule crews for a number of fraudulent schemes, including BEC schemes and cyber-heists. Analysis also showed that Coconspirator 1 communicated with the U.A.E. phone number +971543777711 (“Phone Number 1”) about multiple fraudulent schemes and money laundering. As described below, Phone Number 1 was one of the phone numbers ABBAS used during 2019 and 2020.
Based on on the review (pursuant to federal search warrants obtained in this District) of data from Coconspirator 1’s iPhone and from an online account connected to that phone (the “Online Account”), other law enforcement personnel’s review of that digital data, and from discussions with United States Secret Service (“USSS”) and FBI personnel, the following was discovered:
a. Coconspirator 1’s iPhone listed Phone Number 1 (+971543777711) with the contact name “Hush.” The phone also contained a contact for Snapchat username “hushpuppi5,” which listed the Snapchat contact name “The Billionaire Gucci Master!!!”
b. Searches of Phone Number 1 and the contact name “Hush” in Coconspirator 1’s iPhone revealed messaging conversations between “Hush,” using Phone Number 1, and Coconspirator 1. (For ease of reference, communications with this moniker and Phone Number 1 are referred to as communications with ABBAS in the remainder of this affidavit.)
c. In or around December 2019, April 2020, and June 2020, the FBI reviewed the publicly viewable Instagram account of “hushpuppi” at www.instagram.com/hushpuppi. Based on information available on the profile page, the user of that account made more than 500 posts and had 2.3 million followers as of June 2020.
d. This Instagram account included numerous publicly viewable images of a man who appeared to be ABBAS, based on comparisons to photographs of ABBAS in passports and other identification documents referenced below in paragraphs 16.c to 16.c.iv. Hundreds of these images on the Instagram account showed ABBAS in designer clothing and shoes, posing on or in luxury vehicles, wearing high-end watches, or possessing other luxury items, indicating substantial wealth.
The FBI further stated that on June 6, 2020, ABBAS posted a photograph of a white Rolls Royce Cullinan that included the hashtag “#AllMine.” while on February 27, 2019, he posted a photograph of himself in front of two vehicles, one of which he described as his new Rolls Royce Wraith.
The agency said that based on the review of publicly available pricing information, the starting price for each of the vehicles is approximately $330,000.
It added that more than two dozen images showed ABBAS in front of, on top of, or inside other luxury vehicles, including multiple models of Bentley, Ferrari, Mercedes, and Rolls Royce.
e. On numerous occasions, ABBAS posted photos of himself wearing items and/or holding shopping bags from luxury stores such as Gucci, Louis Vuitton, Channel, Versace, Fendi, and more.
f. On multiple dates, including April 17, 2020, June 19, 2019, and July 1, 2019, ABBAS posted images of himself inside or in front of private jets. Multiple photographs also appeared to show ABBAS posing in locations around the world (such as Dubai and Paris).
Innocenti further stated in the affidavit that: “This Instagram profile also claimed that the user was a real estate developer and listed the user’s Snapchat account as “Hushpuppi5,” which is the same Snapchat account name that was saved in Coconspirator 1’s iPhone (see paragraph 9.a). Based on records from Instagram received in June 2020, the Instagram account was subscribed with the name “RAY,” the email address rayhushpuppi@gmail.com, and the verified phone number +971502818689 (“Phone Number 2”). The Instagram account was created on October 10, 2012, and recent account history from 2020 showed logins from Internet Protocol (“IP”) addresses located in the U.A.E.
“Based on subscriber records from Snap Inc., the Snapchat account “Hushpuppi5” used the phone number +971565505984 (“Phone Number 3”) and the email address rayhushpuppi@gmail.com (i.e., the same email as the Instagram account). The Snapchat account used the display name “The Billionaire Gucci Master!!!,” which was the same Snapchat contact name saved in Coconspirator 1’s phone for the Snapchat account “Hushpuppi5.”
“Records from Apple Inc. showed that the email account rayhushpuppi@gmail.com was used to create an Apple account on March 29, 2014, which was active as of May 2020, and used the subscriber name “Ray Hushpuppi. The same email account was used in subscriber records of another Apple account, which account records also listed the email address rayhushpuppi@icloud.com and another Google account. Phone Number 1 was listed in the subscriber records of a third Apple account, which was created on November 7, 2019. The account listed the subscriber name “Godisgood Godson” and the verified email address godisgoodallthetime0007@gmail.com. Despite using that subscriber name, the name “Ramon Abbas” (i.e., ABBAS) was listed in account records in December 2019 and January 2020. Apple records further listed a user’s address as 1706 Palazzo Versace, in Dubai, U.A.E. (the “Palazzo Versace” address).
“Records from Google for ABBAS’ email address rayhushpuppi@gmail.com, included a lease renewal/tenancy contract for the Palazzo Versace address for April 4, 2020 through May 3, 2021, which also listed Phone Number 3. Posts on ABBAS’s Instagram page also suggested that he lived at the Palazzo Versace apartments in Dubai, U.A.E., including one that listed the location “Palazzo Versace Dubai. Google records, in turn, indicated that the email account godisgoodallthetime0007@gmail.com, which used the subscriber name “Godisgoodallthetime GraciousGod,” was both created and last logged into on November 7, 2019. This email account was accessed on November 7, 2019 from an IP address that geo-locates to the U.A.E. Google records for this account also included several Apple invoices billed to ABBAS, which used the Palazzo Versace address as the billing address.
Based on an FBI computer scientist’s review of Google account records for rayhushpuppi@gmail.com, obtained through legal process and a federal search warrant in this District, it was discovered he account used the subscriber name “Ray HushPuppi” which was created on September 19, 2013. Additionally, the recovery email listed was rayhushpuppi@icloud.com, and the recovery phone number was Phone Number 2.
The affidavits further showed that multiple emails in the email account rayhushpuppi@gmail.com confirmed that ABBAS used Phone Number 1, Phone Number 2, and Phone Number 3, adding that on April 6, 2020, an email sent to
rayhushpuppi@gmail.com contained a tenancy contract for the Palazzo Versace address, with ABBAS listed as the tenant and Phone Number 3 as his phone number while on February 6, 2020 and March 3, 2020, rayhushpuppi@gmail.com was used to send Phone Number 1 to other persons, which the account user described as “my mobile number” and “my phone number,” respectively.
The Victim Law Firm
In reviewing data from Coconspirator 1’s iPhone, FBI employee saw messages reflecting that, in or around October 2019, ABBAS had conspired with Coconspirator 1 and Coconspirator 2 to commit a fraudulent wire transfer and money-laundering scheme, in which a U.S. victim (the “Victim Law Firm”) lost approximately $922,857.76. The messages reflected that part of the scheme, including acts in furtherance of the conspiracy, occurred while Coconspirator 2 was physically present in the Central District of California.
Records obtained from JPMorgan Chase Bank (“Chase”) for a bank account held in the U.S. (the “Chase Account”) reflect that the Chase Account received a wire transfer on October 15, 2019 for approximately $922,857.76 from the Victim Law Firm. On October 17, 2019, there was a wire transfer from the Chase Account to an account at Canadian Imperial Bank of Commerce (“CIBC”), in Toronto, Ontario, for approximately $396,050. Bank records reflect that the specific account at CIBC ended in 1716 (the “CIBC Account”), consistent with what is discussed below in paragraphs 21, 24, and 25. The remaining funds in the Chase Account were transferred to other accounts.
Based on a review of data from Coconspirator 1’s iPhone, on or around October 17, 2019, ABBAS, using what appeared to be the Snapchat account “hushpuppi5,” sent an image of a Chase wire confirmation to Coconspirator 1. The image appeared to show a wire transfer form related to a transfer of approximately $396,050 from the Chase Account to the CIBC Account, which, based on other messages on Coconspirator 1’s iPhone, appears to have been held by Coconspirator 2.
On April 14, 2020, FBI interviewed S.R., owner of the Victim Law Firm, about the above-referenced wire sent on October 17, 2019. On April 16, 2020, FBI interviewed N.C., who was an attorney and co-worker of S.R., and on May 21, 2020, FBI interviewed K.C., a paralegal of the Victim Law Firm. Based on these interviews, it was learned that the Victim Law Firm, which is located in New York State, was representing a client, A.D., in the refinance of real estate who was refinancing his/her property with Citizens Bank. As part of the closing for this refinance, on October 15, 2019, K.C. sent a verification email to what appeared to be a Citizens Bank email address (later identified as a “spoofed” email address) requesting wire instructions. Per the internal policy of the Victim Law Firm, all wire verifications were to be sent to their firm via fax and followed-up by a phone call. K.C. received a fax message in response to her verification email with what was later determined to be fraudulent wire instructions to transfer the loan payoff amount of their client A.D. to the Chase Account. K.C. then called the phone number listed on the fax to verify the wire instructions.
On October 15, 2019, K.C. initiated the wire transfer to the Chase Account for approximately $922,857.76. Neither the Victim Law Firm, nor their client A.D., realized the funds had been fraudulently transferred to the Chase Account until later in October 2019, when A.D. checked his/her account and realized that the funds for the refinance had not been credited. By this time, all of the funds had been depleted from the Chase Account.
Messages on Coconspirator 1’s iPhone reflect that at approximately the same time on October 17, 2019 that ABBAS sent Coconspirator 1 an image of the wire transfer confirmation for the transaction from the Chase Account to the CIBC Account, Coconspirator 1 was communicating with another phone number to confirm the wire had been deposited into the CIBC Account. Based on other messages on the iPhone and records obtained by the FBI, that phone number was used by Coconspirator 2. The communications between Coconspirator 1 and Coconspirator 2 on October 17, 2019 included the following messages:
Coconspirator 1: Keep lookout for the 396 and so ur thing till u hear from me.
Coconspirator 2: Ok will do
Coconspirator 2: I’m in La so how can I make sure??
Coconspirator 2 also sent Coconspirator 1 a photograph showing a secure login to the CIBC Account in Coconspirator 2’s name. The account number ended in 1716, consistent with the account number that ABBAS sent to Coconspirator 1 in an image on October 17, 2019.
The FBI reviewed international travel records from a law enforcement database, which showed that Coconspirator 2 travelled from Toronto, Canada to Los Angeles, California on October 16, 2019. This was one day before the wire transfer from the Chase Account to the CIBC Account in Coconspirator 2’s name. Further, as referenced above, Coconspirator 2 messaged Coconspirator 1 on October 17, 2019 that “I’m in La.” Travel records also show that Coconspirator 2 departed Los Angeles around October 23, 2019 for Canada. Taken together, this indicates that Coconspirator 2 was in Los Angeles at the time of the wire transfer.
Later in the day on October 17, 2019, while still in Los Angeles, Coconspirator 2 appeared to confirm the wire transfer in an iMessage found on Coconspirator 1’s iPhone:
Coconspirator 1: Did the big hit?
Coconspirator 2: Yessir.
After Coconspirator 2 appeared to confirm to Coconspirator 1 that the money was transferred to the CIBC Account, Coconspirator 1 appeared to provide confirmation back to ABBAS, within a minute:
ABBAS: Sup bro
Coconspirator 1: Confo u sent me today
Coconspirator 1: Landed
Coconspirator 1: Just now.
Coconspirator 1 then wrote that he was on an airplane and had just landed. A few seconds later, ABBAS asked, “Money came in?,” and Coconspirator 1 responded, “Yes. For Canada.” ABBAS then demanded, “Give me a screenshot.” Coconspirator 1 stated that he was not able to because his Wi-Fi signal was not strong enough, but promised to send a screenshot.
The affidavit said that persons involved in fraudulently obtaining and laundering funds from BEC schemes and other online fraud schemes often request confirmation of fraudulent transactions, including in the form of screenshots or photographs showing proof that the funds were transferred.
It, however, added that the Coconspirator 1 ultimately did not send that screenshot as he was arrested on or about October 17, 2019, in a U.S. airport, on a federal arrest warrant, shortly after sending his last message to ABBAS.
<strong>The Foreign Financial Institution</strong>
Based on information from FBI agents investigating the cyber-heist from the Foreign Financial Institution, it was discovered that on February 12, 2019, a Foreign Financial Institution suffered a computer intrusion and cyber-heist in which approximately €13 million (approximately $14.7 million) was fraudulently wired from the Foreign Financial Institution to bank accounts in multiple countries.
Coconspirator 1 and ABBAS, who used Phone Number 1 in these communications, exchanged messages discussing the cyber-heist from the Foreign Financial Institution. Based on a review of data from Coconspirator 1’s iPhone and his Online Account, and discussions with FBI special agents and other law enforcement personnel familiar with this investigation, it was discovered that in a message on January 16, 2019, Coconspirator 1 contacted ABBAS asking for two European bank accounts that could receive “5m euro” (€ 5 million), which he said would be from the country in which the Foreign Financial Institution is located (the “Foreign Financial Institution Country”). Coconspirator 1 stated several times that the “hit” would occur on February 12. After some discussion, ABBAS sent Coconspirator 1 the account information for a Romanian bank account, which he said could be used for “large amounts.” ABBAS further said he could provide another account, and Coconspirator 1 said that it would be a payment of “5m”—i.e., € 5 million—to each account.
On February 1, 2019, Coconspirator 1 told ABBAS that a coconspirator said that “12th February they doing it. “I have 4 spots Available[.] u gave me 1/4[.] try to get me a next one pls it will both done at once.” Coconspirator 1 also sent ABBAS a photograph of a computer screen containing a messaging conversation which discussed a February 12 “drop” and a “cashout.”
On February 7, 2019, Coconspirator 1 told ABBAS, “12th Feb they lunching [sic “launching”] the swift I need 1 more from you pls.” Coconspirator 1 later explained, “I have 6 slots in total [¶] All 5m Euro [¶] Big hit in 12th feb [¶] They will all credit same time.”
SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, provides a network that enables financial institutions worldwide to send and receive information about financial transactions in a secure, standardized, and reliable environment. SWIFT also sells software and services to financial institutions, much of it for use on the SWIFTNet network. SWIFT does not facilitate funds transfers. Rather, it sends payment orders, which must be settled by correspondent accounts that the institutions have with each other. Each financial institution, to exchange banking transactions, must have a banking relationship by either being a bank or affiliating itself with one (or more) bank(s) so as to enjoy those particular business features.
FBI agents investigating Coconspirator 1 and other targets, explained that hackers sometimes will attempt to conduct cyber-heists by gaining access to a bank’s computer network and then sending fraudulent and unauthorized SWIFT messages.
On February 10, 2019, Coconspirator 1 told ABBAS, “Brother tonight is my deadline to submit anything more,” and then asked, “Do u want add one more or just stick to that one u gave me ?” The next day, ABBAS responded and provided account information for another bank account in Bulgaria.
A photograph, dated February 13, 2019, found in Coconspirator 1’s Online Account showed a computer screen with a messaging conversation in which Coconspirator 1 and another person discussed a number of “drops,” i.e., bank accounts that could receive fraudulent funds. One participant said that there could only be “1 euro” drop, and they then discussed how many of Coconspirator 1’s drops would be used. The username known to be used by Coconspirator 1 stated, “I have 3 euro 1 usa [¶] 2 romania 1 bulgaria 1 usa.”
On February 12, 2019, Coconspirator 1 told ABBAS, “Wire is completed . . . We did it [¶] 500k euro ท [¶] Should be on ur side by now.” In the conversation that followed, Coconspirator 1 told ABBAS that there was only one wire to the account in Romania, “Sender name : tipico group limited [¶] Country : [Foreign Financial Institution Country] [¶] Amount : 500k euro. . . It’s there now my other crew confirmed it’s there as well[.]”
Later, while they were trying to figure out whether the wire had been successful, Coconspirator 1 added, “They did me 3 wires ( 2 to euro 1 to USA ) . . . Bank it came from is :[Foreign Financial Institution] . . . Brother, we still have access and they didn’t realize, we gonna shoot again tomoro am.” ABBAS then confirmed that Coconspirator 1 was saying that the new wire would be sent to the second bank account he provided to Coconspirator 1, in Romania.
An image of a conversation saved in Coconspirator 1’s Online Account, dated February 12, 2019, with a person other than ABBAS, discussed a payment specifically from the Foreign Financial Institution. The conversation in the image stated, “my guy also deleted history logs at the bank so they won’t even c the transaction.”
The next day, February 13, 2019, after ABBAS sent screenshots showing that the funds had not arrived in the Romanian bank account, Coconspirator 1 responded, “Today they noticed and pressed a recall on it, it might show and block or never show.” Coconspirator 1 then sent an image of a news article to ABBAS detailing the theft of funds from the Foreign Financial Institution, followed by a message stating “Look it hit the news.” ABBAS then replied “damn.” Coconspirator 1 then wrote to ABBAS: “Next one is in few weeks, will let U know when it’s ready. too bad they caught on or it would been a nice payout.”
Additional Fraudulent Schemes and Attempted Money Laundering
In addition to participation in those fraudulent schemes, ABBAS and Coconspirator 1 discussed additional BEC frauds and/or other fraudulent schemes in 2019. These included schemes where ABBAS and Coconspirator 1 sought to fraudulently obtain millions—and, at times, hundreds of millions—of U.S. dollars and U.K. pounds sterling, as described below.
On March 10, 2019, Coconspirator 1 requested a bank account in the U.A.E. from ABBAS into which approximately $5 million could be deposited from a victim in the United States. Coconspirator 1 told ABBAS that the “job” would be “Monday am USA time,” and, after some discussion, wrote, “Brother I need it now or we will lose our chance pls.” ABBAS responded by providing bank account information for an account at Commercial Bank International in Dubai, U.A.E.
On April 30, 2019, Coconspirator 1 told ABBAS, “Brother I have 4 company’s in uk ready to switch bank acc on file but acc has to be open beneficiary.” After some discussion, Coconspirator 1 further stated, “I have a room working for me , we have leads and company contracts . My guy r changing acc on file for 100m contracts and there payment are once or twice a week 1-5m I have 4 ready to switch up.”
The affidavit said the Coconspirator 1 was referring to a BEC scheme, because BEC schemes often involve a hacker or fraudster tricking a victim into sending a payment to a coconspirator’s account by switching bank account information on payment instructions provided to the victim. It also said that an “open bene” or “open beneficiary” account is a bank account where a different business account name can be substituted to help in deceiving the victim into sending funds.
It thus appears that Coconspirator 1 was telling ABBAS that coconspirators were fraudulently obtaining $1 million to $5 million through a BEC scheme once or twice a week, and was asking ABBAS for a bank account that could be used to receive such funds.
On May 3, 2019, Coconspirator 1 told ABBAS, “I need uk open beneficiary acc for Monday bro !!!!! [¶] Today I they paid me.” Coconspirator 1 also sent ABBAS an image of a message from another person saying, “Yo [¶] 3 invoices totaling 1.1 M going into that account today . . . 346k 256k and 507k.” Coconspirator 1 then said, “Bro I have a room ready.” In the resulting discussion, Coconspirator 1 told ABBAS that he was “doing invoice account swap” and needed “account open beneficiary.” When ABBAS asked, “Which country,” Coconspirator 1 responded, “U tell me what country is best i attack [¶] But [¶] I have uk [¶] Ready live.”
On May 7, 2019, Coconspirator 1 sent ABBAS a photograph of an apparent banking website showing a transaction “due to be paid” of approximately 1,110,447 of some currency, which is around the same amount as the discussion described in the prior paragraph. Coconspirator 1 then wrote, “I sent 1.1m pound WRDFFWKH\VDLGRSHQEHQLQXNPRQH\ODQGHGDQGQRZWKH\DVNLQJTXHVWLRQVƃ, have other companies ready to swap bro pls help me out I am losing millions.”
ABBAS then stated, “I will paste u one today,” and Coconspirator 1 responded, “When we swap bro the only thing we change is iban or acc on file and we keep all other info as original but we can put acc name on the memo, u need acc that can handle millions and not block.”
The next day, after Coconspirator 1 stated, “Brother my guy can do refund to any visa debit card [¶] Just need card number exp and name,” ABBAS and Coconspirator 1 had some additional discussion that appeared to be about credit card numbers, culminating with ABBAS providing bank account information for an account in Mexico.
On May 12, 2019, Coconspirator 1 wrote to ABBAS, “Brother tonight we are gonna swap ur acc on a big contract payments will be 3-6m every week [¶] I give u confirmation in 12he [¶] From uk.” After ABBAS acknowledged the message, Coconspirator 1 wrote on May 13, 2019, “Your acc has been updated on file , give me 2hr I will send unall details, my workers just went to sleep.” ABBAS responded, “Waiting.”
Coconspirator 1 then sent messages to ABBAS about the apparent victims. First, Coconspirator 1 sent the name of an English Premier League football club, listing the club’s address as the stadium where the club plays. Coconspirator 1 also wrote, “Amount 100M £,” indicating that the fraudulent transaction would be for 100 million euros. Second, Coconspirator 1 sent the name of a U.K. company with an address in Edinburgh, Scotland, and wrote, “Amount 200m £.” Coconspirator 1 then added, “We swapped ur acc under 2 contracts . Tomorow morning we will send u the previous payment and amount with future payment and amount. Can I have 1 more for tomorow to swap pls.”
In response, ABBAS stated, “Bro [¶] I can’t keep collecting houses n not give them a feedback n keep asking for more. This things cost a lot of money now to open.” ABBAS and Coconspirator 1 then discussed the use of the account, and Coconspirator 1 sent a photograph of a computer screen showing the Mexican bank account information with the name of a U.K. company, with a U.K. address, substituted as the beneficiary information. ABBAS responded, “When it’s done let me know.”
Innocenti said that FBI agents who have experience with these matters told him that Nigerian-origin subjects sometimes use the words “aza” (sometimes “azar,” “azza,” or “azah”) or “house” to refer to a bank account used to receive proceeds of a fraudulent scheme. He said the word “house” is also sometimes used to refer to a bank itself.
He said he observed that, in other messages with ABBAS, Coconspirator 1 used the term “azza,” in addition to using the term “house.”, adding that While Coconspirator 1 is not Nigerian, he is known to have communicated with multiple Nigerian-origin coconspirators.
On July 3, 2019, Coconspirator 1 reported to ABBAS, “Brother I can’t send from uk to Mexico they keep finding out, but uk 2 uk these guy keep paying and I can show u my last week cashout.” He also added that another coconspirator “has acces to a European bank and want to initiate a MT103/202 10-50 million if u know about it.”
“I know based on my training and experience that MT103 and MT202 are types of SWIFT messages. It thus appears that Coconspirator 1 was referencing a cyber-heist scheme in which a coconspirator would be able to make fraudulent transfers of 10 million to 50 million in dollars or euros” the affidavit said.
