Not realizing the difference in the letters "e-mail", a Singapore company was cheated of IDR 32 billion

The National Police revealed that cyber crimes arise because of the shrewdness of the perpetrator and the negligence of the victim.

JAKARTA, KOMPAS — The Indonesian National Police has succeeded in uncovering a case of alleged data manipulation via business electronic mail which resulted in a Singaporean company suffering losses of up to IDR 32 billion. The company did not realize that the electronic mail address (e-mail) of the partner requesting the transfer was a fake email.

Director of Cyber ​​Crime Bareskrim Polri Brigadier General (Pol) Himawan Bayu Aji in a press conference, Tuesday (7/5/2024), said that the case began with the actions of several people who committed manipulation of data or business emails of PT Huttons Asia which has business relations with Kingsford Huray Development Ltd. The perpetrators used email using the name PT Huttons Asia, namely PT Hutton Asia International.

"The modus operandi of the perpetrators is to trick the victim by using a fake e-mail address, namely changing the position of the alphabet or adding one or more alphabets to the e-mail address so that it resembles the original," said Himawan.

The perpetrator committed fraud by using electronic mail in the name of PT Hutton Asia International and sending notification of a change in email address from arhuttonsgroup.com to arhuttongroups.com. In fact, the electronic mail does not belong to PT Huttons Asia, the original company. The incident occurred on June 20, 2023 in Singapore.

BENEDIKTUS KRISNA YOGATAMA

Four modes of Social Engineering fraud, financial services cybercrime. Source: Financial Services Authority.

The perpetrator then sent a bill created by the perpetrator who was in Indonesia through one of the banks in Indonesia. The account was then used for business transaction payments. Afterwards, Kingsford Huray Development Ltd transferred money to the account created by the perpetrator, resulting in PT Huttons Asia experiencing a loss of Rp 32 billion.

"In cybercrime, there are always two things involved - negligence and cunningness. What is negligence? Negligence is when data owners or victims are usually complacent with situations like this," said Himawan.

Later, the NCB Singapore wrote a letter to the International Relations Division of the Indonesian National Police as part of the investigation into the case. This was documented in the police report A/12/VIII/SPKT on August 18, 2023.

The modus operandi of the perpetrators is to trick the victim by using a fake e-mail address, namely changing the position of the alphabet or adding one or more alphabets to the e-mail address so that it resembles the original.

On April 25, 2024, the Indonesian National Police investigators arrested five suspects consisting of four men and one woman in Jakarta. Two of them were foreign nationals, namely EJA and CO alias O from Nigeria. The other three were DM alias L, YC, and I. All five suspects have been detained since April 26, 2024.

A Nigerian citizen named Henry Cidum was also arrested for using gorilla tobacco. The police then handed over the Nigerian resident to the immigration office because he did not have any identification.

Currently, the Indonesian National Police investigators are also searching for a Nigerian citizen with the initial S. He is suspected of playing a role in hacking and communicating with the company Kingsford Hooray Development Ltd.

The role of the perpetrator

In carrying out their crime, the five perpetrators had their respective roles. Suspect CO or O ordered L and E to find someone and establish a company named PT Hutton Asia International, and become directors of the company. Both of them were also asked to create a company account to accommodate the proceeds of the crime.

JOHANES GALUH BIMANTARA

The atmosphere of the GovWare cyber security technology exhibition, which is part of the Singapore International Cyber Week (SICW) 2023, on Thursday (19/10/2023), at Marina Bay Sands, Singapore. Several technology companies are promoting their cyber security services.

The suspect DM alias L recruited YC and I to form a fake company under the name PT Hutton Asia International. The suspect DM alias L is a recidivist from Polda Metro Jaya in the case of business electronic mail fraud and a recidivist from Bareskrim Polri in the case of counterfeit money.

The suspect YC played a role in creating the establishment deed of PT Hutton Asia International to open a bank account used to store proceeds from criminal activities. He will receive a commission of 5 percent of the value of money that will enter the fake account. As for suspect I, together with YC, they created a fictional company with I serving as the director. Suspect I received a commission of 10 percent of the money that came in.

"So, this is a criminal act by a syndicate because their modus operandi is that these Nigerian citizens exploit Indonesian citizens who are here to create fake companies," said Himawan.

The suspects were charged under Article 51 Paragraph 1 juncto of Law Number 19 of 2016 concerning Information and Electronic Transactions and/or Article 378 and Article 55 Paragraph (1) of the Code Law Criminal Code (KUHP) as well as Article 82 and Article 85 of Law Number 3 of 2011 concerning Fund Transfers and/or Article 3, Article 5 Paragraph (1), Article 10 of Law Number 8 of 2010 concerning Prevention and Eradication of the Crime of Laundering Money.

KRISTIAN OKA PRASETYADI UNTUK KOMPAS

Three mobile phones seized by the Tangerang Police will be examined in the information technology laboratory of the Cyber Subdirectorate of the Criminal Investigation Directorate of the Jakarta Metropolitan Police Special Region.

From the search, investigators seized evidence in the form of 32 billion rupiahs, four passports, 12 mobile phones, one laptop unit, one detachable disk, five bank books, and 20 ATM cards. Investigators have examined seven witnesses and five experts to strengthen the investigation of this case.

Intermediate Investigator of the National Police Criminal Investigation Unit, Senior Commissioner Roland Ronaldy, said that to hunt down the Nigerian citizen with the initials S, his party had coordinated with Interpol and submitted a red notice to Interpol.

Learning from this case, Head of the Public Information Bureau of the Indonesian National Police's Public Relations Division Brigadier General (Pol) Trunoyudo Wisnu Andiko urges the public to be vigilant when receiving communication through electronic mail. This is because a difference of one letter in an email can have different impacts.