Case studies

Vishing scammers prosecuted thanks to digital forensic analysis

SABRIC received a request from law enforcement to analyse several hard disc drives, mobile phones, flash drives, SIM cards and micro-SD cards that were recovered from suspects involved in vishing scams. A vishing scam happens when a fraudster phones a bank customer pretending to be calling from a bank’s call centre to inform them that their details have been compromised and that their bank accounts are to be blocked. Personal information is
used to manipulate the victim into sharing or confirming confidential information such as their online banking login credentials and bank card PIN numbers. Data extracted from seized devices contained:

  • Spreadsheets containing thousands of entries of personal information including names and surnames, identification numbers, bank names and account numbers.
  • Images of identification documents, company documents and temporary permits for asylum seekers. SABRIC prepared and analysed the data so that:
    • Law enforcement and the Criminal Justice System could use the evidence in their criminal investigation to prosecute the suspects.
    • The data could be used by SABRIC members to proactively identify if any fraud had been committed against their clients and
    • SABRIC members could improve client authentication, while taking additional steps to further protect customers against fraud.

Business email compromise (BEC) happens when an attacker hacks into an email account and impersonates the real owner for the purposes of defrauding the owner, a company, its customers, partners, and/or employees to send money or sensitive data to the attacker’s account. This case study saw a significant criminal mastermind arrested in Gauteng for their involvement in business email compromise fraud.
Video footage was recovered from one crime scene and SABRIC was requested to prepare still images of the suspect from this footage to be used as evidence. The images linked the suspect to multiple new crime scenes, with each scene leading to the identification of new accomplices resulting in the arrest of several perpetrators for fraud.
Upon arrest, multiple devices were recovered and sent to SABRIC for processing and analysis. Various deposit slips, fraud templates and letters of transactions were recovered from these devices linking the suspects to even more crimes.
SABRIC prepared and analysed the data so that:

  • The evidence could be used by law enforcement and the Criminal Justice System in their criminal investigation to prosecute suspects and
  • SABRIC members and law enforcement could collaborate to investigate if any fraud had been committed against banking clients.

Law enforcement conducted a take down on a fraud syndicate seizing numerous electronic exhibits which SABRIC assisted in acquiring, processing, and analysing.
Data extracted from these devices contained:

  • PDF documents comprising bank statements and SARS documents.
  • Images of bank cards, identification documents, bank statements and tax invoices.
  • Excel spreadsheets containing personal information as well as vehicle registration templates.
  • Word documents containing bank confirmation letters and Eskom billing statement templates.
    SABRIC prepared and analysed the data so that:
  • The evidence could be used by law enforcement and the Criminal Justice System in their criminal investigation to prosecute suspects.
  • The data could be used by SABRIC members to proactively identify if any fraud had been committed against their clients and
  • SABRIC members could enhance client authentication processes, along with steps to further protect customers against fraud.

An accused was convicted and sentenced to 10 years’ imprisonment after SABRIC and its member banks supported investigations and compiled linkages in matters from 2012 to 2014 where R45 million in fraudulent funds were transferred to 105 beneficiary accounts.

SABRIC was requested to support an investigation into a motor vehicle scam. The buyer of the vehicle forwarded a confirmation of payment to the seller for the release of the vehicle. SABRIC established that the proof of payment was falsified. The vehicle was not released, and the buyer was arrested.

At the request of the prosecution, a SABRIC official testified in aggravation of sentence for a cash-in-transit accused in the High Court. On handing down the sentence, the judge referred to the SABRIC testimony and the accused was sentenced on multiple counts; two of murder, two of attempted murder, one of robbery with aggravated circumstances, two of illegal possession of a firearm, one of possession of a prohibited firearm and one for illegal possession of ammunition. The respective sentences amounted to 145 years’ imprisonment.

SABRIC supported the NPA in evaluating a proposed plea bargain in which the accused was negotiating with the state for a lesser charge of malicious damage to property for an ATM attack. SABRIC compiled a comprehensive opinion and accompanied the bank representative to consult with the prosecutor. The prosecutor declined the plea bargain and went to trial with the matter. In September 2020, the two accused were both convicted and sentenced to ten, and five years of imprisonment, respectively.

In Gauteng, a joint team traced and disrupted a criminal network responsible for a large-scale, pre-paid electricity scam relating to card
fraud and theft that involved the illicit sale of electricity. During the operation luxury vehicles, laptops, bank cards and peripherals were
seized. SABRIC assisted with analysis of the evidence leading to the arrest of suspects.

SABRIC prepared a report for a bank card fraud case which the prosecutor submitted in aggravation to the court. The report was not disputed by the defence, and the accused was sentenced to an effective ten years’ imprisonment.

SABRIC assisted a law enforcement agency in the investigation of a triple murder. Three people were reported missing and later found murdered in a forest. Using transactional and other data sourced from banks, we were able to identify potential suspects linked to the murders that eventually resulted in arrests.

SABRIC was approached by a law enforcement agency to provide financial information to solve a kidnapping matter. The kidnappers were seeking a substantial ransom, and with SABRIC’s assistance, the victim was traced, and the suspects arrested.

SABRIC was approached by a bank in the United Kingdom to assist with securing information linked to fraud involving false death certificates and millions of pounds. With SABRIC’s assistance, the bank was able to mitigate potential fraud.

In Gauteng, an alert issued by SABRIC assisted law enforcement and the banking industry to investigate rogue cryptocurrency dealers who were attempting to defraud domestic and foreign investors out of millions of Rands.

Based on analysis conducted by SABRIC, criminals that were compromising banks’ client data to process unauthorised debit orders and personal loans were identified.

A case worth noting saw law enforcement retrieve stolen POS devices from under the bonnet of a vehicle after suspects were arrested for interfering with customers at a filling station. Analysis of the POS devices by the SABRIC DAC showed that numerous transactions had been conducted. When the transactional data was queried by the prosecutor, a mobile network provider was able to corroborate them thanks to SABRIC’s analysis.

In his case, three suspects approached a bank branch manager presenting identification documents and a Companies and Intellectual
Property Commission (CIPC) document disclosing a trust. The suspects then requested that the manager transfer millions of Rands from the trust account into various bank accounts. Analysis conducted by the DAC revealed details of the accounts as well as several possible syndicate members. SABRIC collaborated with bank and SARS investigators to assist law enforcement establish if any of the account data extracted was used to commit crimes.

Law enforcement arrested a suspect who was found to be in possession of a hijacked motor vehicle. Found in the vehicle were point of sale devices,  laptops, mobile phones, magnetic stripe reader/writers, SIM cards and bank cards. Analysis of these exhibits revealed several fraudulent ID documents, bank statement templates and customer credit profile reports. Fake bank statements featuring the bank name, branch code, account holder name and surname, ID number, account number and account type were also located in the vehicle.

Scroll to Top