FBI: VCU lost $470,000 to a Scammer Posing as a Nearby Construction Company.

The FBI reported on Wednesday that a Virginia Commonwealth University employee sent $470,000 to a group of Nigerian con artists who had stolen millions of dollars from universities, construction firms, and governmental organizations in Virginia, North Carolina, and Texas.

Advertisements

In Virginia federal court, Olabanji Egbinola, 42, was accused of wire fraud, conspiracy to commit wire fraud, money laundering, and conspiracy to commit money laundering after the FBI extradited three Nigerian individuals from the United Kingdom.

The FBI alleges that Egbinola defrauded VCU in the fall of 2018 by claiming to be a Richmond construction company doing business with the university.

A VCU spokesman said the university recovered a significant portion of the money through insurance. The university also implemented safeguards to protect against future instances of fraud.

WWBT, Richmond’s NBC affiliate, previously reported the story.

Online scammers often target real estate purchasers, the elderly and others by persuading them to make wire transfers to bank accounts the criminals control. The scammers may impersonate an employee or business partners, and they are often members of transnational criminal organizations that originated in Nigeria and spread throughout the world, the FBI said.

The following account of the scam is based on an FBI news release and a criminal complaint filed in federal court.

In the fall of 2018, someone using the name “Rachel Moore” contacted an employee in the procurement department at VCU using the email address “accounts@kjellstromlee group.com.” Kjellstrom and Lee is a construction firm located in Richmond that has done business with VCU. Its email address is similar to the one used in the scam.

The scammer wrote that Kjellstrom and Lee’s bank account was being audited and asked if VCU could send the next payment to a foreign bank account. The scammer and the VCU employee corresponded several times over the course of three months.

“Hope you are good,” the scammer wrote. “Can you please notify us at remittance@kjellstromleegroup.com when a payment has been made.”

On Dec. 20, 2018, VCU sent $469,819.49 to an account with the Bank of Hope. On Jan. 3, VCU’s bank contacted the university, concerned the payment was made to a fraudulent account.

VCU contacted Kjellstrom and Lee and learned the construction company doesn’t employee a Rachel Moore.

The roughly $470,000 could not be recovered. Authorities claim the money was redistributed through at least 50 wire and check transactions in the five days after VCU sent it.

An investigation by the FBI’s Richmond Division determined that someone used the account “bridgetclark” to create fraudulent email addresses through the internet domain registrar NameCheap Inc. The scammer registered more than 50 domains with names similar to legitimate construction companies.

The scammer who created the bridgetclark account used a variety of techniques to conceal his or her identity. The account was paid for using Bitcoin cryptocurrency, which is hard to trace. The scammer also used a virtual private network, known as a VPN, to conceal his or her IP address and physical location.

In February 2019, the FBI sent a network investigative technique, or NIT, to the fraudulent email address used in the scheme. An NIT is a technology used by the government to gain access to a computer.

Once the scammer opened the email and its attachment, a file was executed, providing data to the FBI, including the IP address of the computer that opened the attachment.

The scammer was in the United Kingdom. Police in the United Kingdom determined that the IP address originated from a two-story brick house in Chafford Hundred, about 20 miles east of London.

Authorities say one resident of the home was Egbinola, the man charged this week by U.S. authorities.

Egbinola has a criminal history, U.S. authorities said. In 2008, officials say, U.K. police arrested him on suspicion of money laundering and discovered a large quantity of U.S. currency at his residence. His computer contained information related to bank accounts of individuals who were victims of fraud. It’s unclear if Egbinola was ever tried for the crime.

In 2015, Egbinola traveled to Los Angeles, and the address he visited is associated with another investigation of fraud and money laundering. When traveling to the U.S., Egbinola listed his email address as aegbinola@gmail.com. The FBI says Egbinola used that email address to communicate with another address that is the subject of an FBI investigation for scamming construction companies in North Carolina.

The FBI also arrested Oludayo Kolawole John Adeagbo, 43, a Nigerian citizen and U.K. resident, and Donald Ikenna Echeazu, 40, a dual U.K. and Nigerian citizen, on suspicion of defrauding $1.9 million from a North Carolina university through an email scheme.

Adeagbo is also charged with defrauding Texas government entities, construction companies and a Houston-area college of more than $3 million.

U.K. officials arrested all three in April 2020, and the U.S. requested extradition. The defendants filed appeals, but the U.K. High Court rejected them last month.