Cornersone Quarterly Report

[] [Homeland Security Investigations Cornerstone ] --------------------------------------------------------------- October 2020 ISSUE #1 --------------------------------------------------------------- [200 Plus HSI Special Agents] Designated HSI Cornerstone Representatives across all HSI field offices. --------------------------------------------------------------- [Did You Know?] HSI Special Agents are available to provide training and share red flag indicators, criminal typologies, and methods with businesses and industries that manage the very systems that terrorists and criminal organizations seek to exploit. --------------------------------------------------------------- HSI Illicit Finance and Proceeds of Crime Unit --------------------------------------------------------------- [HSI_Contact] [Bulk Cash] --------------------------------------------------------------- Combating Financial Crime through Collaboration Cornerstone seeks to detect and close down vulnerabilities within U.S. financial, trade and transportation sectors. This mission is accomplished through proactive outreach and collaboration with businesses and industries that manage the very systems terrorists and criminal organizations seek to exploit. --------------------------------------------------------------- [COVID] Operation Stolen Promise COVID-19 has directly or indirectly affected most Americans, if not all of them. If not from the disease itself, most have at least felt its economic consequences in one form or another. Sadly, as with most disasters and tragedies in the U.S., voracious scammers and fraudsters are frequently lying in wait for an opportunity to take advantage of unsuspecting victims. The ongoing global pandemic, which has already disrupted so many lives, gave criminal organizations a chance to do just that. It supplied the opportunity to take advantage and target portions of our population that have already suffered greatly. Homeland Security Investigations (HSI) responded to this threat by creating Operation Stolen Promise (OSP) a collaborative effort to ensure the continued health and safety of the American public and the integrity of the American economy. Through OSP, HSI special agents and intelligence analysts work closely with financial institutions and law enforcement partners to identify and investigate financial fraud schemes. Throughout the pandemic, scammers and fraudsters have endeavored to illegally profit through multiple means, including fundraising for fake charities, offering online sales of counterfeit medicines and medical supplies and using various medical scams, as well as fraudulently applying for the Payment Protection Program (PPP) loans and Economic Injury Disaster Loans (EIDL) offered by the Small Business Administration (SBA). HSI is working diligently with its private and public sector partners to protect vulnerable consumer populations and the financial sector, while disrupting criminal networks who intend to exploit this crisis for their own illicit financial gain. --------------------------------------------------------------- HSI COVID-19 Financial Fraud Cases --------------------------------------------------------------- Domestic Cases [Covid19 Domestic Cases] --------------------------------------------------------------- International Cases [HSI International Covid-19 Cases ] --------------------------------------------------------------- [Los Angeles] HSI Los Angeles Disrupts $1.7 Million Loan Fraud Scheme On June 2020, HSI Los Angeles special agents initiated an investigation into Arman Manukyan, the owner of two shell entities called ARGO GLOBAL INCORPORATED (ARGO GLOBAL) and EXPRESS WIRING, which were used to submit fraudulent SBA PPP loan applications for a total loanable amount of $1.7 million. In the application process, the owner of these two entities attached fabricated tax documentation and made false representations about the operational status of the companies, and how the loan proceeds would be spent. Throughout the investigation, agents discovered that Manukyan moved money amongst his accounts to give the appearance of legitimate business transactions. At one point he wired $200,000 from one of his business accounts to an account of a precious metals dealer based in Oklahoma and told bank employees that “his accountant” instructed him to wire the funds to the precious metals dealer. As part of his PPP loan applications, Manukyan attached an Internal Revenue Service (IRS) Form 940 – Employer’s Annual Federal Unemployment (FUTA) Tax Return and IRS Form 941 – Employer’s Quarterly Federal Tax Return. The supporting documents purported to show wages and taxes paid by ARGO for tax year 2019 in the amount of $4,162,500 for his 80 employees. However, no list of employees or associates who purportedly received these wages or for whom unemployment taxes were paid in tax year 2019 were submitted. A federal arrest warrant was obtained for Manukyan, however, he has since fled the U.S. to Minsk, Belarus, and is currently a federal fugitive. An Interpol red notice was issued for Manukyan. Financial Red Flag Indicators Presented in this Case: - Cash deposits and withdrawals that are not consistent with the business or industry. Suspect purchased precious metals for a purported sewing company. - Business accounts had no payroll deductions. - Unable to verify business information or history through public records. Suspect utilized shell companies. - Over-inflation of the number of employees or reported income that is not consistent with the business type or previous history of business. Suspect claimed 80 employees. - Business address was a virtual office. --------------------------------------------------------------- [HSI Seattle] Seattle Doctor Charged With PPP Loan Fraud On June 30, 2020, special agents from HSI, the Federal Bureau of Investigation (FBI), the Federal Deposit Insurance Corporation (FDIC) Office of the Inspector General (OIG), the Department of Health and Human Services (HHS), the Small Business Administration OIG, the Internal Revenue Service – Criminal Investigations, and the Treasury Inspector General for Tax Administration (TIGTA) arrested a Seattle doctor for his part in a SBA PPP loan fraud scheme. The suspect received at least $2,768,400 through the PPP loan program by submitting false information on multiple applications. The criminal investigation revealed that between May and June 2020, the suspect filed at least nine different applications for multiple companies that did not appear to provide legitimate business functions. The suspect also falsified relevant information on the loan applications about his criminal history and eligibility to receive PPP funds. The suspect is currently facing charges of wire fraud, bank fraud, and money laundering. Financial Red Flag Indicators Presented in this Case: - Cash deposits and withdrawals that are not consistent with the business or industry. - Business accounts had no payroll deductions. - Businesses were newly formed and accounts newly opened. - Deposits were made into the business accounts and then immediately wired out. - Suspect shielded key personal information in his applications. --------------------------------------------------------------- [HSI Nashville] HSI Atlanta Investigates West-African Ring for COVID-19 Related Employment Fraud In a recent case, Homeland Security Investigations (HSI) special agents in Atlanta disrupted a large-scale unemployment insurance fraud scheme and arrested two individuals. In this joint investigation with the U.S. Secret Service, the U.S. Postal Inspection Service, the Internal Revenue Service, and the Department of Labor – Office of Inspector General, investigators worked directly with financial institutions to identify suspicious transactions that indicated that financial fraud occurred. These transactions included many ACH payments that originated from out of state. In two months time, accounts held by suspects received over $330,000 in unemployment payments and IRS refunds and/or stimulus payments. Funds were then withdrawn through various debit card transactions throughout the Atlanta area. Further, approximately $64,000 was used to purchase U.S. Postal money orders at various U.S. Post Offices in the Atlanta Metropolitan area. This fraud network is believed to consist of hundreds, if not thousands, of money mules with potential losses in the hundreds of millions of dollars. Money mules transfer illicit proceeds on behalf or at the direction of another individual or organization. The origin of the funds may or may not be known to the money mules making them either an additional victim of crime or a coconspirator. The financial institutions targeted in this scheme have been at all levels including local banks, credit unions, and large national banks. Financial Red Flag Indicators Presented in this Case: - Individuals on visitor visas opening accounts on the behalf of U.S. based companies. - Only source of funds is State and Federal tax authorities and income is not in line with their stated business. - The customer’s bank account starts to receive transactions that do not fit his or her history of typical transactions, to include overseas transactions, or the customer purchases large amounts of convertible virtual currency or purchases large amounts of U.S. Postal Money Orders. - Financial institutions suddenly see transactions using a debit card in a place geographically different from the account holder or in a manner inconsistent with transaction history. --------------------------------------------------------------- Red Flag Indicators of PPP & EIDL Fraud for Financial Institutions - Multiple loan applications among several financial institutions. - After the issuance of a PPP loan to a customer, there is no additional transaction activity such as employee payroll check transactions, rent, or utility payments. - Requested loan amount does not match the previous financial transaction history of the employer or company. - Over-inflation of the number of employees or reported income that is not consistent with the business type or previous history of business. - Wages reported for employees are not consistent with job function or all reported wages are the same regardless of job function. - Financial transactions since February 2020 are inconsistent with previous financial activity or normal business activity. - Supporting loan documents (IRS documents, form I-9) are submitted with updated forms that were not available during the date of use, expired forms, or backdated forms. - Unable to verify business information or history through public records. - Businesses with an EIN issued between February 2020 – present. - Businesses with COVID-19 in the name or any business that references COVID-19 related testing, supplies, or treatments. - Irregular International wires citing COVID-19 related relief, testing, or treatment. - The use of altered tax documents. - Omission of criminal history or failure to disclose previous legal proceedings as part of the loan application. --------------------------------------------------------------- Financial Institutions Can Proactively Combat PPP & EIDL Fraud - Proactively conduct follow-up interviews for any questionable information provided for loan applications. Collect and confirm basic application information such as name, DOB, SSN or EIN, residential and business addresses, and business type/history. - Compare monthly payroll and operating expenses to the requested amount of the PPP loan. - Monitor customer account money flow comparisons before and after the PPP loan was issued to identify possible fraud related to inflated number of employees. - Be aware of newly opened businesses without basic functional requirements to operate, disqualifying circumstances such as expired business licenses and applicant’s prior criminal history. [CORNERSTONE Connect Bar] IF YOU WOULD LIKE LEARN MORE ABOUT THE CORNERSTONE PROGRAM OR WOULD LIKE TO REQUEST FINANCIAL TRAINING PLEASE CONTACT US AT CORNERSTONE@DHS.GOV --------------------------------------------------------------- For more information about HSI and our mission please click [here.]( To report suspicious activity, call 1-866-347-2423 or complete our [tip form](. --------------------------------------------------------------- [DHS ICE Cool Grey] [Privacy Policy]( | GovDelivery is providing this information on behalf of U.S. Department of Homeland Security, and may not use the information for any other purposes. [Modi]([fy subscriptions]( | [Delete profile]( | [Help]( --------------------------------------------------------------- This email was sent to {EMAIL} by: U.S. Immigration and Customs Enforcement (ICE) · U.S. Department of Homeland Security · Washington, DC 20528 · 202-732-4242 [GovDelivery logo](