Document fraud, money laundering and the online trade in illicit goods and services are the engines of organised crime. These cross-cutting criminal threats enable and facilitate most, if not all, other types of serious and organised crime. The business models of OCGs active across the spectrum of serious and organised crime rely on document fraud, money laundering and online trade to maintain their criminal enterprises.
Click here to open this image
Money laundering sustains and contributes to the growth of criminal markets across the EU.
Money laundering is linked to virtually all criminal activities generating criminal proceeds.
Money laundering allows OCGs to introduce the proceeds of crime into the legitimate economy. Almost all criminal groups need to launder profits generated from criminal activities. However, the way in which money laundering is carried out varies greatly depending on an OCG’s level of expertise as well as the frequency and scale of money laundering activities. Criminal networks continuously seek to exploit the latest technological developments such as cryptocurrencies and anonymous payment methods. Rapid transaction processing and the proliferation of effective anonymisation tools are significant obstacles in the identification of the beneficial owners of criminal proceeds. A growing number of online platforms and applications offer new ways of transferring money and are not always regulated to the same degree as traditional financial service providers. Money launderers heavily rely on document fraud to facilitate their activities. Fraudulent documents such as false invoices and forged ID documents are used to conceal the origin of criminal cash, to open bank accounts or to establish shell companies. Money launderers provide services to both organised crime and terrorist organisations.
OCGs increasingly use money laundering syndicates acting as illegal service providers to launder money. In exchange for a commission of between 5% and 8%, these syndicates offer complex laundering techniques and carry out the laundering operations on behalf of other OCGs.
In 2015, Europol supported Spanish authorities in dismantling a Chinese network involved in the laundering of criminal proceeds from THB for labour exploitation, the production of counterfeit goods as well as excise tax fraud. Relying on middlemen and third parties, the OCGs had established complex corporate structures and various accounts to transfer money to China. In addition to their main criminal activities, the group also offered money laundering and international remittance services to other OCGs based in the EU in exchange for a negotiated percentage of the laundered funds. Between 2009 and 2015, the European branch of this OCG had laundered more than EUR 340 million.
Cash remains at the core of the money laundering business. Cash continues to be smuggled by couriers and, increasingly, by post and parcel services.
In 2016, a Joint Investigation Team (JIT) composed of French, Belgian and Dutch investigators, Eurojust and Europol dismantled a complex network involved in the laundering of drug trafficking proceeds based in Morocco. Cash couriers travelling by car collected up to EUR 1 million per month in cash across Western Europe and transported it to Belgium and the Netherlands to be transferred to Morocco via the Middle East using the Hawala system. The operation resulted in the seizure of more than EUR 7.1 million in cash.
Trade-based money laundering is a highly effective way of concealing criminal funds by manipulating or forging purchases or sales using double invoicing, false invoicing, over- and under-invoicing by companies that are owned by OCGs, their associates and relatives.
A 2016 investigation by French, Spanish, German and Dutch law enforcement authorities disrupted an OCG laundering the proceeds generated by the trade of heroin. This OCG collected proceeds throughout the EU and laundered the funds in Middle Eastern countries relying on cash couriers and tradebased money laundering techniques. The OCG purchased expensive second-hand cars, heavy machinery and construction equipment in Germany in cash and exported them to Iraq where they were again sold for cash. The group then used Money Service Businesses and Hawala to introduce the funds into the legitimate financial system, leaving virtually no paper trail.
New payment methods such as cryptocurrencies, prepaid cards, online payments and internet vouchers are continuously emerging and are generally less well-regulated than traditional payment methods. In combination with alternative banking platforms, these new payment methods allow the movement of large amounts of criminal funds. Underground banking systems are financial networks operating outside of normal banking channels to transfer money internationally, avoiding the fees and regulations of conventional banks.
The use of fraudulent documents in the EU has significantly increased. It represents a significant threat to the EU.
Document fraud is a key enabler of all types of criminal activity as well as terrorism. Document fraud is also expected to emerge as one of the fastest growing criminal markets over the coming years.
High-quality counterfeit documents are primarily produced by highly specialised counterfeiters.
Fraudulent documents are increasingly traded online and trafficked using post and parcel services.
Document fraud is a key facilitator for organised crime. Document fraud entails the production and use of counterfeit documents as well as the use of genuine documents obtained by means of deception or misrepresentation. The production and use of fraudulent documents has also been linked to terrorist actors. Document fraudsters and forgers manipulate or produce all types of identity, travel and administrative documents.
Fraudulent documents are used and traded extensively among OCGs and represent a significant obstacle in the fight against serious and organised crime. Fraudulent IDs are in high demand and are the most commonly traded type of fraudulent document. Increasingly, fraudulent documents are traded online. Online marketplaces are used by criminals to display the range of genuine documents on offer and allow document forgers to receive orders directly from clients.
BERLIN CHRISTMAS MARKET ATTACK
On 19 December 2016, a Tunisian suspect
drove a truck into a Christmas market in the
centre of Berlin, Germany. The terrorist attack
left 12 people dead and 56 others injured.
The perpetrator was a rejected asylum
seeker from Tunisia and had previously been
suspected of involvement with the Islamic
State. After his asylum claim was rejected, the
suspect travelled throughout Europe using
multiple identity documents under different
aliases.
Increasingly sophisticated security features protecting documents against forgery as well as improved technical control measures have compelled OCGs to improve the quality of fraudulent documents. Suppliers of raw materials now primarily rely on Darknet marketplaces to sell their products.
The sale or rental of travel and identity documents such as passports is an increasing concern. There has been a significant increase in the number of lost and stolen documents in circulation. Instability and armed conflicts often allow criminal groups to obtain blank documents from the affected regions. This is also true for conflict zones on the periphery of the EU and has been highlighted by the widespread availability of thousands of non-EU blank identity documents.
Fraudulent documents are multi-purpose criminal tools and each document can be used repeatedly to support different criminal activities. Documents forgers are service providers often cooperating with multiple OCGs involved in various criminal activities.
DOCUMENT FORGERY AND MIGRANT SMUGGLING6
In May 2016, Greek and Czech law enforcement authorities arrested several suspects involved in the forgery of documents and migrant smuggling as part of an international investigation supported by Europol. The forged documents were subsequently provided to irregular migrants to enter the EU or to legalise their stays there. The investigation in Greece highlighted the structure and the hierarchy of the Athens-based network. The fees for the forged documents ranged from EUR 100 to EUR 3,000 per piece depending on the quality, type and country of issue. The documents forged by the criminal group included passports, national ID cards, visas, driving licences, asylum seekers’ registration cards and residence permits.
Breeder documents are documents that are used to obtain other forms of legitimate identification for the purpose of establishing a false identity. Fraudulent breeder documents are typically used to apply for genuine travel and identity documents and driving licences. Birth certificates, marriage records, work contracts or invitations to stay in the EU are forged in order to obtain visas, residency or work permits on false grounds.
Online platforms operating in the legal economy have had a profound impact on business models, shopping experiences and customer expectations. The multiplication of sales platforms makes online trade easier, more accessible and cheaper. This development has been mirrored in the online trade in illicit goods as criminals, like legitimate traders, look to opportunities online to grow their businesses.
Virtually all illicit commodities are now traded online either on dedicated criminal online marketplaces or by exploiting otherwise legal online platforms. The number of goods on offer and frequency with which new products become available indicates that the online trade in illicit goods is thriving and highly dynamic. Commodities such as cannabis, cocaine, counterfeit currency, counterfeit medicine, cultural goods, excise tobacco, firearms, heroin, hormonal substances, specimens of endangered species, stolen vehicle parts and accessories, synthetic drugs and new psychoactive substances (NPS), as well as compromised payment card data are sold and purchased online.
It is not only illicit commodities that are traded online, but also criminal services. The expanding CaaS business model provides customers with access to a wide range of criminal services. A prime example of this is cybercrime, where customers can access such services as malware coding, Distributed Denial of Service (DDoS) services, bulletproof hosting and anonymisation services, botnet hire and money laundering.
Vendors often attempt to hide illegal goods among legal products on online platforms on the surface web. In some cases, surface web vendors redirect their customers to mirror sites on the Darknet or advertise their products using false product designations or descriptions.
The online market caters to dealers who buy in bulk for re-sale as well as individual users. The diminishing reliance on access to street networks of consumers of illicit commodities challenges the established business models in many criminal markets.
The distribution of illicit commodities via online platforms has soared in recent years and is expected to continue to increase steadily over the coming years. Online trade offers the opportunity to reach a huge number of potential customers. Illicit goods purchased online are predominantly trafficked using postal and parcel services.
THE SALE OF DRUGS VIA PHOTOSHARING PLATFORMS
Photo-sharing applications and platforms are popular with a huge number of users. These services allow users to create communities around shared interests using hashtags. Drugs dealers and users make use of these platforms to form communities to discuss, exchange information and trade various types of illegal drugs. Potential customers scroll through pictures of advertised products and then contact the dealer privately using direct messaging functionalities. The eventual transaction takes place either face to face or via online payment and delivery by mail.
The Darknet is a distributed anonymous network within the deep web that can only be accessed using software such as The Onion Router (TOR), I2P and Freenet. While these tools were ostensibly developed for the purpose of legitimately protecting freedom and privacy, confidential business activities and relationships, they can equally be used by criminals for the same purpose - to conceal their identity and/or the hosting location of websites, forums and markets, collectively referred to as “hidden services”.9
DARKNET ARMS VENDORS ARRESTED IN SLOVENIA10
Firearms traffickers use Darknet marketplaces to sell illegal firearms to private individuals, members of OCGs and terrorists based in the EU. In December 2016, Slovenian law enforcement authorities, with the support of Europol, arrested two suspects accused of selling various live firing weapons including automatic rifles, hand and smoke grenades as well as ammunition via a prominent Darknet marketplace. The firearms were paid for in Bitcoin.
It is estimated that the top 1% most successful vendors are responsible for 51.5% of all transactions on Dark markets.11 Goods and services offered on the Darknet are available to anyone, be it an individual user, an OCG or terrorist group.12
There is a shift from sales on the surface web to sales on the Darknet, typically when the status of a product or substance changes from being legal to illegal. For example, the sales of gun parts or de-activated firearms is legal in certain jurisdictions and therefore available on the surface web, but when the gun is assembled or re-activated it is illegal and will be sold on the Darknet. Likewise, a previously undiscovered New Psychoactive Substance (NPS) is initially unregulated and can be sold on the surface web, but as soon as it is regulated or restricted, sales will move to the Darknet. Dark markets are highly unstable. New decentralised markets are likely to overcome the weakness and vulnerability of being hosted in a specific location. These localised Dark markets cut out intermediaries, cater to sellers and buyers in their own language allowing them to interact directly. Transactions on local platforms enable sellers and buyers to avoid international mail systems by arranging the local collection of illegal goods.
Although the exact scale of the criminality on the Darknet cannot be fully determined as of yet, the Darknet is clearly an established criminal environment hosting an increasing number of platforms including Dark markets and other hidden services.
