For neighbours and store homeowners round the constructing he lived in, an unpainted and unplastered storey constructing, David Erubure is a internet developer and IT professional.
The home, which has about 4 flats, is in Izomo Idum Area of Warri, Udu Local Government Area of Delta State, southern Nigeria.
Many of Mr Erubure’s social media followers in all probability imagine that he runs a “successful” hosting firm.
However, some of his actions turned a topic of worldwide investigation when many of the web sites he hosted appeared in a number of fraudulent schemes.
The Norwegian Broadcasting Corporation (NRK), in partnership with PREMIUM TIMES, carried out a months-long investigation into a multi-million dollar fraudulent scheme, together with Mr Erubure’s role in it.
We discovered that Mr Erubure’s neighbours, store homeowners and social media followers should not fallacious about him. But there’s extra they in all probability have no idea about him.
From Norway to Nigeria
In Norway, a Northern European nation, funding recommendation and “genius” tips for earning money are in every single place on TikTook: rental arbitrage, home flipping, and shares you “should” purchase.
Mi Le Hagen, an influencer, likes to supply funding recommendation. The influencer has made tens of hundreds in the inventory market and often shares recommendations on how her followers can succeed.
Between September and November final 12 months, Ms Hagen began sharing funding recommendation with followers in direct messages.
“Right now I’m investing in Bitcoin and making good money from it. I can actually give you a good insight into how you can make money through Bitcoin,” she mentioned.
Ms Hagen advisable utilizing a safe funding web site for digital currencies, which have been the cryptocurrencies she claimed to have made a lot of cash from. The hottest in Norway are Bitcoin and Ethereum.
Meanwhile, there was 247autobot.com, one of the many pretend funding web sites operated as half of a giant scam community.
People who invested cash on the web site watched their supposed returns develop on the display screen. But the returns weren’t actual. The cash had by no means been invested. The scammers had merely stolen it.
“Oh my God. I was scammed out of 23,000 NOK (approx. $2,100),” mentioned a sufferer who didn’t wish to disclose their actual identify. That’s about N3.3 million utilizing the present trade fee of N1,344.45 per US dollar.
NOK stands for Norsk Krone, which interprets to Norwegian krone in English. It is the official foreign money in Norway
This is the story of a refined fraud community that has deceived folks round the world, and the hunt for the ones who make it doable.
Mii versus Mi
Mi Le Hagen understands that her followers are hungry for fast cash. So, she wishes to offer them smart steering on saving and index funds. But somebody, a scammer, was busy doing the reverse.
The particular person, posing as Ms Hagen, had copied her TikTook profile and was sending direct messages to her followers, some of whom sadly fell for the scam.
When she realised at first, she expressed shock that she was well-known sufficient for folks to be copying her on TikTook. The followers contacted her – both to complain that they had misplaced cash or needed to warn her about the pretend accounts.
The pretend profile created by the scammers was virtually indistinguishable from the actual one. In reality, the scammers copied many images and posts from Ms Hagen’s actual account. Some of the pretend accounts even had extra followers than hers.
“It affects my good name and reputation. I give guidance on long-term saving, not speculative tips meant to deliver short-term profit,” Ms Hagen informed NRK.
The influencer was devastated. The pretend profiles blocked her, in order that they have been solely seen to her followers.
She didn’t know cease them. All the whereas, new copy accounts stored showing, and her followers have been in danger of being deceived.
The investor wolf in sheep’s clothes
To unmask the identification of the scammer, the NRK was helped by Daniel Christensen, an moral hacker who likes to hunt cybercriminals and expose fraud.
Mr Christensen had helped comic Johan Golden to find who was utilizing his face and identification to scam folks. During the time, he found clues that led him to a group of scammers working on TikTook.
The scammers thought that they had tricked one other particular person into investing cash on the web site that they had arrange. They didn’t know that Mr Christensen was the wolf, and not the sheep.
“I could see immediately that the website (247autobot) was not legitimate,” Mr Christensen informed NRK.
The scammers believed that that they had satisfied a new particular person to speculate cash by way of their pretend web site. But they didn’t know they have been coping with a man who was secretly in search of coding flaws – weaknesses in the scammers’ web sites that would assist to expose them.
It didn’t take Mr Christensen a lot time to get to the back-end of the web site. What he noticed as the website’s function was unmistakably clear: to scam folks out of as a lot cash as doable.
As he investigated the scam web sites, extra and extra stored showing. All with lists of unwitting buyers. All with the similar coding flaw.
The lady on the listing
One of the folks on the listing was a nurse from the United States. Mr Christensen observed that she had not too long ago deposited cash into the web site.
“She was about to deposit more, so I called her,” Mr Christensen recalled.
He warned her that the web site was a scam, however it took a number of calls earlier than she was satisfied. He stopped her from transferring one other 3,200 NOK (about $320), utilizing the trade fee at the time.
However, she had already misplaced about 20,000 NOK (about $2,000) at the time, in keeping with her. Mr Christensen shortly understood that he couldn’t name everybody on the listing.
He thought of one other thought: Changing the cost tackle on the web sites. That means, the cash would come to him fairly than to the unknown scammers who had created the websites.
Mr Christensen’s plan was to ship the a reimbursement to the individuals who had been scammed. At first, the plan labored. But it didn’t final lengthy. The scammers quickly stopped his try. After that, all the web sites confirmed the similar clean white web page the place the cost addresses had been.
Determined to uncover the scammers, Mr Christensen checked out the investor lists once more. One identify caught his consideration. The particular person known as himself “Eagleworker” and had an investor profile on many of the web sites.
Later on, Mr Christensen shared all his findings with NRK: He had discovered 100 fraudulent funding web sites. But NRK subsequently discovered over 200 extra of such web sites.
The web sites shared a number of options, making it clear that they have been half of the similar scam community and the similar origin. Sixty of the web sites had a safety flaw that made it simple to entry their back-end programs. Fifty-five contained a Norwegian cellphone quantity, whereas some customers had uploaded their passports to confirm their identities.
When contacted for feedback, a number of victims – who lack hope of doable restoration of the funds – refused to talk. They have been ashamed to offer the particulars of the scam. A couple of, nonetheless, have been prepared to talk on the foundation of anonymity.
Most of them narrated that they created funding accounts at the urging of Norwegian TikTook profiles they adopted — together with the one which imitated the influencer, Ms Hagen.
Others described lengthy on-line conversations with pleasant individuals who finally advisable investing in cryptocurrency. They hoped for fast returns.
But the returns would change into unimaginable to money out, as a result of each time they tried to withdraw their cash, they have been informed to pay one other charge or tax first.
“I was trusting and I was manipulated. The money I handed over, I will never get back,” one Norwegian sufferer mentioned.
N86 billion misplaced to scammers
NRK has recognized over 140 cost addresses on the scam web sites. Together, these addresses had obtained greater than 12 million NOK (about $1.2 million at the time). This is about N1.6 billion, utilizing the present trade fee.
The cost addresses are modified often and the scammers ship the cash onward as quickly as it’s obtained. This makes it tough to hint the place the cash goes.
However, whereas working for NRK, crypto analyst Arild Møller-Holst from KPMG Norway adopted the path of the cash.
Mr Møller-Holst discovered that the cash was despatched to a minimum of 54 totally different crypto addresses linked to cryptocurrency exchanges. These accounts had obtained round 700 million NOK (about $74 million). The sum is roughly NI00 billion utilizing the present trade fee.
Mr Møller-Holst informed NRK that there are two prospects: both the folks behind these accounts are instantly concerned in the scam, or they’re skilled cash launderers who assist criminals transfer and conceal stolen cash.
Connecting the scam community to Erubure
For most individuals, a web site is just what they see on the display screen— textual content, photographs, and movies. But for moral hackers like Mr Christensen, a web site is far more than that.
While analyzing the hidden elements of a scam web site, Mr Christensen discovered one thing uncommon: a perform that would create a web-based retailer by way of the area “storevase.com.”
More than 20,000 on-line shops have been mentioned to have been created by way of StoreVase, in keeping with the web site.
The platform claims that its aim is to make e-commerce accessible to companies throughout Africa.
Driven by elevated curiosity, Mr Christensen determined to dig deeper. What he discovered was revealing: A scam funding web site, firstapexpips.org, shares elements of its code with storevase.com.
StoreVase was finally linked to iSkySoftic, Mr Erubure’s firm. The iSkySoftic’s identify appeared on the login web page of the scam web site.
The scam lodge
Mr Erubure is listed as the managing director and technical director of the IT firm iSkySoftic LTD. The firm claims to offer web site templates and a place to host them, which is named hosting.
On his private Facebook profile in 2020, he shared two posts exhibiting that iSkySoftic was providing templates for funding web sites.
Business seems to have been going effectively. On two events, Mr Erubure enticed job seekers by promising a mouth-watering wage.
However, the internet hosting supplier was additionally full of fraudulent web sites.
We tracked down previous web sites and digital accounts linked to Mr Erubure. In 2017, a web site registered in his identify printed the weblog publish “How to start your own Ponzi scheme in Nigeria”.
He has created many accounts on-line and used many nicknames. A recurring one has been variations of “eagle.” In 2018, Mr Erubure used this eagle as his Banner picture on Facebook.
On Mr Erubure’s internet host, “Eagleworker” was the identify that the majority typically appeared on the web sites as an investor. On greater than 25 pretend funding web sites, “Eagleworker” has registered a person account.
These person accounts have been apparently used to check that the pretend funding web sites have been functioning as supposed.
We discovered that Crypto addresses linked to the web sites have obtained a minimum of $1.2 million (about N1.6 billion). But the crypto addresses are half of a a lot bigger income of $74 million (roughly N100.02 billion), in keeping with an evaluation carried out by the consulting agency KPMG Norway on behalf of NRK.
What our investigation reveals
Our investigation means that Mr Erubure is behind the Eagleworker identification. Could he even have been concerned in operating fraudulent web sites linked to his hosting?
NRK discovered two situations the place these identities seem collectively. On a crypto platform, there was an account with the username “eagleworker” linked to Mr Erubure’s cellphone quantity and identify.
The scam hunt
For two days, a PREMIUM TIMES reporter tried to contact Mr Erubure for a response. He rejected all the calls with out returning them, despite the fact that he didn’t know who was calling at the time.
Meanwhile, earlier than then, we had obtained, by way of our investigations, a cell phone quantity mentioned to belong to a possible member of the family of Mr Erubure. Truecaller recognised the quantity as belonging to “Jennifer Hassan.”
On 3 July, a PREMIUM TIMES reporter recognized and visited Mr Erubure’s former home in Warri, Delta State.
The constructing is a multi-family residential construction, which seems to be underneath renovation, with some ground-floor home windows open and unfinished. One flat was being occupied by an unidentified particular person, mentioned to be a member of the family.
Based on interactions with a number of neighbours and store homeowners round the space, we established that Mr Erubure was staying at the house till not too long ago, when he obtained married and moved to an undisclosed location in the similar Warri.
During interviews with neighbours and store homeowners round the space, PREMIUM TIMES encountered Jennifer. Her obvious nervousness at first when she was proven Mr Erubure’s {photograph} and when she heard his identify talked about didn’t instantly ship a message till a lot later. Even when she recognized herself as Jennifer, there was no inkling that she was the particular person we had earlier recognized as Mr Erubure’s possible member of the family.
“I hope there is no problem?” a visibly anxious Jennifer repeatedly requested our reporter after acknowledging that she has recognized Mr Erubure for a very long time. But she was unwilling to share any details about him.
The reporter then posed as an official of a Nigerian financial institution who had come to search out out why he had not delivered a supposed internet improvement contract he had facilitated for him on behalf of the financial institution.
Jennnifer, feeling relieved, confirmed that Mr Erubure had moved out of the household home after getting married. She excused herself to get Mr Erubure’s spouse’s cell phone quantity from a store proprietor close by, however returned minutes later, claiming she couldn’t get it.
We noticed that Jennifer contacted somebody over the phone, suspected to be Mr Erubure. On her return, she appeared to have taken the journalist’s {photograph} along with her cellphone.
Our reporter requested her for her cellphone quantity for a potential follow-up and instantly checked it on Truecaller when she offered it. When the app recognized her as Jennifer Hassan, the reporter was left dumbfounded.
“I’ll keep you updated,” she assured the reporter earlier than parting methods.
Curiously, barely half-hour later, Mr Erubure started calling the PREMIUM TIMES reporter. The journalist then texted him, promising to name him again after an “ongoing meeting” in the workplace.
“Ok,” Mr Erubure responded.
He didn’t reply to subsequent calls on his cellphone line. On 3 August, the journalist forwarded a lengthy textual content message to him, asking for his touch upon the consequence of our investigation, which discovered that a number of fraudulent web sites have been linked to his hosting. He didn’t reply both.
Mr Erubure later contacted the journalist with one other cell quantity, which Truecaller confirmed as his.
“Hello. I know I am speaking with David. Let’s….” the journalist mentioned upon listening to Mr Erubure’s faint “hello.” But he instantly ended the name and refused to select up subsequent calls on the line.
The similar day, we contacted Jennifer and confronted her with our findings. She denied involvement in any fraudulent funding web site and claimed she doesn’t know Mr Erubure, regardless of admitting understanding him earlier than.
Under the knife
On 10 August, NRK despatched a 1,100-word e-mail with allegations and inquiries to Mr Erubure. He replied after 37 minutes.
“Hello, I’m glad to hear from you and I believe there may be errors in your investigations,” he tells NRK.
The 32-year-old confirmed that the internet host belongs to his firm, however says he and iSkySoftic should not concerned in any kind of fraud.
If it seems that his clients are concerned in fraud, he’ll take the applicable measures, he mentioned.
When requested to reply to our place that over 300 web sites linked to his internet host might be tied to varied varieties of fraud, he mentioned:
“OK, I can’t certainly tell which are engaged in fraud though, but I believe if the investigation proves they are into fraud then the right steps should be taken. But from this list, although long, I notably can pin one that is a printing company.”
On promoting web site templates for funding web sites, Mr Erubure admitted that his firm beforehand offered web site facades, however not full web sites.
This was discontinued a few years in the past, he mentioned.
But on 21 August, he mentioned:
“We didn’t say we sell investment templates, we sell scripts generally and code snippets which most likely buyers converted into investment templates.”
He argued that the web site templates themselves can be utilized for good or dangerous functions. That is as much as the purchaser.
“Knife used for cooking can create joy, but it can also be used for wrong purposes,” Mr Erubure mentioned in writing to NRK.
When requested what he would say to those that have misplaced their cash to web sites hosted by him, he mentioned: “I’m deeply sorry and perceive what it means for somebody to lose cash as I’ve been a sufferer too.
“I learnt something from our conversations this past week. What I am sure to do from hence forth is to do a follow up check on websites hosted on our infrastructure.”
The Eagle behind the curtain
Recall that on a crypto platform, there was an account with the “eagleworker” related to Mr Erubure’s cellphone quantity and identify.
When interrogated on that, he replied: “It must have been someone who knows me who set up an account in hopes of recruiting me.”
He has additionally printed a YouTube video with a recording of his personal display screen. In the video, the browser suggests 5 beforehand used e-mail addresses. One is utilized by eagleworker, and two of them belong to Mr Erubure.
The browser’s autofill reveals e-mail addresses linked each to Mr Erubure and to the “Eagleworker” username.
“I don’t operate that email, but I might know the person that does,” he mentioned.
He continued: “The video was recorded on a publicly available computer when I was training to become a web developer many years ago. Eagleworker must have used the same machine and browser.”
NRK has repeatedly requested Mr Erubure who he thinks Eagleworker may very well be if it’s not him. He has but to get again on that.
We discovered that Mr Erubure deleted some photographs on his Facebook profiles on 8 August, barely 24 hours after PREMIUM TIMES contacted some people with investor accounts on the fraudulent web sites hosted on his infrastructure.
Mr Erubure admitted eradicating the photographs, however defended his motion.
“Well it’s normal once a while to delete items I believe you must have done same..,” he mentioned.
Back to Norway
Back in Oslo, Norway’s capital, the content material creator Ms Hagen was offered with the findings of this investigation.
“It is possible to follow the money to Nigeria,” she mentioned.
She believes too little is being finished and is asking for decisive motion.
“I wish that at a higher political level, there would be international cooperation to stop the scammers more quickly,” she added.
Cyber fraud: What Nigerian legal guidelines say
There isn’t any indication that Nigerian companies are presently investigating Mr Erubure, nor has he been discovered responsible of any crime.
However, fraud of any variety is against the law in Nigeria.
Section 1(1) of the Advance Fee Fraud and Other Fraud Related Offences Act 2006, as an illustration, offers that a one who, by false pretence and with intent to defraud, obtains property from one other particular person “in Nigeria or in any other country” commits an offence.
This additionally covers inducing a particular person abroad to ship property or confer a profit. The Act, underneath its Section 1(3), prescribes “imprisonment for a term of not more than 20 years and not less than seven years without the option of a fine” for convicted offenders.
Nigeria additionally has the Cybercrimes Act, initially enacted in 2015 and amended in 2024. This laws offers with numerous varieties of computer-related fraud.
Section 14(2) of the Act makes it a crime for a particular person, with intent to defraud, to ship an electronic mail that materially misrepresents details, inflicting the recipient or one other particular person to endure harm or loss.
Offenders face a minimum of 5 years’ imprisonment and a high quality of a minimum of N10 million, or each, in keeping with the subsection of the Act.
But any computer-related fraud, similar to fraud dedicated by way of scam funding web sites, falls underneath the Cybercrimes Act 2024, a senior Nigerian lawyer, Monday Ubani, informed PREMIUM TIMES.
Mr Ubani mentioned that if the matter is investigated and culprits recognized, they might be tried underneath the Cybercrime Act.
“The facts of the case will determine the charges to be filed against an offender, but it will generally come under the Cybercrimes Act (2024),” Mr Ubani, a Senior Advocate of Nigeria, says.
Discover extra from Premium Times Nigeria
Subscribe to get the newest posts despatched to your e-mail.
