For neighbours and store homeowners round the constructing he lived in, an unpainted and unplastered storey constructing, David Erubure is a net developer and IT knowledgeable.
The home, which has about 4 flats, is in Izomo Idum Area of Warri, Udu Local Government Area of Delta State, southern Nigeria.
Many of Mr Erubure’s social media followers most likely consider that he runs a “successful” hosting firm.
However, some of his actions turned a topic of worldwide investigation when many of the web sites he hosted appeared in a number of fraudulent schemes.
The Norwegian Broadcasting Corporation (NRK), in partnership with PREMIUM TIMES, carried out a months-long investigation into a multi-million dollar fraudulent scheme, together with Mr Erubure’s role in it.
We discovered that Mr Erubure’s neighbours, store homeowners and social media followers aren’t flawed about him. But there’s extra they most likely have no idea about him.
From Norway to Nigeria
In Norway, a Northern European nation, funding recommendation and “genius” tips for earning profits are in all places on TikTookay: rental arbitrage, home flipping, and shares you “should” purchase.
Mi Le Hagen, an influencer, likes to supply funding recommendation. The influencer has made tens of hundreds in the inventory market and usually shares recommendations on how her followers can succeed.
Between September and November final yr, Ms Hagen began sharing funding recommendation with followers in direct messages.
“Right now I’m investing in Bitcoin and making good money from it. I can actually give you a good insight into how you can make money through Bitcoin,” she mentioned.
Ms Hagen really helpful utilizing a safe funding web site for digital currencies, which have been the cryptocurrencies she claimed to have made a lot of cash from. The hottest in Norway are Bitcoin and Ethereum.
Meanwhile, there was 247autobot.com, one of the many faux funding web sites operated as half of a giant scam community.
People who invested cash on the web site watched their supposed returns develop on the display. But the returns weren’t actual. The cash had by no means been invested. The scammers had merely stolen it.
“Oh my God. I was scammed out of 23,000 NOK (approx. $2,100),” mentioned a sufferer who didn’t need to disclose their actual identify. That’s about N3.3 million utilizing the present trade price of N1,344.45 per US dollar.
NOK stands for Norsk Krone, which interprets to Norwegian krone in English. It is the official foreign money in Norway
This is the story of a refined fraud community that has deceived individuals round the world, and the hunt for the ones who make it potential.
Mii versus Mi
Mi Le Hagen understands that her followers are hungry for fast cash. So, she needs to provide them smart steerage on saving and index funds. But somebody, a scammer, was busy doing the reverse.
The individual, posing as Ms Hagen, had copied her TikTookay profile and was sending direct messages to her followers, some of whom sadly fell for the scam.
When she realised at first, she expressed shock that she was well-known sufficient for individuals to be copying her on TikTookay. The followers contacted her – both to complain they’d misplaced cash or wished to warn her about the faux accounts.
The faux profile created by the scammers was virtually indistinguishable from the actual one. In reality, the scammers copied many pictures and posts from Ms Hagen’s actual account. Some of the faux accounts even had extra followers than hers.
“It affects my good name and reputation. I give guidance on long-term saving, not speculative tips meant to deliver short-term profit,” Ms Hagen informed NRK.
The influencer was devastated. The faux profiles blocked her, in order that they have been solely seen to her followers.
She didn’t know learn how to cease them. All the whereas, new copy accounts saved showing, and her followers have been in danger of being deceived.
The investor wolf in sheep’s clothes
To unmask the id of the scammer, the NRK was helped by Daniel Christensen, an moral hacker who likes to hunt cybercriminals and expose fraud.
Mr Christensen had helped comic Johan Golden to find who was utilizing his face and id to scam individuals. During the time, he found clues that led him to a group of scammers working on TikTookay.
The scammers thought they’d tricked one other individual into investing cash on the web site they’d arrange. They didn’t know that Mr Christensen was the wolf, and not the sheep.
“I could see immediately that the website (247autobot) was not legitimate,” Mr Christensen informed NRK.
The scammers believed that they’d satisfied a new individual to take a position cash by means of their faux web site. But they didn’t know they have been coping with a man who was secretly in search of coding flaws – weaknesses in the scammers’ web sites that might assist to expose them.
It didn’t take Mr Christensen a lot time to get to the back-end of the web site. What he noticed as the web site’s function was unmistakably clear: to scam individuals out of as a lot cash as potential.
As he investigated the scam web sites, extra and extra saved showing. All with lists of unwitting traders. All with the identical coding flaw.
The lady on the checklist
One of the individuals on the checklist was a nurse from the United States. Mr Christensen seen that she had lately deposited cash into the web site.
“She was about to deposit more, so I called her,” Mr Christensen recalled.
He warned her that the web site was a scam, however it took a number of calls earlier than she was satisfied. He stopped her from transferring one other 3,200 NOK (about $320), utilizing the trade price at the time.
However, she had already misplaced about 20,000 NOK (about $2,000) at the time, in accordance with her. Mr Christensen rapidly understood that he couldn’t name everybody on the checklist.
He thought of one other thought: Changing the cost tackle on the web sites. That manner, the cash would come to him relatively than to the unknown scammers who had created the websites.
Mr Christensen’s plan was to ship the a reimbursement to the individuals who had been scammed. At first, the plan labored. But it didn’t final lengthy. The scammers quickly stopped his try. After that, all the web sites confirmed the identical clean white web page the place the cost addresses had been.
Determined to uncover the scammers, Mr Christensen checked out the investor lists once more. One identify caught his consideration. The individual referred to as himself “Eagleworker” and had an investor profile on many of the web sites.
Later on, Mr Christensen shared all his findings with NRK: He had discovered 100 fraudulent funding web sites. But NRK subsequently discovered over 200 extra of such web sites.
The web sites shared a number of options, making it clear that they have been half of the identical scam community and the identical origin. Sixty of the web sites had a safety flaw that made it straightforward to entry their back-end programs. Fifty-five contained a Norwegian cellphone quantity, whereas some customers had uploaded their passports to confirm their identities.
When contacted for feedback, a number of victims – who lack hope of potential restoration of the funds – refused to talk. They have been ashamed to provide the particulars of the scam. A number of, nonetheless, have been prepared to talk on the foundation of anonymity.
Most of them narrated that they created funding accounts at the urging of Norwegian TikTookay profiles they adopted — together with the one which imitated the influencer, Ms Hagen.
Others described lengthy on-line conversations with pleasant individuals who finally really helpful investing in cryptocurrency. They hoped for fast returns.
But the returns would develop into unimaginable to money out, as a result of each time they tried to withdraw their cash, they have been informed to pay one other price or tax first.
“I was trusting and I was manipulated. The money I handed over, I will never get back,” one Norwegian sufferer mentioned.
N86 billion misplaced to scammers
NRK has recognized over 140 cost addresses on the scam web sites. Together, these addresses had obtained greater than 12 million NOK (about $1.2 million at the time). This is about N1.6 billion, utilizing the present trade price.
The cost addresses are modified usually and the scammers ship the cash onward as quickly as it’s obtained. This makes it tough to hint the place the cash goes.
However, whereas working for NRK, crypto analyst Arild Møller-Holst from KPMG Norway adopted the path of the cash.
Mr Møller-Holst discovered that the cash was despatched to no less than 54 completely different crypto addresses linked to cryptocurrency exchanges. These accounts had obtained round 700 million NOK (about $74 million). The sum is roughly NI00 billion utilizing the present trade price.
Mr Møller-Holst informed NRK that there are two potentialities: both the individuals behind these accounts are immediately concerned in the scam, or they’re skilled cash launderers who assist criminals transfer and cover stolen cash.
Connecting the scam community to Erubure
For most individuals, a web site is just what they see on the display— textual content, pictures, and movies. But for moral hackers like Mr Christensen, a web site is far more than that.
While inspecting the hidden components of a scam web site, Mr Christensen discovered one thing uncommon: a operate that might create a web-based retailer by means of the area “storevase.com.”
More than 20,000 on-line shops have been mentioned to have been created by means of StoreVase, in accordance with the web site.
The platform claims that its purpose is to make e-commerce accessible to companies throughout Africa.
Driven by elevated curiosity, Mr Christensen determined to dig deeper. What he discovered was revealing: A scam funding web site, firstapexpips.org, shares components of its code with storevase.com.
StoreVase was finally linked to iSkySoftic, Mr Erubure’s firm. The iSkySoftic’s identify appeared on the login web page of the scam web site.
The scam resort
Mr Erubure is listed as the managing director and technical director of the IT firm iSkySoftic LTD. The firm claims to offer web site templates and a place to host them, which is called hosting.
On his private Facebook profile in 2020, he shared two posts exhibiting that iSkySoftic was providing templates for funding web sites.
Business seems to have been going nicely. On two events, Mr Erubure enticed job seekers by promising a mouth-watering wage.
However, the internet hosting supplier was additionally full of fraudulent web sites.
We tracked down previous web sites and digital accounts linked to Mr Erubure. In 2017, a web site registered in his identify revealed the weblog publish “How to start your own Ponzi scheme in Nigeria”.
He has created many accounts on-line and used many nicknames. A recurring one has been variations of “eagle.” In 2018, Mr Erubure used this eagle as his Banner photograph on Facebook.
On Mr Erubure’s net host, “Eagleworker” was the identify that the majority typically appeared on the web sites as an investor. On greater than 25 faux funding web sites, “Eagleworker” has registered a person account.
These person accounts have been apparently used to check that the faux funding web sites have been functioning as meant.
We discovered that Crypto addresses linked to the web sites have obtained no less than $1.2 million (about N1.6 billion). But the crypto addresses are half of a a lot bigger income of $74 million (roughly N100.02 billion), in accordance with an evaluation carried out by the consulting agency KPMG Norway on behalf of NRK.
What our investigation reveals
Our investigation means that Mr Erubure is behind the Eagleworker id. Could he even have been concerned in working fraudulent web sites linked to his hosting?
NRK discovered two situations the place these identities seem collectively. On a crypto platform, there was an account with the username “eagleworker” linked to Mr Erubure’s cellphone quantity and identify.
The scam hunt
For two days, a PREMIUM TIMES reporter tried to contact Mr Erubure for a response. He rejected all the calls with out returning them, regardless that he didn’t know who was calling at the time.
Meanwhile, earlier than then, we had obtained, by means of our investigations, a cell phone quantity mentioned to belong to a seemingly member of the family of Mr Erubure. Truecaller recognised the quantity as belonging to “Jennifer Hassan.”
On 3 July, a PREMIUM TIMES reporter recognized and visited Mr Erubure’s former home in Warri, Delta State.
The constructing is a multi-family residential construction, which seems to be beneath renovation, with some ground-floor home windows open and unfinished. One flat was being occupied by an unidentified individual, mentioned to be a member of the family.
Based on interactions with a number of neighbours and store homeowners round the space, we established that Mr Erubure was staying at the house till lately, when he acquired married and moved to an undisclosed location in the identical Warri.
During interviews with neighbours and store homeowners round the space, PREMIUM TIMES encountered Jennifer. Her obvious anxiousness at first when she was proven Mr Erubure’s {photograph} and when she heard his identify talked about didn’t instantly ship a message till a lot later. Even when she recognized herself as Jennifer, there was no inkling that she was the individual we had earlier recognized as Mr Erubure’s seemingly member of the family.
“I hope there is no problem?” a visibly anxious Jennifer repeatedly requested our reporter after acknowledging that she has recognized Mr Erubure for a very long time. But she was unwilling to share any details about him.
The reporter then posed as an official of a Nigerian financial institution who had come to seek out out why he had not delivered a supposed net growth contract he had facilitated for him on behalf of the financial institution.
Jennnifer, feeling relieved, confirmed that Mr Erubure had moved out of the household home after getting married. She excused herself to get Mr Erubure’s spouse’s cell phone quantity from a store proprietor close by, however returned minutes later, claiming she couldn’t get it.
We noticed that Jennifer contacted somebody over the phone, suspected to be Mr Erubure. On her return, she appeared to have taken the journalist’s {photograph} along with her cellphone.
Our reporter requested her for her cellphone quantity for a potential follow-up and instantly checked it on Truecaller when she offered it. When the app recognized her as Jennifer Hassan, the reporter was left dumbfounded.
“I’ll keep you updated,” she assured the reporter earlier than parting methods.
Curiously, barely half-hour later, Mr Erubure started calling the PREMIUM TIMES reporter. The journalist then texted him, promising to name him again after an “ongoing meeting” in the workplace.
“Ok,” Mr Erubure responded.
He didn’t reply to subsequent calls on his cellphone line. On 3 August, the journalist forwarded a lengthy textual content message to him, asking for his touch upon the consequence of our investigation, which discovered that a number of fraudulent web sites have been linked to his hosting. He didn’t reply both.
Mr Erubure later contacted the journalist with one other cellular quantity, which Truecaller confirmed as his.
“Hello. I know I am speaking with David. Let’s….” the journalist mentioned upon listening to Mr Erubure’s faint “hello.” But he instantly ended the name and refused to select up subsequent calls on the line.
The identical day, we contacted Jennifer and confronted her with our findings. She denied involvement in any fraudulent funding web site and claimed she doesn’t know Mr Erubure, regardless of admitting figuring out him earlier than.
Under the knife
On 10 August, NRK despatched a 1,100-word electronic mail with allegations and inquiries to Mr Erubure. He replied after 37 minutes.
“Hello, I’m glad to hear from you and I believe there may be errors in your investigations,” he tells NRK.
The 32-year-old confirmed that the net host belongs to his firm, however says he and iSkySoftic aren’t concerned in any type of fraud.
If it seems that his prospects are concerned in fraud, he’ll take the acceptable measures, he mentioned.
When requested to reply to our place that over 300 web sites linked to his net host will be tied to numerous varieties of fraud, he mentioned:
“OK, I can’t certainly tell which are engaged in fraud though, but I believe if the investigation proves they are into fraud then the right steps should be taken. But from this list, although long, I notably can pin one that is a printing company.”
On promoting web site templates for funding web sites, Mr Erubure admitted that his firm beforehand bought web site facades, however not full web sites.
This was discontinued a few years in the past, he mentioned.
But on 21 August, he mentioned:
“We didn’t say we sell investment templates, we sell scripts generally and code snippets which most likely buyers converted into investment templates.”
He argued that the web site templates themselves can be utilized for good or dangerous functions. That is as much as the purchaser.
“Knife used for cooking can create joy, but it can also be used for wrong purposes,” Mr Erubure mentioned in writing to NRK.
When requested what he would say to those that have misplaced their cash to web sites hosted by him, he mentioned: “I’m deeply sorry and perceive what it means for somebody to lose cash as I’ve been a sufferer too.
“I learnt something from our conversations this past week. What I am sure to do from hence forth is to do a follow up check on websites hosted on our infrastructure.”
The Eagle behind the curtain
Recall that on a crypto platform, there was an account with the “eagleworker” related to Mr Erubure’s cellphone quantity and identify.
When interrogated on that, he replied: “It must have been someone who knows me who set up an account in hopes of recruiting me.”
He has additionally revealed a YouTube video with a recording of his personal display. In the video, the browser suggests 5 beforehand used electronic mail addresses. One is utilized by eagleworker, and two of them belong to Mr Erubure.
The browser’s autofill reveals electronic mail addresses linked each to Mr Erubure and to the “Eagleworker” username.
“I don’t operate that email, but I might know the person that does,” he mentioned.
He continued: “The video was recorded on a publicly available computer when I was training to become a web developer many years ago. Eagleworker must have used the same machine and browser.”
NRK has repeatedly requested Mr Erubure who he thinks Eagleworker may very well be if it’s not him. He has but to get again on that.
We discovered that Mr Erubure deleted some pictures on his Facebook profiles on 8 August, barely 24 hours after PREMIUM TIMES contacted some people with investor accounts on the fraudulent web sites hosted on his infrastructure.
Mr Erubure admitted eradicating the pictures, however defended his motion.
“Well it’s normal once a while to delete items I believe you must have done same..,” he mentioned.
Back to Norway
Back in Oslo, Norway’s capital, the content material creator Ms Hagen was introduced with the findings of this investigation.
“It is possible to follow the money to Nigeria,” she mentioned.
She believes too little is being accomplished and is asking for decisive motion.
“I wish that at a higher political level, there would be international cooperation to stop the scammers more quickly,” she added.
Cyber fraud: What Nigerian legal guidelines say
There is not any indication that Nigerian companies are at the moment investigating Mr Erubure, nor has he been discovered responsible of any crime.
However, fraud of any type is prohibited in Nigeria.
Section 1(1) of the Advance Fee Fraud and Other Fraud Related Offences Act 2006, as an example, supplies that a one who, by false pretence and with intent to defraud, obtains property from one other individual “in Nigeria or in any other country” commits an offence.
This additionally covers inducing a individual out of the country to ship property or confer a profit. The Act, beneath its Section 1(3), prescribes “imprisonment for a term of not more than 20 years and not less than seven years without the option of a fine” for convicted offenders.
Nigeria additionally has the Cybercrimes Act, initially enacted in 2015 and amended in 2024. This laws offers with numerous varieties of computer-related fraud.
Section 14(2) of the Act makes it a crime for a individual, with intent to defraud, to ship an email correspondence that materially misrepresents info, inflicting the recipient or one other individual to endure injury or loss.
Offenders face no less than 5 years’ imprisonment and a high quality of no less than N10 million, or each, in accordance with the subsection of the Act.
But any computer-related fraud, equivalent to fraud dedicated by means of scam funding web sites, falls beneath the Cybercrimes Act 2024, a senior Nigerian lawyer, Monday Ubani, informed PREMIUM TIMES.
Mr Ubani mentioned that if the matter is investigated and culprits recognized, they might be tried beneath the Cybercrime Act.
“The facts of the case will determine the charges to be filed against an offender, but it will generally come under the Cybercrimes Act (2024),” Mr Ubani, a Senior Advocate of Nigeria, says.
Discover extra from Premium Times Nigeria
Subscribe to get the newest posts despatched to your electronic mail.
