Aussie businesses hit hard by busted Nigerian email scam ring

The leader of a gang of Nigerian business email compromise and romance scammers, who headed a network of at least 40 criminals, has been arrested and his operation disbanded, according to Interpol.

A 40-year-old Nigerian known as "Mike" was arrested by local police in June along with a 38-year old accomplice in Port Harcourt, in the south of the African nation, Interpol said. The pair face charges of hacking, conspiracy and obtaining money under false pretences, and are on administrative bail as police continue the investigation.

Australia was one of the countries targeted by the scammers, with 94 attacks on small to medium businesses recorded. This makes the country the hardest hit per capita, followed by the UK's 221 cases, according to Trend Micro, which monitored attacks between September 2015 to March 2016.

Along with Australia and Britain, the criminals conned victims in Canada, the US, South Africa and other countries out of an estimated US$60 million (A$80 million). One unnamed victim parted with US$15.4 million.

Money was laundered through helpers in China, Europe and the United States, who made their bank accounts available for the scammers to use.

"Mike" and associates scammed people through payment diversion using compromised supplier emails, with fake messages containing transaction instructions. They also utilised so-called CEO fraud, which asked authorised staffers to send money via wire transfers into the criminals' bank accounts.

They also used keylogging malware such as Predator Pain and Limitless to steal web logins and other credentials in order to hijack accounts.

The world police agency said warned individuals and businesses to be more aware of email-borne fraud, and to enable basic security protocols such as two-factor authentication.

Interpol and the Nigerian police worked with Fortinet Fortiguard Labs to analyse the scam and obtain intelligence, as well as Trend Micro.

Trend Micro estimated that between 2013 and 2015, business email compromise schemes netted almost US$3.1 billion from over 22,100 victims worldwide.