Nigerians claiming to be Richmond construction firm defrauded VCU of $470,000

A Virginia Commonwealth University employee transferred $470,000 to a group of Nigerian scammers who defrauded millions of dollars from government entities, construction companies and universities in Virginia, Texas and North Carolina, the Federal Bureau of Investigation said Wednesday.

The FBI has extradited three Nigerian citizens from the United Kingdom, and authorities charged Olabanji Egbinola, 42, in Virginia federal court with wire fraud, conspiracy to commit wire fraud, money laundering and conspiracy to commit money laundering.

The FBI alleges that Egbinola defrauded VCU in the fall of 2018 by claiming to be a Richmond construction company doing business with the university.

A VCU spokesman said the university recovered a significant portion of the money though insurance. The university also implemented safeguards to protect against future instances of fraud.

WWBT12, Richmond's NBC affiliate, previously reported the story.

Online scammers often target real estate purchasers, the elderly and others by convincing them to make wire transfers to bank accounts the criminals control. The scammer may impersonate an employee or business partners and they are often members of transnational criminal organizations that originated in Nigeria and spread throughout the world, the FBI said.

The following account of the scam is based on an FBI news release and a criminal complaint filed in federal court.

In the fall of 2018, someone using the name "Rachel Moore" contacted an employee in the procurement department at VCU using the email address "[email protected]." Kjellstrom and Lee is a construction firm located in Richmond that has done business with VCU. Its email address is similar to the one used in the scam.

The scammer wrote that Kjellstrom and Lee's bank account was being audited and asked if VCU could send the next payment to a foreign bank account. The scammer and the VCU employee corresponded several times over the course of three months.

"Hope you are good," the scammer wrote. "Can you please notify us at [email protected] when a payment has been made."

On Dec. 20, 2018, VCU sent $469,819.49 to an account with the Bank of Hope. On Jan. 3, VCU's bank contacted the university, concerned the payment was made to a fraudulent account.

VCU contacted Kjellstrom and Lee and learned the construction company doesn't employee a Rachel Moore.

The roughly $470,000 could not be recovered. Authorities claim the money was redistributed through at least 50 wire and check transactions in the five days after VCU sent it.

An investigation by the FBI's Richmond Division determined that someone used the account "bridgetclark" to create fraudulent email addresses through the Internet domain registrar NameCheap, Inc. The scammer registered more than 50 domains with names similar to legitimate construction companies.

The scammer who created the bridgetclark account used a variety of techniques to conceal his or her identity. The account was paid for using Bitcoin cryptocurrency, which is hard to trace. The scammer also used a virtual private network (VPN) to conceal his or her IP address and physical location.

In February 2019, the FBI sent a network investigative technique, or NIT, to the fraudulent email address used in the scheme. An NIT is a technology used by the government to gain access to a computer.

Once the scammer opened the email and its attachment, a file was executed, providing data to the FBI, including the IP address of the computer that opened the attachment. The scammer was in the United Kingdom.

Police in the United Kingdom determined that the IP address originated from a two-story brick house in Chafford Hundred, about 20 miles east of London. Authorities say one resident of the home was Egbinola, the man charged this week by U.S. authorities.

Egbinola has a criminal history, U.S. authorities said. In 2008, officials say, U.K. police arrested him for money laundering and discovered a large quantity of U.S. currency at his residence. His computer contained information related to bank accounts of individuals who were victims of fraud. It's unclear if Egbinola was ever tried for the crime.

In 2015, Egbinola traveled to Los Angeles, and the address he visited is associated with another investigation of fraud and money laundering. When traveling to the U.S., Egbinola listed his email address as [email protected]. The FBI says Egbinola used that email address to communicate with another address that is the subject of an FBI investigation for scamming construction companies in North Carolina.

The FBI also arrested Oludayo Kolawole John Adeagbo, 43, a Nigerian citizen and U.K. resident, and Donald Ikenna Echeazu, 40, a dual U.K. and Nigerian citizen, with defrauding a North Carolina university for $1.9 million through an email scheme.

Adeagbo is also charged with defrauding Texas government entities, construction companies and a Houston-area college of more than $3 million.

U.K. officials arrested all three in April 2020, and the United States requested extradition. The defendants filed appeals, but the U.K. High Court rejected them last month.