‘Done’: Prosecution describes 'sophisticated' €1 million scheme in court
The compilation of evidence against a 25-year-old Tammy Caruana from St Paul’s Bay continued on Wednesday, as the prosecution laid out what it described as a sophisticated fraud operation that allegedly targeted around 200 victims and generated close to €1 million.
The accused is pleading not guilty to charges that she posed as a representative of a local bank to trick victims into handing over sensitive financial details, which were then used to siphon funds through cryptocurrency channels.
Password refusal and digital evidence
Testifying in court, Inspector Claire Vella Borg explained how Caruana had refused to provide passwords for electronic devices seized during a search of her residence. Despite this, the Cybercrime Unit managed to access and analyse the data.
Investigators uncovered extensive material, including crypto wallet seed phrases linked to the Exodus platform. Analysis of these wallets showed incoming transactions ranging from €12,000 to over €82,000.
The inspector also described how Telegram chats revealed structured coordination with foreign third parties, including the sharing of victims’ personal data such as names, IBAN numbers, addresses, and mobile numbers.
‘Done’: real-time fraud coordination, and confirmation
A video presented in court showed communications linked to fraudulent activity taking place abroad, including in Turkey. In one clip, a voice is heard saying “done,” indicating that a fraudulent transaction had been successfully completed.
Other voice notes captured the accused expressing frustration at victims who failed to follow instructions. In one recording, she is heard using foul language, “I’m so f… fed up, they don’t know how to press a f… button”.
Further footage showed crypto transactions between the accused and alleged accomplices, including the transfer of commissions, through crypto.
Fake bank portals and spoofing tools
Evidence presented by the prosecution pointed to deliberate planning, including Google searches related to Bank of Valletta’s website and discussions about using fake versions of bank portals to harvest login credentials.
Investigators also traced IP addresses linked to services used to send bulk messages and conduct spoofing, technology that allows scammers to disguise phone numbers so calls appear to originate from legitimate sources such as banks.
Sergeant Jonathan Ferris from the Digital Forensic Unit testified that devices seized from the accused’s residence contained fabricated banking websites, VPN applications to conceal location, and records of google searches of financial calculations, such as percentage splits from fraudulent proceeds.
Telecom data and spoofing explained
Representatives from GO’s fraud prevention unit testified about the technical challenges of tackling spoofing.
Charmaine Galea Triganza explained how scammers manipulated caller ID systems so that calls appeared to originate from official bank numbers, when in reality they were made from foreign lines. She noted that such software, while not always easily accessible, can be obtained online for between $4,000 and $5,000, “a relatively small investment compared to the thousands stolen from victims.”
Antoine Bonnici from GO also presented telecommunications data, including call logs, SMS records, and data sessions linked to two mobile numbers associated with the case.
One number was unregistered, while the other was registered under a third party. The extracted data, spanning several years, was exhibited in court via a USB device.
Nicholas Portelli, representing Moneybase, presented documentation relating to several foreign account holders. These accounts are suspected to have been used as “money mules”, individuals who allow their bank accounts to be used to receive and transfer illicit funds on behalf of others, often in exchange for a commission, to facilitate the movement of illicit funds.
Double life: Different stories to victims and family
The court also heard how the accused allegedly maintained different narratives about her work. While telling victims she was self-employed and earning between €2,000 and €3,000 per month by managing cryptocurrency investments, she reportedly told her mother that she worked in an online call centre from home, earning around €5,000 monthly.
Investigators also recovered CVs sent by the accused to potential contacts, as well as messages suggesting financial pressure and attempts to secure income.
The prosecution is being led by Inspector Claire Vella Borg, assisted by lawyers Marica Ciantar and Mauro Abela on behalf of the Attorney General.
Professor Stefano Filletti appeared as parte civile for Bank of Valletta, while lawyer Maria Lisa Buttigieg represented Banif plc. The accused is being represented by lawyers Roberto Spiteri and Franco Galea. Magistrate Lara Lanfranco presided over the sitting.
The case continues on 30 April at 1pm.
RSS Feed Source: Independent Malta ‘Done’: Prosecution describes 'sophisticated' €1 million scheme in court