For neighbours and store house owners round the constructing he lived in, an unpainted and unplastered storey constructing, David Erubure is a internet developer and IT professional.
The home, which has about 4 flats, is in Izomo Idum Area of Warri, Udu Local Government Area of Delta State, southern Nigeria.
Many of Mr Erubure’s social media followers in all probability imagine that he runs a “successful” internet hosting firm.
However, some of his actions grew to become a topic of worldwide investigation when many of the web sites he hosted appeared in a number of fraudulent schemes.
The Norwegian Broadcasting Corporation (NRK), in partnership with PREMIUM TIMES, carried out a months-long investigation into a multi-million dollar fraudulent scheme, together with Mr Erubure’s role in it.
We discovered that Mr Erubure’s neighbours, store house owners and social media followers should not flawed about him. But there’s extra they in all probability have no idea about him.
From Norway to Nigeria
In Norway, a Northern European nation, funding recommendation and “genius” methods for getting cash are in every single place on TikTookay: rental arbitrage, home flipping, and shares you “should” purchase.
Mi Le Hagen, an influencer, likes to supply funding recommendation. The influencer has made tens of 1000’s in the inventory market and often shares tips about how her followers can succeed.
Between September and November final yr, Ms Hagen began sharing funding recommendation with followers in direct messages.
“Right now I’m investing in Bitcoin and making good money from it. I can actually give you a good insight into how you can make money through Bitcoin,” she stated.
Ms Hagen beneficial utilizing a safe funding web site for digital currencies, which have been the cryptocurrencies she claimed to have made a lot of cash from. The hottest in Norway are Bitcoin and Ethereum.
Meanwhile, there was 247autobot.com, one of the many pretend funding web sites operated as half of a massive scam community.
People who invested cash on the web site watched their supposed returns develop on the display. But the returns weren’t actual. The cash had by no means been invested. The scammers had merely stolen it.
“Oh my God. I was scammed out of 23,000 NOK (approx. $2,100),” stated a sufferer who didn’t need to disclose their actual identify. That’s about N3.3 million utilizing the present change fee of N1,344.45 per US dollar.
NOK stands for Norsk Krone, which interprets to Norwegian krone in English. It is the official foreign money in Norway
This is the story of a refined fraud community that has deceived folks round the world, and the hunt for the ones who make it potential.
Mii versus Mi
Mi Le Hagen understands that her followers are hungry for fast cash. So, she wishes to provide them wise steerage on saving and index funds. But somebody, a scammer, was busy doing the reverse.
The individual, posing as Ms Hagen, had copied her TikTookay profile and was sending direct messages to her followers, some of whom sadly fell for the scam.
When she realised at first, she expressed shock that she was well-known sufficient for folks to be copying her on TikTookay. The followers contacted her – both to complain that they had misplaced cash or wished to warn her about the pretend accounts.
The pretend profile created by the scammers was nearly indistinguishable from the actual one. In truth, the scammers copied many pictures and posts from Ms Hagen’s actual account. Some of the pretend accounts even had extra followers than hers.
“It affects my good name and reputation. I give guidance on long-term saving, not speculative tips meant to deliver short-term profit,” Ms Hagen advised NRK.
The influencer was devastated. The pretend profiles blocked her, so that they have been solely seen to her followers.
She didn’t know cease them. All the whereas, new copy accounts saved showing, and her followers have been in danger of being deceived.
The investor wolf in sheep’s clothes
To unmask the identification of the scammer, the NRK was helped by Daniel Christensen, an moral hacker who likes to hunt cybercriminals and expose fraud.
Mr Christensen had helped comic Johan Golden to find who was utilizing his face and identification to scam folks. During the time, he found clues that led him to a group of scammers working on TikTookay.
The scammers thought that they had tricked one other individual into investing cash on the web site that they had arrange. They didn’t know that Mr Christensen was the wolf, and not the sheep.
“I could see immediately that the website (247autobot) was not legitimate,” Mr Christensen advised NRK.
The scammers believed that that they had satisfied a new individual to take a position cash via their pretend web site. But they didn’t know they have been coping with a man who was secretly in search of coding flaws – weaknesses in the scammers’ web sites that might assist to expose them.
It didn’t take Mr Christensen a lot time to get to the back-end of the web site. What he noticed as the website’s goal was unmistakably clear: to scam folks out of as a lot cash as potential.
As he investigated the scam web sites, extra and extra saved showing. All with lists of unwitting buyers. All with the identical coding flaw.
The girl on the checklist
One of the folks on the checklist was a nurse from the United States. Mr Christensen observed that she had just lately deposited cash into the web site.
“She was about to deposit more, so I called her,” Mr Christensen recalled.
He warned her that the web site was a scam, however it took a number of calls earlier than she was satisfied. He stopped her from transferring one other 3,200 NOK (about $320), utilizing the change fee at the time.
However, she had already misplaced about 20,000 NOK (about $2,000) at the time, in response to her. Mr Christensen shortly understood that he couldn’t name everybody on the checklist.
He thought of one other thought: Changing the fee deal with on the web sites. That method, the cash would come to him moderately than to the unknown scammers who had created the websites.
Mr Christensen’s plan was to ship the a reimbursement to the individuals who had been scammed. At first, the plan labored. But it didn’t final lengthy. The scammers quickly stopped his try. After that, all the web sites confirmed the identical clean white web page the place the fee addresses had been.
Determined to uncover the scammers, Mr Christensen checked out the investor lists once more. One identify caught his consideration. The individual referred to as himself “Eagleworker” and had an investor profile on many of the web sites.
Later on, Mr Christensen shared all his findings with NRK: He had discovered 100 fraudulent funding web sites. But NRK subsequently discovered over 200 extra of such web sites.
The web sites shared a number of options, making it clear that they have been half of the identical scam community and the identical origin. Sixty of the web sites had a safety flaw that made it simple to entry their back-end methods. Fifty-five contained a Norwegian cellphone quantity, whereas some customers had uploaded their passports to confirm their identities.
When contacted for feedback, a number of victims – who lack hope of potential restoration of the funds – refused to talk. They have been ashamed to provide the particulars of the scam. A couple of, nonetheless, have been prepared to talk on the foundation of anonymity.
Most of them narrated that they created funding accounts at the urging of Norwegian TikTookay profiles they adopted — together with the one which imitated the influencer, Ms Hagen.
Others described lengthy on-line conversations with pleasant individuals who finally beneficial investing in cryptocurrency. They hoped for fast returns.
But the returns would develop into inconceivable to money out, as a result of each time they tried to withdraw their cash, they have been advised to pay one other charge or tax first.
“I was trusting and I was manipulated. The money I handed over, I will never get back,” one Norwegian sufferer stated.
N86 billion misplaced to scammers
NRK has recognized over 140 fee addresses on the scam web sites. Together, these addresses had acquired greater than 12 million NOK (about $1.2 million at the time). This is about N1.6 billion, utilizing the present change fee.
The fee addresses are modified often and the scammers ship the cash onward as quickly as it’s acquired. This makes it tough to hint the place the cash goes.
However, whereas working for NRK, crypto analyst Arild Møller-Holst from KPMG Norway adopted the path of the cash.
Mr Møller-Holst discovered that the cash was despatched to at the least 54 completely different crypto addresses linked to cryptocurrency exchanges. These accounts had acquired round 700 million NOK (about $74 million). The sum is roughly NI00 billion utilizing the present change fee.
Mr Møller-Holst advised NRK that there are two prospects: both the folks behind these accounts are instantly concerned in the scam, or they’re skilled cash launderers who assist criminals transfer and conceal stolen cash.
Connecting the scam community to Erubure
For most individuals, a web site is just what they see on the display— textual content, pictures, and movies. But for moral hackers like Mr Christensen, a web site is way more than that.
While inspecting the hidden elements of a scam web site, Mr Christensen discovered one thing uncommon: a perform that might create a web-based retailer via the area “storevase.com.”
More than 20,000 on-line shops have been stated to have been created via StoreVase, in response to the web site.
The platform claims that its aim is to make e-commerce accessible to companies throughout Africa.
Driven by elevated curiosity, Mr Christensen determined to dig deeper. What he discovered was revealing: A scam funding web site, firstapexpips.org, shares elements of its code with storevase.com.
StoreVase was finally linked to iSkySoftic, Mr Erubure’s firm. The iSkySoftic’s identify appeared on the login web page of the scam web site.
The scam lodge
Mr Erubure is listed as the managing director and technical director of the IT firm iSkySoftic LTD. The firm claims to offer web site templates and a place to host them, which is named internet hosting.
On his private Facebook profile in 2020, he shared two posts displaying that iSkySoftic was providing templates for funding web sites.
Business seems to have been going properly. On two events, Mr Erubure enticed job seekers by promising a mouth-watering wage.
However, the internet hosting supplier was additionally full of fraudulent web sites.
We tracked down outdated web sites and digital accounts linked to Mr Erubure. In 2017, a web site registered in his identify printed the weblog put up “How to start your own Ponzi scheme in Nigeria”.
He has created many accounts on-line and used many nicknames. A recurring one has been variations of “eagle.” In 2018, Mr Erubure used this eagle as his Banner picture on Facebook.
On Mr Erubure’s internet host, “Eagleworker” was the identify that almost all usually appeared on the web sites as an investor. On greater than 25 pretend funding web sites, “Eagleworker” has registered a person account.
These person accounts have been apparently used to check that the pretend funding web sites have been functioning as meant.
We discovered that Crypto addresses linked to the web sites have acquired at the least $1.2 million (about N1.6 billion). But the crypto addresses are half of a a lot bigger income of $74 million (roughly N100.02 billion), in response to an evaluation carried out by the consulting agency KPMG Norway on behalf of NRK.
What our investigation reveals
Our investigation means that Mr Erubure is behind the Eagleworker identification. Could he even have been concerned in working fraudulent web sites linked to his internet hosting?
NRK discovered two cases the place these identities seem collectively. On a crypto platform, there was an account with the username “eagleworker” linked to Mr Erubure’s cellphone quantity and identify.
The scam hunt
For two days, a PREMIUM TIMES reporter tried to contact Mr Erubure for a response. He rejected all the calls with out returning them, despite the fact that he didn’t know who was calling at the time.
Meanwhile, earlier than then, we had obtained, via our investigations, a cell phone quantity stated to belong to a doubtless member of the family of Mr Erubure. Truecaller recognised the quantity as belonging to “Jennifer Hassan.”
On 3 July, a PREMIUM TIMES reporter recognized and visited Mr Erubure’s former home in Warri, Delta State.
The constructing is a multi-family residential construction, which seems to be below renovation, with some ground-floor home windows open and unfinished. One flat was being occupied by an unidentified individual, stated to be a member of the family.
Based on interactions with a number of neighbours and store house owners round the space, we established that Mr Erubure was staying at the house till just lately, when he obtained married and moved to an undisclosed location in the identical Warri.
During interviews with neighbours and store house owners round the space, PREMIUM TIMES encountered Jennifer. Her obvious nervousness at first when she was proven Mr Erubure’s {photograph} and when she heard his identify talked about didn’t instantly ship a message till a lot later. Even when she recognized herself as Jennifer, there was no inkling that she was the individual we had earlier recognized as Mr Erubure’s doubtless member of the family.
“I hope there is no problem?” a visibly anxious Jennifer repeatedly requested our reporter after acknowledging that she has identified Mr Erubure for a very long time. But she was unwilling to share any details about him.
The reporter then posed as an official of a Nigerian financial institution who had come to seek out out why he had not delivered a supposed internet improvement contract he had facilitated for him on behalf of the financial institution.
Jennnifer, feeling relieved, confirmed that Mr Erubure had moved out of the household home after getting married. She excused herself to get Mr Erubure’s spouse’s cell phone quantity from a store proprietor close by, however returned minutes later, claiming she couldn’t get it.
We noticed that Jennifer contacted somebody over the phone, suspected to be Mr Erubure. On her return, she appeared to have taken the journalist’s {photograph} together with her cellphone.
Our reporter requested her for her cellphone quantity for a potential follow-up and instantly checked it on Truecaller when she supplied it. When the app recognized her as Jennifer Hassan, the reporter was left dumbfounded.
“I’ll keep you updated,” she assured the reporter earlier than parting methods.
Curiously, barely half-hour later, Mr Erubure started calling the PREMIUM TIMES reporter. The journalist then texted him, promising to name him again after an “ongoing meeting” in the workplace.
“Ok,” Mr Erubure responded.
He didn’t reply to subsequent calls on his cellphone line. On 3 August, the journalist forwarded a lengthy textual content message to him, asking for his touch upon the consequence of our investigation, which discovered that a number of fraudulent web sites have been linked to his internet hosting. He didn’t reply both.
Mr Erubure later contacted the journalist with one other cell quantity, which Truecaller confirmed as his.
“Hello. I know I am speaking with David. Let’s….” the journalist stated upon listening to Mr Erubure’s faint “hello.” But he instantly ended the name and refused to select up subsequent calls on the line.
The identical day, we contacted Jennifer and confronted her with our findings. She denied involvement in any fraudulent funding web site and claimed she doesn’t know Mr Erubure, regardless of admitting realizing him earlier than.
Under the knife
On 10 August, NRK despatched a 1,100-word electronic mail with allegations and inquiries to Mr Erubure. He replied after 37 minutes.
“Hello, I’m glad to hear from you and I believe there may be errors in your investigations,” he tells NRK.
The 32-year-old confirmed that the internet host belongs to his firm, however says he and iSkySoftic should not concerned in any kind of fraud.
If it seems that his prospects are concerned in fraud, he’ll take the acceptable measures, he stated.
When requested to answer our place that over 300 web sites linked to his internet host will be tied to varied kinds of fraud, he stated:
“OK, I can’t certainly tell which are engaged in fraud though, but I believe if the investigation proves they are into fraud then the right steps should be taken. But from this list, although long, I notably can pin one that is a printing company.”
On promoting web site templates for funding web sites, Mr Erubure admitted that his firm beforehand offered web site facades, however not full web sites.
This was discontinued a few years in the past, he stated.
But on 21 August, he stated:
“We didn’t say we sell investment templates, we sell scripts generally and code snippets which most likely buyers converted into investment templates.”
He argued that the web site templates themselves can be utilized for good or dangerous functions. That is as much as the purchaser.
“Knife used for cooking can create joy, but it can also be used for wrong purposes,” Mr Erubure stated in writing to NRK.
When requested what he would say to those that have misplaced their cash to web sites hosted by him, he stated: “I’m deeply sorry and perceive what it means for somebody to lose cash as I’ve been a sufferer too.
“I learnt something from our conversations this past week. What I am sure to do from hence forth is to do a follow up check on websites hosted on our infrastructure.”
The Eagle behind the curtain
Recall that on a crypto platform, there was an account with the “eagleworker” related to Mr Erubure’s cellphone quantity and identify.
When interrogated on that, he replied: “It must have been someone who knows me who set up an account in hopes of recruiting me.”
He has additionally printed a YouTube video with a recording of his personal display. In the video, the browser suggests 5 beforehand used electronic mail addresses. One is utilized by eagleworker, and two of them belong to Mr Erubure.
The browser’s autofill reveals electronic mail addresses linked each to Mr Erubure and to the “Eagleworker” username.
“I don’t operate that email, but I might know the person that does,” he stated.
He continued: “The video was recorded on a publicly available computer when I was training to become a web developer many years ago. Eagleworker must have used the same machine and browser.”
NRK has repeatedly requested Mr Erubure who he thinks Eagleworker may very well be if it isn’t him. He has but to get again on that.
We discovered that Mr Erubure deleted some pictures on his Facebook profiles on 8 August, barely 24 hours after PREMIUM TIMES contacted some people with investor accounts on the fraudulent web sites hosted on his infrastructure.
Mr Erubure admitted eradicating the pictures, however defended his motion.
“Well it’s normal once a while to delete items I believe you must have done same..,” he stated.
Back to Norway
Back in Oslo, Norway’s capital, the content material creator Ms Hagen was introduced with the findings of this investigation.
“It is possible to follow the money to Nigeria,” she stated.
She believes too little is being accomplished and is asking for decisive motion.
“I wish that at a higher political level, there would be international cooperation to stop the scammers more quickly,” she added.
Cyber fraud: What Nigerian legal guidelines say
There is not any indication that Nigerian companies are presently investigating Mr Erubure, nor has he been discovered responsible of any crime.
However, fraud of any sort is prohibited in Nigeria.
Section 1(1) of the Advance Fee Fraud and Other Fraud Related Offences Act 2006, for example, offers that a one that, by false pretence and with intent to defraud, obtains property from one other individual “in Nigeria or in any other country” commits an offence.
This additionally covers inducing a individual abroad to ship property or confer a profit. The Act, below its Section 1(3), prescribes “imprisonment for a term of not more than 20 years and not less than seven years without the option of a fine” for convicted offenders.
Nigeria additionally has the Cybercrimes Act, initially enacted in 2015 and amended in 2024. This laws offers with varied kinds of computer-related fraud.
Section 14(2) of the Act makes it a crime for a individual, with intent to defraud, to ship an piece of email that materially misrepresents information, inflicting the recipient or one other individual to endure harm or loss.
Offenders face at the least 5 years’ imprisonment and a high-quality of at the least N10 million, or each, in response to the subsection of the Act.
But any computer-related fraud, similar to fraud dedicated via scam funding web sites, falls below the Cybercrimes Act 2024, a senior Nigerian lawyer, Monday Ubani, advised PREMIUM TIMES.
Mr Ubani stated that if the matter is investigated and culprits recognized, they’d be tried below the Cybercrime Act.
“The facts of the case will determine the charges to be filed against an offender, but it will generally come under the Cybercrimes Act (2024),” Mr Ubani, a Senior Advocate of Nigeria, says.
Discover extra from Premium Times Nigeria
Subscribe to get the newest posts despatched to your electronic mail.
