Report (STR): A local bank filed a suspicious transaction report with the SIC concerning a customer who instructed the bank to transfer an amount to his supplier in a European country. Following the execution of the transfer, the customer discovered that the e-mail of his supplier had been compromised and that the payment instructions he acted on originated from a hacker and not the supplier.
    
Analysis and Investigation: The SIC initiated its investigation by reviewing all bank records, documents and invoices submitted by the reporting bank and decided to contact a counterpart FIU seeking information on the bank account that received the transfer abroad. The information obtained from the counterpart FIU indicated that the beneficiary account receiving the transfer belonged to a company involved in fraudulent fund transfers. Three STRs had been previously filed with the counterpart FIU regarding similar wire transfers that were immediately transferred to a third beneficiary after being credited into its account.

Subsequent Measures: The SIC forwarded the findings to the General Prosecutor suggesting that the judicial police-cybercrime office also further investigate the matter, and also asked the counterpart FIU for additional information.

Report (STR): The SIC received two suspicious transaction reports from two local banks concerning the same customer who owns several companies in Lebanon. The compliance officers at the two banks didn’t receive any justifications or supporting documents from the said customer regarding certain accusations and suspicious account activity. The first bank became suspicious of the customer after coming across an article in the newspaper that mentioned the customer as being detained for corruption and bribing government officials in order to cover up for illicit acts committed by others, including drug trafficking. The second bank became suspicious after realizing that the customer’s companies accounts were being used as transitory accounts, and that almost all cash deposits were withdrawn directly in checks.

Analysis and Investigation: The SIC initiated its investigation by obtaining all available bank records including KYC forms, bank statements and copies of identification documents from the two reporting banks. In the first bank, multiple cash deposits below the threshold were executed on the customer’s account, and this activity was presented as being proceeds from real estate transactions. Checks deposited in his account were from individuals where no business relationship could be established. The analysis of his companies’ accounts at the second bank revealed that cash deposits were followed by cash and check withdrawals, and the relationship with the beneficiaries of the issued checks couldn’t also be established. During the investigation, further information on the suspect was received from local law enforcement authorities. The SIC decided to circulate the suspect’s name to all banks, financial institutions and money remittance companies operating in Lebanon to identify bank accounts and transactions. One additional bank reported having accounts for the suspect and his companies. The analysis performed on the accounts’ statements reflected a similar pattern of transactions.

Subsequent Measures: With the findings at hand, the SIC decided to lift banking secrecy off the identified bank accounts and forward the investigation findings to the General Prosecutor for further investigation.

Report (ROA): During 2019, a terrorist attack took place in Northern Lebanon and resulted in the death of law enforcement officers, army personnel and the injury of several civilians. The terrorist, known to be affiliated with ISIL, opened fire on army personnel, and blew himself up after a pursuit and confrontation with law enforcement officers. The Lebanese General Prosecutor sought the SIC assistance in order to identify any related bank accounts and transactions pertaining to the terrorist and related individuals arrested for interrogation.

Analysis and Investigation: The SIC initiated its investigation by circulating the names of the terrorist and related individuals to all banks, financial institutions and money remittance companies operating in Lebanon. No bank accounts or real estate ownership were identified for the terrorist, but two money remittance companies reported two incoming remittances in minimal amounts in prior years. A counterpart FIU was contacted in this regard. Investigations conducted by law enforcement authorities made available to the SIC revealed that in order to carry out the attack, the terrorist sold his house furniture and used the proceeds to self-finance his attack. Furthermore, the terrorist did not receive instructions from ISIL leaders but instead committed what was described as a “lone wolf” operation after having served time in jail for joining ISIL in Syria.

Subsequent Measures: The SIC requested from all money remittance companies not to perform any transaction for any of the related individuals under interrogation and forwarded the findings to the Lebanese General Prosecutor.