FYI...

- http://www.f-secure.com/weblog/archives/00001382.html
February 19, 2008 - "...site that we discovered back in December, BGI-Funds... It's a PHP based Bulletin Board that's used for money laundering recruitment... At the top of the search results was a Symantec post (September '07) making the link between Storm spam and a copy of the phpBB site. So that pretty much confirmed what we wanted to know. Returning to the search today — the site's still alive — though the name has changed several times. Submitting a Google search for Paid for Receiving Bank Transfers provides a large number of results... We located two sites that are currently active. They're hosted using fast flux... New forum members have been signing up at both locations in order to communicate with the site's Admin (who promises 10%). The membership list appears to be merged prior to February of this year. Posts to the forum date back to the end of 2004. The recycled forum will apparently survive as long as does the Storm botnet..."

(Screenshots available at the URL above.)

More on this...

- http://www.f-secure.com/weblog/archives/00001385.html
February 21, 2008 - "Tuesday's phpBB money laundering post posed a question regarding the forum's membership list — why are Canadians advertising their location on a forum promoting illegal activity? Well, some of our steadfast readers did the legwork and located the answer. Email Money Transfer (EMT)... Very interesting. Interac Email Money Transfer service allows people to send money to anyone with an e-mail address and a bank account in Canada. Folks with one of the "Big Five" Canadian banks can send EMTs. And any personal account holder in Canada can receive funds. EMT funds are not frozen, so an EMT doesn't bounce, as the funds are guaranteed. It does sound like something worth advertising to crooks desiring to launder money. Sounds easy, right? Maybe not. Brian Krebs of Security Fix investigated similar sites last month*... he was offered a certified check rather than an EMT. Certified checks can be faked — that sounds more like an advance fee fraud..."
* http://blog.washingtonpost.com/securityfix/2008/01/just_say_no_to_workathome_mone.html

(Screenshots available at both URLs above.)