Whistleblower explains ABCs of money laundering

NEW YORK – A review of HSBC corporate accounts demonstrating a suspicious pattern of deposits and withdrawals illustrates how credit card transactions can be used in money laundering activity, according to a whistleblower who has provided WND with more than 1,000 pages of evidence against the global bank.

The evidence includes customer account ledgers for dozens of companies through which the financial institution was laundering money each month, charges John Cruz, a former relationship manager for the bank's southern New York region.

"Studying the pattern of deposit and withdrawal activity in the suspect corporate accounts provides abundant evidence that bank employees at HSBC were directly involved manipulating fictitious corporate accounts in a money laundering scheme that extended to the highest levels of bank management and bank security," Cruz said.

"The money laundering in the suspect accounts tended to start slowly and build rapidly, to the point where millions of dollars were being wired into and wired out of the accounts monthly."

The series of Articles on HSBC already has caused fallout for this reporter and for WND, which saw one of the articles temporarily blocked when HSBC filed a complaint with an Internet provider that turned out to be unwarranted.

HSBC is reportedly under investigation by a U.S. Senate committee, and WND has provided material to federal investigators.

Exhibit 1 is a checking account record from a redacted HSBC account in which PayPal and American Express transactions play a prominent role. The two credit card-related companies, as WND has reported, have been implicated in the alleged HSBC international money-laundering scheme involving hundreds of billions of dollars.

As seen in Exhibit 1, the PayPal link into the account was established in the bank statement period that began July 25, 2008, and ended Aug. 26, 2008

Exhibit 1: PayPal established in suspicious HSBC corporate checking account

The checking account at the beginning of the statement period had a balance of only $500 and the first deposit from PayPal was $1.01 in total, followed the same day by two additional deposits, amounting to 15 cents each.

"The point of beginning this way was the have the first transactions be so small that no one in bank security would notice the transaction as important," Cruz explained. "For the first 60 to 90 days, the criminals within the bank would proceed cautiously so the account would become established within the bank computer system without drawing unnecessary attention."

Cruz also pointed out the initial PayPal deposits tended to be in small amounts because the goal of the money launderers was to make sure the PayPal transaction facility linked successfully to the account, as preparation for transferring large sums into the account through PayPal.

"After this initial 60 to 90 day period, the money launders were ready to go," he said. "Now larger sums could be run through the account without suspicious activity reports being filed by bank computer system watchdogs."

He noted the primary responsibility for filing suspicious activity reports with the relevant federal law enforcement authorities rested with the bank representative who opened the account.

"As long as the bank representative opening the account was in on the fraudulent scheme, tens or even hundreds of thousands of dollars at a time could be run through an account once it emerged from the 60 to 90 day initial period," he said. "One branch could have hundreds of these fraudulent accounts opened simultaneously, with hundreds of thousands of dollars flowing through each of the hundreds of accounts on a daily basis."

Cruz turned over to WND a tape recording he made of a conversation with a new HSBC bank manager upon coming into a branch that he had been assigned to manage. The bank manager admitted he was shocked to discover that of the 351 business accounts he examined in that particular HSBC branch, 267 accounts, more than 75 percent, were found to be fraudulent.

Exhibit 2 traces the HSBC corporate checking account under examination here from the statement period beginning Oct. 27, 2008, and ending Nov. 28, 2008, some three months after the statement period examined in Exhibit 1 above.

This statement seen in Exhibit 2 documents five deposits credited into the account, all from PayPal and all in even multiples of ten thousand dollars, intermixed with five online transfers out of the account. All were in even multiples of ten thousand dollars, such that the beginning balance of the account was $1 and the ending balance $32,001.

The PayPal deposit credits into the account do not list where the funds came from, other than to specify PayPal, and the transfers out of the account similarly went to unknown sources.

Exhibit 2: PayPal deposit activity in even $10,000 multiples

"PayPal was particularly suited to this pattern of suspicious money transfers because PayPal as a corporation exists to mask the accounts or credit card facilities from which a person pays into another account," Cruz observed.

"PayPal's stated goal is to protect innocent Internet buyers for identity theft and subsequent credit card fraud. But seen through he eyes of criminal money launders, PayPal provides a convenient service for hiding their identities and masking where suspicious deposit transfers originate."

Exhibit 3 tracks the same corporate checking account though the statement period beginning on July 14, 2009, and ending on Aug. 14, 2009, roughly a year after the statement period reported above in Exhibit 1.

Now the sums being debited and credited into the account have grown by a factor of 10 or greater, and American Express appears as the destination of two payments from the account, one debited in the amount of $200,000 on July 23, 2009, and the second in the amount of $300,000 on Aug. 11, 2009.

That the account was being used primarily as a money-laundering conduit is evident from the beginning balance of $17,006.46 and an ending balance of $6.42, after hundreds of thousands of dollars were transferred in and out of the account throughout the statement period.

Exhibit 3: Account debits and credits in amounts of $100,000 and greater

"What Exhibit 3 really shows is that the money that is credited to the account is most likely money transferred in from other accounts, where the transfers here do not list PayPal because the transfers were most likely internal transfers among various HSBC accounts," he noted.

The point is that a PayPal transfer to a fraudulent account only needs to show up once – the first time the money comes into the bank. After the money is in the bank, the PayPal-derived funds can be transferred into multiple other fraudulent accounts, without PayPal being listed a second time as the source of the funds transfer."

Exhibit 4 documents the same corporate checking account for the period Nov. 29, 2008, through Dec. 24, 2008.

The point in Exhibit 4 is that the account began modestly in August 2008, as documented above in Exhibit 1, and grew to a point where by the end of 2008, $1.25 million was being wired into the account and $1.57 million was being debited from the account.

"Remember, just because an account starts small, doesn't mean the account will end small," Cruz emphasized. "The point is that the money-laundering criminals working within the bank know exactly how to game the system so as to stay below the radar of getting caught."

He explained that an average person depositing more than $10,000 in cash into a bank account in person has to fill out official suspicious activity reports, but a corporate account in which tens or hundreds of thousands of dollars are flowing through the account monthly avoids scrutiny as long as the bank officer establishing and managing the account within the bank reports the transactions as normal for the business involved.

"The same thing happens if you walk into a bank and make a series of deposits each calculated to be under $10,000," he noted. "This is considered 'structuring,' again requiring suspicious activity reports to federal law enforcement that may conclude you broke up deposits to be under the $10,000 cash deposit limit to avoid having the deposits reported."

Yet, he notes, a corporate checking account in which tens or hundreds of thousands of dollars are being run through the account at a time remains unsuspicious, as long as the bank reports the transactions as normal for the business involved.

Exhibit 4: Account activity in millions of dollars at year-end, 2008

Finally, Exhibit 5 details the account activity for the reporting period summarized above in Exhibit 5.

Again, the PayPal deposits are in multiple even increments of $10,000, matched by even-incremented debit transfers out of the account, such that the account balance at the end of the reporting period was $1.

Exhibit 5: Detail of account activity, reporting period seen in Exhibit 4

"The scheme alleged here argues that money is transferred into the bank and built up in many different accounts," Cruz summarizes.

"It becomes a shell game that grows by leaps and bounds as money launderers become confident they have established patterns of account activity that can be accepted as normal for the accounts, even though no real business other than to transfer money into and out of the accounts is evident from the bank customer statements."

Cruz points out that the 1,000 pages of customer records he brought out of HSBC provide evidence that the Social Security number stolen from one individual was used to create over 5,000 fraudulent accounts through which more than $800 million was transferred in-and-out over a six-month period, all without the knowledge of the person whose identity had been stolen.

"The suspicious activity I witnessed while employed at HSBC was shocking to me, both in the audacity to steal the identities of legitimate individuals to create the fraudulent accounts and in the staggering amount of money that was run through the accounts, once they were established," Cruz concluded.

He was employed as a relationship manager at HSBC in Long Island, N.Y., from January 2008 to February 2010.

Cruz was fired for "poor job performance," after, he claims, he refused to stop investigating, documenting and reporting suspicious activity he encountered almost daily in doing his job.

He has written a book-length account of his experience at HSBC, published in October 2011 under the title "World Banking, World Fraud: Using Your Identity."

Previous stories:

Look who 'has stolen IDs, fake tax returns'

Investment firm fires WND reporter for exposing scandal

Big bank retaliates against WND for exposé

PayPal, American Express implicated in bank fraud

See big bank money-laundering evidence

Banking giant accused of laundering billions