Exclusive:US Secret Service investigate Scotland firm over multi-million pound cyberattack fraud

Around £2.1 million has been stolen from the housing agency as the US Secret Service is investigating

It is a little-known clothing firm based out of an anonymous residential street in Scotland’s biggest city, with overflowing bags and boxes of rubbish piled up outside its front door.

But a Glasgow company is at the centre of a multi-million pound fraud investigation by the US Secret Service into millions of public money that was stolen from a fund designed to help struggling homeowners, The Scotsman can reveal.

For the past year, authorities in the US have been looking into how a state agency in North Carolina fell victim to a form of cyberattack known as a business email compromise, in which scammers use fraudulent emails to impersonate executives or other trusted individuals to solicit sensitive information and the transfer of money to shell accounts.

The public agency, known as the North Carolina Housing Finance Agency (NCHFA), provides affordable housing in the south-eastern US state, and has provided tens of billions of dollars to bankroll new builds and help with the cost of mortgages and repairs for those who are struggling.

But in April last year, it called in police and the FBI after what it referred to as an “isolated cyber incident”, which saw it lose around $2.7 million (£2.1m). At the time, Dale Folwell, the North Carolina state treasurer, said the criminals had “worked really hard” to embezzle the money, and stressed there were “a lot of hard working” people across the state government trying to stop them.

Now, it has emerged the investigation into the cyberattack is focused on a business based in Glasgow, which cannot be named for legal reasons, with officials going to court to recoup the money from an online bank account set up by the Scottish firm.

The fraud came to light after employees in the NCHFA finance department received emails requesting updates to the payment account for Innovative Emergency Management (IEM), a private firm that assists the agency with a scheme known as the homeowner assistance fund. The fund is a multi-billion pound pot of money set up by the US government to help homeowners facing financial hardship as a results of the pandemic.

Around £2.1m was stolen in the cyberattack, with the US Secret Service investigating a bank account set up by a firm based in Glasgow. Picture: Sean Gallup/Getty Images

The email address that made the request to NCHFA was similar, though not identical, to the real company. The NCHFA staff did not notice any difference. After the agency’s bank, Wells Fargo, urged it to verify the account information, it was too late.

According to Caleb Anderson, a special agent with the US Secret Service, a representative at IEM pointed out the updates “were not legitimate nor requested” by the firm’s employees. “NCHFA realised the email address requesting the IEM account updates did not match other IEM employee email addresses,” he added in a written declaration to the US District Court for the Eastern District of North Carolina. “Subsequently, it was determined approximately $2.7 million had been wired to a fraudulent account.”

By June last year, a review had established the account that had received the money was maintained by Currencycloud, a firm that allows businesses to move money across borders and conduct transactions in multiple currencies. On closer inspection, it transpired the account had been opened just weeks before the transfer in the name of the Glasgow-based business.

According to Mr Anderson’s declaration, the firm’s bank account received the $2.76m payment in April last year, with Currencycloud receiving an invoice document from the business in which it claimed it had billed the North Carolina agency for a “consultancy and management fee”. His affidavit, filed as part of a complaint to US District Court for the Eastern District of North Carolina, adds the money that was obtained by the Glasgow-based firm via the “unlawful laundering” was seized. The local US attorney is now pressing ahead with a civil forfeiture claim.

It is unclear what action, if any, US authorities intend to take. According to filings maintained by Companies House in the UK, the company was incorporated in January 2023. Its confirmation statement is listed as being overdue, and the company has yet to file any accounts.

The records state the firm is concerned with the wholesale of clothing and footwear, as well as retail sale, via stalls and markets, of textiles and clothing, but there is no indication of whether it is actively trading. Its registered address is a house in Ashcroft Drive in Croftfoot, based in the southside of Glasgow. The Scotsman understands neither the named firm nor its listed director are the owners of the property.

It is one of at least four companies that have been registered by Romanian nationals at the same address, according to Companies House records. Some firms were registered as freight transport enterprises, although others list the nature of their business as housebuilding, or painting and plastering. Apart from the business being investigated by US authorities, all the firms in question have either been dissolved or are in the process of being struck off.

Last week, there was no answer at the upper cottage flat on the street. The curtains in the property’s front windows were drawn, while piles of rubbish bags lay strewn to the side of the house. One neighbour, who did not wish to be named, said it was unclear who lived in the address. “You see people coming and going, but I don’t know who they are,” they explained. “It’s news to me that a house in this street is involved in something like this.”

A spokeswoman for the US Secret Service said the agency was “unable to comment on pending litigation and/or any potential ongoing investigations”. The US attorney’s office for the Eastern District of North Carolina said: “We can’t comment beyond what is available in the public record at this time.”