On March 19th, the state of California was placed on lockdown after news that the novel and deadly virus, COVID-19, was spreading like wildfire, crippling the nation’s hospitals. Just days later, other states followed suit. While families stocked-up on food and basic necessities, they then raced home to hold their families close, fearing what was to come. Across the nation, business owners were forced to close shop if their services or goods were deemed non-essential by the government, and their employees were quickly shuffled to work-from-home status. While everyone was defining their new normal, something equally sinister was lurking and spreading as quickly as the virus itself.
Modern day conmen, using a tactic known as spear phishing, began targeting both buyers and sellers of in-demand, and lifesaving, Personal Protective Equipment known as PPE, due to a nationwide shortage. The Occupational Safety and Health Administration (OSHA) defines PPE as “equipment worn to minimize exposure to hazards that cause serious workplace injuries and illnesses.” Everyone from the U.S. Government, to hospitals, retirement homes, nurses, patients, and everyone else, needed PPE Masks, but there was no stockpile beyond profiteers’ warehouses and garages; it quickly became obvious the nation was in short, accessible supply. On Friday, April 10th, Los Angeles County instituted a WEAR MASK order into law to protect both store clerks and necessity shoppers from the deadly virus.
Respirators, sometimes referred to as face masks, soon became the most widely requested item in America, second to hand sanitizers and toilet paper. And, the Phishermen, as I like to call them, were lurking and ready to phish in a very large pond, with millions of dollars to gain. I happen to know, because I spent the larger part of a week, unraveling the scam.
I am the owner of a twenty-five-year old consumer promotions and marketing company called Tagsource, LLC (AKA TAG!) I sit on the Board of Directors of the Specialty Advertising Association of California (SAAC). My company is a long-standing member of the Promotional Products Association International, a member driven organization that services a $23.3 billion-dollar industry with more than 3,500 supplier companies, 30,000 distributor firms, and together we comprise some 50,000 American jobs. Distributor firms have been playing in the field of PPE (like hospital gowns, shoe coverings, FDA approved masks, uniforms, etc.) because we already service the medical community with branded merchandise. Together, with our suppliers, we have well-vetted, consistent, and reliable factory relationships. We understand product and factory compliance, fair practice and pricing, licensing requirements, government regulations, safety testing, and labor standards.
When medical supply companies couldn’t meet the demand to service the current wave of PPE requests, procurement officers came to us, or we went to them. Our industry rose to the challenge as a secondary source to solve the nationwide #PPEshortage. But, like everyone else, we were struggling to keep up with the ever-evolving COVID-19 FDA regulations, CDC guidelines, state and federal rules, and new border restrictions that could prevent our products from getting through to our buyers and their end-users. We were learning as quickly as we could to keep up, but new middlemen began to proliferate the marketplace, and they were learning the ropes. From pop-up brokers, to fly-by-night organizations, small businesses looking to diversify, Amazon profiteers, to millionaire investors: Everyone wanted to get in on the sale of face masks due to increasing demand, and they began to inundate call centers nationwide.
Enter Trump vs. 3M, creating a perfect storm for spear phishing.
President Donald Trump said Friday his administration will try to stop “profiteers” from exporting medical protective gear, shortly after picking a fight with manufacturing giant 3M, a major producer and exporter of face masks used to protect health care workers from the coronavirus.”
3M argued that blocking exports will raise “significant humanitarian implications” abroad and lead other countries to retaliate by withholding much-needed medical supplies from the U.S.
Middlemen, in most cases, were trying to help solve one of the greatest potential humanitarian crises of modern times, while justifying making some money along the way.
And, the “Phishermen” pounced.
PURPORTED SPEAR PHISHING SCAM UNPACKED:
In the wholesale world, a company needs a buyer and a seller of goods to do business. For me, this all started with an email from an importer whom we’ve worked with in the past. The Phishermen work the supply chain until they get to the buyer. (As far as I can tell, my importer is just another spoke in the wheel on the bike ride to get to me, and through me, hopefully get to any one of my buyers.)
We have a failed order available for 3 million n95 masks, see pics and license attached, goods are available fob china at $2.50/pc for immediate pickup? Thanks!
My interest has peaked. I open the email and inspect the documents, and they look off. I ask standard questions, and for more documentation, because remember, I’m working with someone I should trust here, and so I engage. (As far as I can tell, my importer is innocent in the scam.) And, I respond to the email:
The documentation provided is for “child masks.” Please confirm that they are adult masks and please supply accompanied documentation for those. Also, why aren’t they marked KN95? The documentation as supplied won’t work. Also, we’re learning PPE products are being seized at the ports. There are also US mandates against price-gouging. These normally sell for $2.00 domestically?? Please advise any/all information you can supply.
My importer emails his contact, tells him I’m questioning docs, and probably discloses I have a big potential buyer on the hook waiting for details. At this point, I don’t know who he’s feeding my info to, only that normally he’d be working factory-direct. I have, by now, given him the CDC list of respirators approved under standards used in other countries that are similar to NIOSH-approved N95 respirators. At this point, I’ve questioned docs on products that have been offered for sale, and I’ve stated what I’ve seen from him doesn’t conform to CDC guidelines, let alone my own scruples. Then the importer offers me the product repackaged and relabeled to get them through the border and gets a thorough reprimand from me for even suggesting it.
The purported Phishermen now know the deal they offered me through my importer has to change because none of it passes my cursory inspection to this point. The deal does change, and it gets even bigger and BETTER!
150 million 3M N95 8210 for $4.35 each, landed anywhere in the free world. Coming from China with 50 million shipments. 1 now, 1 in a week, and 1 in 2 weeks. 35% with the PO for each tranche in the escrow account, balance with bill of lading. All instructions in the Purchase order.
Holy flippin’ cow! I’ve hit the mother load! I found those 3M N95 8210’s that 3M vs. Trump prevented from getting into the country! So, I donned my Superwoman cape and declared, “Don’t worry world! I’m here to save you!” Just kidding. I know something’s up. And, drop ship promo business was slow; I had extra time on my hands. I simply had to follow this through.
Meanwhile, in addition to our normal clients on the mad dash hunt for PPE, I’ve got a pop-up broker now in my ear because I tweeted about the purported stockpile leaving China, just in case a miracle was about to unfold, but also to see what turned up. Someone tweets me back, and asks me to take the convo to WhatsApp, where I learn he has a 40 million unit order on the hook for a major healthcare company in dire need, as well as a solid book of other million unit buyer leads. We have an hour long Zoom meeting, and he seems legit, if not overtly opportunistic, and it’s all too promising not to follow through. And, since his purported buyer is in the news about their own PPE shortage, I now have no other choice but to follow all this through. Me and my big tweeting mouth. Still, I’m proceeding with extreme caution with both the buyer and the seller.
I’ve been in business a long time. These high volume numbers are surreal, but “the population of the United States of America is 330,594,690 as of Wednesday, April 15, 2020, based on Worldometer’s elaboration of the latest United Nations data.” My family needs at least three masks to get us through a month of necessity shopping and that’s with continuous reuse. I can do the math.
I wait for the preliminary documentation I requested from my importer. I get something, which in my mind, is the most important thing. It’s an SGS DOCUMENT on the products being sold. SGS offers “world-leading certification services enabling you to demonstrate that your products, processes, systems or services are compliant with national and international regulations and standards.” I’ve been given documentation, purportedly on the production contract on actual goods being offered for sale. So, before I go any further, I upload the doc to SGS to verify its authenticity, but it’s Good Friday, and I know I won’t hear anything back until the following week, and I am on the race to the finish line to potentially land the deal of the century or figuring out the scam and getting back to my old sequestered workday life. I have to keep the bicycle in perpetual motion.
My purported buyer and I work together on a list of docs he wants to see. He seems very familiar with the doc list, which is surprising from someone who is a pop-up broker with potentially big buyer leads. But, his doc list is extensive. And, that’s what’s weird to me. He’s operating like a seasoned and savvy procurement officer would at Walt Disney Company. Or, maybe he’s FBI? Or, maybe he’s already been around the block with distributors like me. I don’t know, but our hour long conversation on Zoom was enjoyable. He sends me his requests:
- Background story
- How did you get the goods and what is your relationship with the seller and/or 3M?
- Have you sold any deals yet?
- Are all 150M units available in about a week at the seller’s airport in the US? What state are they arriving?
- Past References of buyers (Bob, do you have references, as well as the seller? We’ve already supplied ours.)
- Past Bill of Landing (redacted fine)
- 3M Contract (redacted fine)
- Past SGS inspections
- Is there a SGS Certificate of approval on the goods?
- LOI/PO – addressed to who?
- Business name
- Escrow terms and bank information
- Payment terms
- Location of goods and the date of arrival
- Lead time
- Price quoted was landed US and includes delivery to buyer, correct?
Later the purported buyer asks me for: Business registration, Proof of Authorized 3M Distributor, Current SGS Certificate, Certificate of conformity, ISO Certification, NOAH Certification, Nelson Lab Certification, Production Contract and Escrow Docs. Could the buyers and sellers be somehow interlinked in one big scam? He doesn’t suspect that I may suspect him, and by now he’s admitted he’s aware of scams, and likely could suspect me as a scammer as well. And, I’m thinking maybe he still could be a legitimate broker looking to land a 40 million unit deal, a deal of his lifetime, and frankly, of mine.
Since my purported buyer packaged his list of requested docs for me, I sent it to my importer, as if I wrote it myself, and told him what I needed.
Minutes later, I received this from the importer:
150 million 3M N95 8210 for $4.35 each landed anywhere in the free world. Coming from China in 50 million pallets shipments 1 now, 1 in a week, and 1 in 2 weeks + R and E. 35% with the PO for each tranche in the escrow account, ours or yours, balance with bill of lading. Put all instructions in your Purchase order. Attached is a SGS report. Two failed PO’s without POF. Make Purchase Order out to:
<Gives name > Wire Instructions: The Seller uses a former Attorney General to set up the Escrow account. <Gives account number, routing number, Chase bank address in San Diego and swift code> Once the Seller receives the PO and POF, they will issue a Video and a current SGS report and an invoice and send you Escrow information. Now the buyer may talk to the seller. Once all the funds for the first shipment are in Escrow, they will ship 50 Million Now; 50 Million in a Week, 50 Million in 2 Weeks. Once the funds are in Escrow, the first 50 million masks will be shipped by air freight to the airport of your choice at the Seller’s expense. Gown/mask/cap combo. Cost is $5.60. Ventilator Model # YH-830Bi pap. CIF $17,500. Made in the USA. See attachments.
Now, I’m really perplexed. They won’t supply docs until I show them proof of funds. I create a stir with the importer and say no one would operate under these conditions, and I need to see the docs before the buyer will submit a PO, POF, and certainly before they send a 35% down payment on a multi-million dollar order. The importer has a vested interest in closing a big deal, so he gives me the information of his buying source, and get this, it’s an 84-year-old Vietnam Vet who has spent his last ten years in medical sales here in Southern California. I speak to him, but only after scouring the web to see what dirt I can drag up on him, and I discover at least one scam alert from a purported shady deal, sometime ago. He’s as sweet as can be, and tells me about his past wives, and how he’s tied into a Canadian factory that is an authorized Distributor of 3M products, and that factory has the pulse on all twenty-two, 3M factories worldwide. Although he has a scam alert, I believe he believes this is true. The dude is 84. I cut him some slack for one deal gone wrong. (You’d understand if you were on the receiving end of a phone call with a veteran telling war stories and commiserating about his late wife dying from cancer.) And, in the back of my mind, I think maybe my seemingly nice Veteran, who deals in medical sales, could possibly have the legit pulse on a bonafide 3M production contact. If he does, and I have an authentic healthcare buyer, I can get the 3M masks through the border legally, the only way I would touch any deal. He tells me his supplier has stock and they can get me whatever I need. The Vet then sends me the longest, most carefully drafted, NCNDA I have ever seen in my life. I tell him I’m not signing it because it prevents me from selling anything, like ever again. It’s been drafted by lawyers. Really good ones. Somewhere around this time, I advise both the importer and my Vet that 3M vs. Trump is making me think nothing is getting in without government seizure. They communicate that, I’m guessing, to their Canadian partners.
What follows is this from the importer:
Hi Salespeople Reps and Brokers: We are now a sub-distributor of 3M masks. The procedures are relatively simple, we get the purchase order (PO) which must include the buyers name address and phone number along with the product that he wants and any additional instructions. That purchase order goes to the attorney for Interways solution Canada Ltd. the attorney then takes over by calling the buyer arranging for the Deposit to be put into the escrow account. They are sent out at that point the contract and all documents including the invoice. You will receive copies of that. They have a Paymaster to pay the difference of actual cost and the overage which is commissions to us. Currently I have not received the first set of documents as the attorney took Friday off and Sunday, however I’m just giving you an update. I expected Copy that my first transaction within the hour or so. We are extremely comfortable with the process and dealing with a distributor of 3M products. Hold your questions until I send you copies of documents sometime soon. Thank you.
Here is where the PO’s are addressed: <Gives Address> Our new pricing for all Masks. Note we can not ship 3M products into the USA, ordered by Trump. Pricing for 3M anywhere else. N95 1860 $4.15. N95 8210 $4.55 Minimum is 10 Million CIF. KN95 in stock at LaGuardia NYC, $3.15 landed at the buyers airport. KN95 coming from China $2.45 CIF, any country.
By now SGS, has gotten back to me to confirm my suspicions and with this, I’ve had enough of all myself and all my sleuthing:
Dear Tonia, Thank you for submitting the attached documents for authentication. Unfortunately, we are unable to verify this document as part of the format has been removed / hidden. This document is thus of no value whatsoever and we advise you to not rely on it for any purpose. As you can understand, SGS takes very seriously any attempt to alter the appearance of our documents. We would appreciate any assistance you can give us in tracking down the source of this altered document by completing the attached form. Best Regards, Corporate Security Team.
I finally email the importer and let him know he’s potentially involved in a scam of EPIC proportions. I want to copy my Vet, but I don’t have the heart, and I notify the purported pop-up broker/buyer/FBI Agent/procurement officer that the deal is a bust, and that given everything going on with 3M vs. Trump, I’m out. I don’t disclose much further. He responds and says, “So was it a SCAM?” I tell him about the N95’s I can definitely procure from a tried-and-true factory where I can get him three million units of masks, every 3 weeks through my conventional channels. Something still isn’t sitting quite right with my buyer, but I never could connect all the dots. And, I still think he’s a really nice guy.
But, it doesn’t end there:
The importer emails me back with desperate attempts to save the deal that probably had him booking his flight to Aruba. Is he involved in the scam? I really don’t know, but I don’t think so. The Vietnam Vet takes one last crack at documentation, and I let him down as nicely as I could, outlining plain facts that he’s potentially caught up in a spear fishing scam. He asks me to kindly destroy the documents. Is he involved in the scam? I don’t know. I hope not, but I wouldn’t be surprised if he woke-up to find his bank account emptied. He said he had a successful transaction in progress.
Enter New Guy, a purported Distributor principal, like me, who claims he’s been out of our industry, but jumped back in to service old clients on some face masks. Says he’s interested in buying masks from my Vietnam Vet, and my importer told him that my Vet has been vetted by me, and I could confirm he’s legit. I fill New Guy in on what I believe to be was a scam. New Guy’s text came in literally seconds after I announced any deal with me was a bust. New guy definitely seems involved in the scam. He tells me he has two PO’s for 100M KN95’s, and he’s gotten his own attorney involved with his own escrow account, and that I should trust him. He asked me to let him know about legit sources for domestic products to fulfill in 7-10 days. He’s got a buyer on the hook and the deal is about to go bust. But then, in the next sentence, he tells me if I don’t mind waiting 7-10 days, he can get me all the products I need, in the states or from China (as a broker), and through his own network. This totally refutes his first statement that he’s deadlocked and can’t get anything done. He sends me his promotional products distributorship’s website, which is fake. I clicked the link, and it’s a screen capture of a website with nothing linking out. He mentions SAAGNY and how he used to sit on the BOD. I ask him to tell me people in industry he knows, just for fun. He tells me he doesn’t know who I know, so he doesn’t name anyone. He then begs me for legitimate documentation so his deal doesn’t go bust. I tell him to go away. He doesn’t give up, tells me I should believe in him, and he sends me more links to companies he’s an investor in, all with websites built in 2020, and with links to barely built websites. I tell him he’s a crackpot, and he reminds me to be careful. I ignore him forever.
So this is what I know after that long, sordid tale:
- The scammers need something from us, and they are desperate to get it. They need all this legitimate documentation that buyers would ask for, to make their scam work. If we provide it, we are feeding it into the hands of devils with phishing poles. Likely, it’s already been handed to them in some capacity. With documentation, Phisherman can prove legitimacy of production. I literally loathe Phishermen. Get them out of our pond!
- The promotional products industry is ripe for the picking because we have buyer/distributor/supplier/importer/factory relationships. We are one industry that has the full supply chain in our back pockets.
- Fake brokers/buyers may also be looking for documentation to make a scam work. I’m not sure, but I think the buyers and sellers may somehow be connected, even if unwittingly. I’m not saying my pop-up broker is a scammer, because he’s so nice and all, but definitely some things are not lining-up. It’s weird how the first message on WhatsApp from the pop-up broker, matches some of the last details from the seller. Either he’s caught up in the same scam, legitimately trying to source product, or he’s connected to the same scam in some devious way. (If he’s reading this, I want to remind him that I want to believe he’s nice.)
- Nothing lined up. Altered docs. The wrong docs. Not enough docs. Nothing presented was enough to satisfy my buyers. Be wary of deals where too many middlemen are involved, and demand documentation before disclosing anything. If it walks like a duck and talks like a duck, it could be wolf in sheep’s clothing.
- It’s possible these massive buyers and sellers are all a ruse, and the only thing they are trying to do is get is the importer’s, the Vet’s, and my bank accounts which is required to commission us on the back-end of a sale.
- Fake brokers could also be creating fake demand and targeting the promotional products industry specifically. Creating fake demand puts us all in a buying and selling frenzy, hoping we forget standard protocol, and that alone could also be perpetuating the fear about the #PPEshortage that may or may not truly exist on such a grand scale.
- Never mess with a sequestered woman who is trying to diversify during a worldwide pandemic, and who just happens to have some extra time on her hands.
This whole write-up needs to be reported to the FBI.