Suspicious behavior led to the arrest of a “former member of the Rhodesian SAS” who was trying to illegally export peregrine falcon eggs to Dubai. An sharp-eyed Birmingham cleaner is being hailed as a hero for alerting police

[Jeffrey Lendrum] was caught with the rare eggs, valued at £70,000 on the black market, strapped to his body.

Lendrum, who had previous convictions in Zimbabwe and Canada for stealing rare eggs, had asked to use a shower room in the VIP Emirates Lounge.

But Mr Struczynski spotted him dashing in and out the cubicle. He became suspicious when he noticed the cubicle was still dry.

He checked bins in the room nearby where he discovered two discarded egg boxes, which contained a single red-coloured egg.

The cleaner contacted counter-terrorism officers who searched Lendrum.

Previous convictions apparently did not do the trick. Easy to see why. The thief admitted to using helicopters to steal eggs — the eggs are clearly worth a high enough reward to make it worth taking big risks.

This time he was only given 30 months in jail. Some say that will do nothing to stop him from stealing again.

Interesting to note the smuggler attempted to hatch a plan that would trick customs officials even if they found the eggs:

Mr Featherstone established that 14 of the 15 eggs found on Lendrum were fertilized peregrine falcon eggs.

He said the 15th egg, a single unfertilised chicken egg, had probably been bought in a supermarket and painted pinkish brown.

He believes that may have been a decoy attempt, to break open in front of customs officers in case he was stopped.

Really? That helicopter footage was also in his bag when he was arrested. Seems to me if customs goes to the length of asking for an egg to be cracked they might also check the tapes. When they see a nest that has to be reached by helicopter…might be a big clue that those eggs are not from chickens. The thief, in other words, was trying to carry two proofs at the same time — that the eggs are both authentic and fake.

Peregrine Falcon Video Monitor, Buffalo, NY:

It reads like a simple project management list — transfer specific amounts of money using three steps to three people in the Ukraine from three different Western Union locations — under the services title of “IT Outsourcing”.

Krebs has posted an interesting detail from the case last week where $600,000 was stolen in Brigantine, NJ

Below is a screen shot of the alert the Forte Group sent Tharp on the day of the Brigantine breach. Click the image for a larger version.

Kudos to Krebs for publishing it for discussion. The full image on Krebs’ site is said to be from a woman who said she recognized the scam and backed out.

Tharp, who recently lost her job as a buyer for a local automotive supplier, said she figured out the job was a money laundering scam several days before the Brigantine robbery, and closed the bank account she had given her erstwhile employers. But she said the thieves still tried to transfer her $7,394 of the city’s money on Sept. 29. Tharp said she confirmed with her bank that the thieves never managed to deposit the stolen funds.

The instructions have broken English and other inconsistencies. Note, for example:

“Your commision [sic] rate: 0%” and “Your commision [sic] for this task: 0 USD”. However, step two says “Western Union/Money Gram fees along with all other costs, such as bank fees, transportation costs and so on are paid by you and are deducted from your commission.”

The urgency of the request is interesting as well: “As you know our goal is to provide immediate payment service that’s we ask you to complete this task within 1-2 hours. Is it possible?”

The language and style fits within the social engineering study and linguistic analysis we have developed and presented at conferences over the past seven years. Those who have attended our session would immediately have spotted the signs of fraud. It also is further evidence that an automated application of our research will be useful to detect and stop fraud beyond AFF or 419 scams.