How the RCMP took down prolific cyber fraudsters

Content

We’ve all got them. Those annoying spam calls or texts saying there is a “problem with our accounts.” Hopefully, there will be a few less now.

In February 2025, RCMP in Toronto arrested 2 people who had been operating one of the most prolific scam operations in Canada. The evidence against Chakib Mansouri, 30, and Majdouline Alouah, 32, indicated that the total number of their victims was likely in the thousands, with potentially millions of hard-earned savings being stolen from Canadians.

“The suspects were running a scam, via calls or texts, showing spoofed phone numbers alerting victims of suspicious activities on their financial accounts,” says RCMP Corporal Erin Power, a key member of the investigation team. “Victims were redirected to fraudulent bank websites where they were prompted to enter their sensitive financial information, which was then used to drain their accounts. Money was being laundered through online casinos or cryptocurrency accounts.”

In August, the couple plead guilty to charges of fraud, unauthorized use of a computer, laundering proceeds of crime, unauthorized possession of credit card data, and possessing the proceeds of crime. The presiding judge sentenced Mansouri to 4 years and 9 months, and Alouah to 2 years and 9 months.

Identifying the suspects

Canadian law enforcement first got wind of the case in late 2022, when police in the U.K. notified the RCMP about an account on a platform called iSpoof.cc being used to defraud victims in Canada. According to the European Union Agency for Criminal Justice Cooperation (EUROJUST), iSpoof.cc was an online app that enabled scammers to trick victims by appearing as if they were calling from banks or tax offices.

The challenge for investigators was to identify the people who were behind the account. Doing so required the Ontario RCMP Cybercrime Unit to cooperate with several domestic and international partners including the London Metropolitan Police, the Dutch National Police, EUROPOL, EUROJUST, Toronto Police, Peel Regional Police, FINTRAC, the Canadian Anti-Fraud Centre, and the National Cybercrime Coordination Centre.

“This investigation underscored the critical importance of international and domestic cooperation in the global fight against cybercrime. Collaboration was essential,” said now-retired RCMP Inspector Lina Dabit, who was in charge of the Cybercrime Unit during the investigation, in the news release at the time of the arrest.

The unit had an early breakthrough just a few months into the investigation when analysts located call logs, which showed the account users had used a spy function or live call monitoring function that displayed the actual, rather than the spoofed, telephone numbers from which the calls were being placed.

“Once the owner of the phone numbers was identified, we could run open-source research to figure out who they were, where they were located, identify any businesses run by them, and look for any related social media accounts,” says Power. From there, Power says they were able to issue orders for bank records, including voice recognition data.

Luck and solid police work

By this point, the investigation team was near certain that Mansouri and Alouah were its targets. Then an odd bit of luck worked in their favour to lock down their identification as the suspects.

The suspects had a bad experience that had a side effect they didn’t expect.

“Their expensive car had been stolen, and they reported it to the local police,” says RCMP Staff Sergeant Wayne Wong, the team lead for the investigation. “As a result, we were able to fill in the last few missing details."

The Toronto Police Service responded and filed a full report on the stolen vehicle, which included names, address, and even body-worn camera recordings with the vehicle owner’s voice. According to Wong, it was a perfect match to the voice on the bank calls as well as the ones the investigators had been hearing while trying to identify Mansouri.

Once investigators had their suspects, they moved to get the evidence to prove the crimes. “Mansouri and Alouah showed no means of income, despite living a lavish lifestyle,” says Power. “They did not travel to any job; they did not meet with clients or colleagues; and even though 4 businesses were found in their names, they were all shell corporations.”

At this point, the RCMP brought in an undercover operative who became close friends with Mansouri and Alouah to gain their trust and draw out a confession. And it worked.

“They showed him how their scam worked,” says Wong. “They even showed him how they used cryptocurrency and online casinos to launder their stolen funds.”

Shocking scale of crime

Following the arrest in February, the RCMP searched the home of the perpetrators.

“At the beginning, we had estimated that there might be as many as 600 victims,” Power says. “But when we started processing the evidence from the search, we realized this was something bigger.”

Following an analysis of just one of the mobile phones that had been seized during the search of their home, the RCMP found evidence of hundreds of victims, according to Power. The RCMP had seized 40 phones during the search. “We realized that there could literally be thousands of victims,” Power noted.

Power says the scale of their crimes made Mansouri and Alouah a clear threat to Canadians.

A significant legacy

According to her, the bail hearing for Alouah will have long-lasting implications for future cybercriminal trials.

“Normal bail conditions can be ineffective at deterring cyber scammers. An ankle bracelet won’t stop someone from running a scam on a mobile phone,” says Power.

While Mansouri never asked for bail, there was initial uncertainty over whether Alouah would be released.

“One of the biggest successes of the investigation was that she was remanded into custody, detained on primary, secondary, and tertiary grounds. The Justice of the Peace understood the severity of the situation,” says Power. “She made a powerful argument for Alouah being detained based on the threat she presented to Canadians.”

According to Power, the decision to detain Alouah could have a powerful legacy. The decision can now be cited by prosecutors in future cybercrime cases, providing legal support for keeping suspects in these trials in jail while awaiting trial.

What to look out for: Get Cyber Safe!

“I urge all Canadians to take steps in safeguarding their financial information,” says Power, providing the following tips:

• Enrol in enhanced features like 2-factor authentication and account alerts
• Be cautious with calls or texts that claim to be from your financial provider
• If something seems suspicious, don’t respond. Instead, contact your financial institution directly.
• If you believe you’ve been targeted, or victimized by fraud, please report it

Power stresses that reporting is critical, citing the Canadian Anti-Fraud Centre’s data, which shows only 5% to 10% of all fraud and cybercrime incidents being reported in Canada.

“Reporting enables law enforcement to combat fraud and cybercrime and helps identify linkages across separately reported cybercrime incidents, including connections to organized crime,” she says.

If you have been a victim of a cybercrime, fraud or scam, report it to your local police the Canadian Anti-Fraud Centre (CAFC) using their Online Reporting System or by phone at 1-888-495-8501.

Your report will not only help police respond to your case, but it could prevent others from falling victim.