How Barbie-doll maker Mattel got back $3M US from cyber thieves
Executive at California-based toy company wired millions to a Chinese bank following bogus email
The email seemed unremarkable: a routine request by Mattel Inc.'s chief executive for a new vendor payment to China.
It was well-timed, arriving on Thursday, April 30, during a tumultuous period for the Los-Angeles based maker of Barbie dolls. Barbie was bombing, particularly overseas, and the CEO, Christopher Sinclair, had officially taken over only that month. Mattel had fired his predecessor.
The finance executive who got the note was naturally eager to please her new boss. She double-checked protocol. Fund transfers required approval from two high-ranking managers. She qualified and so did the CEO, according to a person familiar with the investigation who spoke on condition of anonymity because he was not authorized to speak about the matter. He declined to reveal the finance executive's name.
Satisfied, the executive wired over $3 million US to the Bank of Wenzhou, in China.
Hours later, she mentioned the payment to Sinclair.
But he hadn't made any such request.
Frantic, Mattel executives called their U.S. bank, the police and the FBI.
The response? You're out of luck. The money's already in China.
Global money laundering hub
Mattel's millions were swept up in a tide of dirty money that passes through China and that Western police are only beginning to understand. The scam the company fell victim to — known as the fake CEO or fake president scam — has cost companies, many of them American, more than $1.8 billion US, according to the FBI. Most of the stolen money passes through banks in China or Hong Kong.
China is emerging as a global hub for money laundering. The dark money that courses through China has long been considered a domestic issue, with Chinese illicitly moving money for other Chinese. That's no longer the case. Mounting evidence indicates that China is becoming a global banker for the criminal economy, according to interviews with police officials, court records in the U.S. and Europe, and intelligence documents reviewed by the Associated Press.
Years of mutual mistrust have hindered law enforcement co-operation between China and the West, adding to China's appeal as a money laundering hub. The U.S. State Department said in a report this month that China has "not cooperated sufficiently on financial investigations."
In a regular briefing with reporters on Monday, Chinese Foreign Ministry spokesman Hong Lei said that the government "places great emphasis" on fighting crimes such as money laundering and is working to expand international co-operation.
"China is not, has not been, nor will be in the future a centre of global money laundering," he said.
Mattel's misadventures in China
Mattel wasn't going to let go of $3 million without a fight. What the company really needed was luck. And when it came to Mattel's China operations, luck had been in short supply.
Mattel's misadventures in China are so spectacular they've become the stuff of business school seminars. In 2007, Mattel recalled 19 million made-in-China toys, including Pixar cars covered in lead paint and Barbie sets embedded with tiny, hazardous magnets.
Then, in 2009, Mattel opened the "House of Barbie," a glowing pink, six-storey shrine on one of Shanghai's ritziest shopping boulevards. It had a spiral staircase encased with over 800 Barbie dolls, a spa and a fashion runway. But the flagship flopped, and Mattel closed it after just two years.
Rising costs and labour shortages weighed on China production, even as the $5.7 billion US toy giant limped back into the Chinese market with dolls — including a Violin Soloist Barbie — aimed at Chinese "tiger moms."
The thieves struck as Mattel was aggressively pushing its China business, positioning itself as a child development brand, which helped grow China sales 43 per cent in 2015 over the prior year. They had done their homework, mining social media and likely hacking corporate emails to penetrate Mattel's corporate hierarchy and payment patterns, according to the person familiar with the investigation.
The criminals had the $3 million sent to Wenzhou, a gritty enclave on China's eastern coast that is emerging as a significant transit point in global money laundering networks. The city is the destination for 90 per cent of the funds stolen through fake CEO scams in Europe, according to an intelligence memo reviewed by the AP.
Wenzhou city officials declined to comment.
Squeezed by mountains against the sea, Wenzhou is known as the birthplace of underground finance in China.
'Money could scatter to any other place'
Decades of official neglect allowed an unusual, business-oriented culture to thrive here. After Mao's anti-capitalist rule, a private economy began to re-emerge in Wenzhou in the late 1970s. But those first peasant entrepreneurs — and the informal financing mechanisms that sprang up around them — inhabited a legal grey zone, said Chen Zongshi, an assistant sociology professor at Zhejiang University. It would be a decade before Wenzhou was officially authorized to develop private enterprise, according to Zongshi. Those regulations were among the first in China.
Poverty, underdevelopment and a lack of arable land also made Wenzhou an ideal place to leave. Strivers heading for Europe and North America poured out of Wenzhou, and in their wake, the informal financial systems that served the area's entrepreneurs went global.
Today, money that ends up in Wenzhou doesn't have to stay there — thanks in part to the pawn shops and corner grocery stores that quietly double as money-transfer agents, said Yan Lixin, the secretary general of the China Center for Anti-Money Laundering Studies at Shanghai's Fudan University.
"From Wenzhou, the money could scatter to any other place," he said.
Chinese police freeze account
Luck arrived for Mattel in the form of a bank holiday. Friday, May 1, was Labour Day in China.
That, crucially, gave Mattel time. The company notified Chinese police, who quickly launched a criminal investigation, according to a letter from Mattel thanking Chinese authorities, which was obtained by the AP.
When the Bank of Wenzhou opened the following Monday, a China-based anti-fraud executive from Mattel strode past the sculpted lions that flank the entrance to the bank's headquarters, marched upstairs to the International Business Department and presented a letter from the FBI, according to two people familiar with the investigation who were not authorized to speak publicly.
Chinese police froze the account that very morning. Two days later, on May 6, Mattel got its money back, according to the letter.
Mattel wrote that the Wenzhou police "showed a great sense of responsibility and enforcement capability."
"We hereby reiterate our appreciation," Mattel wrote. "We also hope that this case can pave the way for future international cooperation in fighting similar transnational crimes."
Chinese authorities pursue corruption
International co-operation has grown in importance for Beijing. China's ruling Communist Party is campaigning to purge corruption from its ranks, pursuing officials who have fled overseas with ill-gotten wealth, in an effort to shore up its legitimacy as China's economy slows.
"If we need help getting corrupt officials or bribes back, we need to offer assistance when other countries need it too," said Huang Feng, Director of the Institute for International Criminal Law at Beijing Normal University. "The problem is not that the Chinese authorities have been unco-operative, it's that we don't have a relevant legal framework to implement."
He said Mattel fought the fraud correctly, imploring Chinese authorities to use Chinese law to get the money back.
The Bank of Wenzhou confirmed that its staff handled Mattel's case but declined to comment. Police in Wenzhou confirmed that an investigation was ongoing but declined to discuss details. Mattel also declined to comment for this story, citing the ongoing investigation.
Since its near miss in Wenzhou, Mattel has tracked a dozen more attempted hacks.
It's still not clear who was behind the scam.