Darknet Diaries - 142: Axact

Episode Date: February 6, 2024

Axact sells fake diplomas and degrees. What could go wrong with this business plan?SponsorsSupport for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more.Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.This show is sponsored by Shopify. Shopify is the best place to go to start or grow your online retail business. And running a growing business means getting the insights you need wherever you are. With Shopify’s single dashboard, you can manage orders, shipping, and payments from anywhere. Sign up for a one-dollar-per-month trial period at https://shopify.com/darknet.

Okay, we're recording. So I'm going to call my dad because he's going on about something in emails and I just have to clarify what in the world is happening. Hello. Hey, Dad. How's it going? I thought you were in D.C. Oh, no, I'm back now. Oh, fantastic. Yeah. Fantastic. Listen, I was trying to get, I couldn't quite make it out,

understand what it is you're talking about in these emails. So I wanted to call you to get clarification. My emails. Yeah, so you bought a TV in Mexico. Explain this story to me. Wow. I was in Mexico. Yeah.

And when I was ready to leave, uh, I'll say teenagers saying, Hey, do you want to buy a 75 inch television? I said, no. And he said, well, it's only $65. I said, 65. I said, open the box. I looked in, there was something in there. I said, for $65, you got to carry it to my car. He went, yeah, yeah, yeah, yeah. So they brought it to the car, drove it home. I set it up in the living room, plugged it in. It was so clear and vibrant. And then I noticed that it was the menu for KFC.

Like, well, so it was like you turned the screen, like that's the channel it was on. It wasn't a TV. It was the menu from a KFC. Well, so the KFC has screens, has like TVs that are menus. The TV is a menu. So you sure it wasn't just on the. No. What was it?

No, it was just the drive-up menu for KFC. It wasn't even a TV. Wait, hold on a second. It was just like a light with a plastic piece in front of it? Yeah, but it was very clear, vibrant, chicken, three-piece, four-piece. Yeah. What? They stole the menu off the... Yes, yes, exactly.

Exactly, it wasn't a TV. But the good news is, I put it on the street to get rid of it. Well, hold on. So you put it on the street for the trash truck? No, for anybody to pick it up, not the trash. Somebody might want it. Did you put like a

sign on it or something? Well, it said free. Yeah, it said free. But it was on the street. And then the fourth day I put for sale $25 and somebody stole it that night. These are true stories from the dark side of the internet. I'm Jack Recider.

This is Darknet Diaries. This episode is sponsored by Delete Me. I know a bit too much about how scam callers work. They'll use anything they can find about you online to try to get at your money. And our personal information is all over the place online. Phone numbers, addresses, family members, where you work, what kind of car you drive. It's endless. And it's not a fair fight. But I realize I don't need to be fighting this alone anymore. Now I use the help of Delete Me.

Delete Me is a subscription service that finds and removes personal information from hundreds of data brokers' websites and continuously works to keep it off. Data brokers hate them because Delete.me makes sure your personal profile is no longer theirs to sell. I tried it and they immediately got busy scouring the internet for my name and gave me reports on what they found. And then they got busy deleting things. It was great to have someone on my team when it comes to my privacy. Take control of your data and keep your private life private by signing up for Delete Me. Now at a special discount for Darknet Diaries listeners. Today, get 20% off your Delete Me plan when you go to joindeleteme.com slash darknetdiaries

and use promo code darknet at checkout. The only way to get 20% off is to go to joindeleteme.com slash darknetdiaries and enter code Darknet at checkout. That's joindeleteme.com slash darknetdiaries and use code Darknet. Support for this show comes from Black Hills Information Security. This is a company that does penetration testing, incident response, and active monitoring to help keep businesses secure. I know a few people who work over there, and I can vouch they do very good work.

If you want to improve the security of your organization, give them a call. I'm sure they can help. But the founder of the company, John Strand, is a teacher, and he's made it a mission to make Black Hills Information Security world-class in security training. You can learn things like penetration testing, securing the cloud, breaching the cloud, digital forensics, and so much more. But get this, the whole thing is pay what you can. Black Hills believes that great intro security classes do not need to be expensive, and they are trying to break down barriers to get more people into the security field. And if you decide to pay over $195, you get six months access to the MetaCTF Cyber Range, which is great for practicing your skills and showing them off to potential employers.

Head on over to BlackHillsInfosec.com to learn more about what services they offer and find links to their webcasts to get some world-class training. That's BlackHillsInfosec.com. BlackHillsInfosec.com. Hey, how's it going? Hello, hello, Jack. It's nice meeting you. Yeah, I'm excited to hear the story, but it sounds made up. I know. It's crazy, isn't it? Listen, I don't want my voice to be used if it's okay. Yeah, sure. Of course. I won't use your

voice. Okay, listen. Come closer. Come closer. This is a forbidden interview. The powers that be do not want this guy telling you his story. So I got to do my part and keep him a secret. But I want to tell you this story so bad. So what you heard there was a voice actor. And he's just going to be reading the transcript for you of the interview I did with him. But the other thing is, I've got to conceal this guy's name. So we're just going to make up a name and call him Fazal. Meet Fazal. Okay, some background about me. I'm from Pakistan, actually.

I worked in a call center for eight years. Fazal would answer the phones all day in a call center. He'd sit at a computer, put his headset on, and wait for a call. And when one would come in, he'd see on the screen what company this person is calling about. And he would handle customer support for a handful of different companies. Customers would ask about their account or trouble with their service.

And because he knew English and could speak clearly, he was pretty good at doing this call center work. There was a group of us. We were all friends working there. But we saw this other company had a whole bunch of openings for call center employees. Exact. Exact's website says they're a leader in IT globally. And it looks like it's a very

impressive company. I mean, they've got a recruitment video. Here, let's take a listen to this. Exact is one of the few organizations nationwide that has a well-defined leadership development program and structured career paths. Each and every employee at Xact is enabled to travel that path to reach the highest level in the organization. They had tall buildings all over.

Karachi, Islamabad, Lahore. And you know, they had one of the biggest transport fleets as well. So they were big and we were excited. They were like good money and opportunity. We were tired of our call center anyway. So, you know, it was time.

A whole group of them applied to work at EXACT and they all got the job. It was a much better place than where they were used to. They were in a six-story building and the pay was much better. We started working in their main hub in Karachi. Now, the way this call center would work is we would do customer support for whatever client we'd have. My first client was University in Manchester, England. And this was a little different than what I was used to. He was answering calls,

helping students out with the stuff they needed. But it was also commission-based. Basically, he'd be sitting around waiting for a phone to ring. And if somebody were to call and ask about, like, a program at the school, he was supposed to try to get them to sign up for classes. And if he could, he'd get some extra money from making the sale. But the commission was very small. And not many people would even call that were interested.

So the pay for this university was not very good. But inside this call center was a leaderboard. In fact, it would show you this leaderboard every time you logged into the computer. You could see how much money everyone in the call center was making. And some people were making really great money. Like insane amounts. Hundreds of thousands. And you could see who their customers were.

Other universities. And they were very possessive of their clients. Like one day, another team was very busy and one of the calls rolled over to me and that was for their university. I answered it and immediately someone came running over to me and said, no, no, no, no, transfer that call to me. We have this handled.

So I never got a chance to get any good sales from other universities. Faisal talked to his boss and was like, how come these other teams are making so much more money than I am? Is there a way that I can get a better client or something? So his boss says, you know what, there is something here. We have a brand new client. It just came on board.

And they're called Bayview. No, Bayville. Bay City University. Yeah, Bay City University. That sounds good. They're the same kind of thing that you've been doing. You've got to help students with their online classes. But you can also earn some commissions,

and there's some big potential here. You're interested? F-Zal's like, all right, sure. So they brought him over to this account, Bay City University. No, Baytown University. Yeah, that sounds better. They assigned this account to our whole group. It was strange.

A few people on our team were webmasters, developers. A few were marketers. And then the rest of us were call center workers. The webmasters got to work at creating the university's website, baytownuniversity.com. It said they've got scholarships, a robust alumni network, student aid, and the school was ranked number four in the country. Come take classes and get a great career at Baytown University.

They made this website in a couple of days. It looked really good. It looked just as good as any other fancy university out there. It had a list of courses you could take, a whole portal for students to log in and take classes remotely even. In fact, we had to do training so they could show us how to help students take their online courses. And they set up courses using Canvas, which a lot of schools use Canvas actually. But they showed us how to help students take their classes. It took a couple of weeks to fully integrate this university and get everyone trained up on it.

Then Fazal started getting emails and calls from students interested in signing up. Basically, people were asking about classes there, and Fazal had to try to get them to enroll. And if he could, he'd get a commission. Hi, can you tell me about your teaching degree? Oh, you called at the perfect time. Yes, of course I can. We have one of the best schools in the country. Our professors all come from the highest rated universities and our students typically go on to make great money

after getting their degree. We also have an accelerated program where you can earn your degree fairly quickly. Oh, and did I mention that because we're online, we're one of the cheapest schools around. The sooner we can get you enrolled, the sooner we can get your degree. Our next classes are starting up in two days.

If we can get you signed up in the next 24 hours, we can get you enrolled in this semester's classes. Are you ready to get started? But Fazal was looking at this website and checked into it. And this school did not exist last month. This university is brand new. There are no reviews about it or people talking about it. And he looked at the address.

It was a US address. And he typed that into Google Maps. And there's no building there. He was realizing this school doesn't exist. This was something that Exact created from thin air. There was no real university. There was no learning, no classes, nothing. We were taking people's money and giving them fake degrees. Did they know it was fake? Maybe not at first,

since we had only a few classes you could take a semester. So to them, it might have felt like they were cheating us. Because here's the thing. When you go on Canvas to take the course, you can just hit next on every lesson to finish the whole course in minutes. So they'd get done with all their courses in like 20 minutes for the semester and feel like we're the suckers for not making them go through the course properly. Ooh, that's an interesting psychological trick, huh? To set up the classes in a way that you could easily skip through the material and just finish the whole course in a couple minutes. This made it seem like the students were the cheaters here, not the

school, which kind of brings them in on the scam even more, you know, to make it feel like they're the ones scamming the school, almost. The web team did great work at building this university's website. They listed a bunch of accrediting bodies. And if you go on the accrediting bodies' websites, you see this school is approved. But the accrediting bodies were all made up too. They even went so far as to put on the website that the school is endorsed by Senator John Kerry, even though John Kerry never actually endorsed it. They even made us fake personas on LinkedIn,

which looked like we worked at this university. And so if you looked up the university on LinkedIn, you'd see all these employees there and faculty. Now this school website, besides it being a scam, had another dark side to it. Here, check this out. So if a potential student was interested in going to school here, they could ask for more information about classes on the website or whatever. But to do that, the website would make the potential student create an account on the school website. And they'd create an account on this site and it would ask you for things like your Facebook profile, your Twitter profile,

your LinkedIn profile. And I mean, this isn't so much of a stretch to ask, right? I mean, I've probably been on dozens of sites that have asked me for my social media profiles too. But then all this information is wrapped up and given to Fazal to try to follow up and make the sale. I don't think you understand.

All of it was given to me. All their information. Yeah, okay, then explain. What do you mean? So, when they had to make an account on this fake school site, they had to enter in an email address for their username and make a password. Well, that password was stored in clear text and given to me. Oh, I see. That is creepy.

Yeah, I thought the same. Kind of creepy. But it's far worse than that. I was talking with someone from another team. And they said, go to facebook.com and try to log in with this email and password. And we were able to log in to these people's Facebook accounts. Holy cow, that's not creepy. That's awful. So when you put your password into the school's website, they would just hand that password right to Fazal so he could do whatever he wanted with it. And this is a really good reminder that when we

log in somewhere, anywhere, we're giving our password to the app or the website. I mean, we trust that they aren't looking at our password or storing it in clear text. We trust that they're hashing it or encrypting it so they can't see it even if they want it. But here's a clear example of what could go wrong if we trust a website too much. Exact employees could see the user's passwords and try using those passwords on their social media accounts to see if they reuse the password there. And they would sometimes be able to log in to Facebook or LinkedIn

or even their email inboxes. And the website had some kind of tracker on the user. I'm not sure how it worked. But if I were on the phone with them, I can see everything they are clicking and hovering over. Okay, but why are exact employees even logging into people's Facebook accounts at all? Because what we were doing was building a profile on every new student. The more information we knew about them, the easier it is to sell them on the degree. So once we learned a lot of details about them, we'd call them and say,

I'm not sure if you're interested in a business degree, but we have a big sale on them right now. And we knew very well that's exactly what they wanted. Dang, dude, this is the bunk. That's what this is. Fake university, hacking into students' accounts, and fake degrees. It's a scam.

It's a big, big scam. We haven't even got to step one yet. We also had a lead generation team, or maybe marketing team it's a big, big scam. We haven't even got to step one yet. We also had a lead generation team, or maybe marketing team it's called, who would find potential students. What they did was made it so that if anyone posted their resume on monster.com or indeed.com, the marketing team would pick that resume up

and look at it to see if they would benefit from a degree from our university. I don't know how they were able to immediately see everyone's resumes, but we were sent a lot of resumes. Okay, and what would you do with that? We'd then research that person, look for their social media profiles, try to find out their goals and ambitions, get to know them, then email or call them and say something like, hey, I know you're struggling to find work. I want to help you with that. And of course, I try to get them to enroll. Oh man, you know what? I've made accounts on these career websites before and yeah, it seems like the moment you apply for a job or post your resume, you instantly get flooded with emails about jobs you're seeking and it's extremely hard to unstick yourself from this relentless barrage of job opportunities. It's almost like these sites have an active data breach or are selling your data as soon as you give it to them. Once, I applied for a job in

2008 on one of these job recruitment sites, and I'm still getting emails from people today saying they found the perfect job for me. All right, we at step one yet? Yeah, yeah. Okay, step one. We want the student to enroll, yeah? So we offer them a cheap introductory rate. A few courses. Maybe a few hundred dollars. Where are these students typically in the world? Like, are they in Pakistan? No, no, no.

I never saw any Pakistani students. We mostly targeted US, UK, some of Europe, and a lot in the Gulf states. Like Saudi Arabia, Jordan, you know, Dubai, UAE. Because a lot of people there, money was not a factor for them. Didn't any of this feel wrong? Like, were you maybe thinking twice about giving someone a fake degree? It wasn't just degrees. There were certifications we were offering.

And high school diplomas too. But yeah, I did feel like this wasn't right. But AXAC charmed me to get me to not care. It was really weird. Let me tell you. You ever see how Google's offices are? Yeah, I did. I did go to a Google office once.

And I remember they had free food for the employees. There were free rides to work. There was a place you can get your hair cut in the parking lot. They were given car washes in the parking lot. Yeah, we had all that too. But like 100 times more than what Google gives their employees. It was nuts. To begin with, Exact Offices had a kitchen with chefs to make you anything you wanted.

Free, of course. But they also partnered with the best restaurants in town. So you could go to an internal website, order food from any of these restaurants, and they'd bring you the food right to your desk. And not just like in a paper sack. Whatever food they brought you, it was always done with a touch of class, served by a butler on a nice metal tray. And they would come collect the dishes from you and bring you any drink you asked for. So our food was taken care of while you were

at work, but our food was taken care of at home too. In fact, they didn't want you to fuss with anything outside the office. If you needed groceries, just tell them what you want and someone will deliver it to your home. If your wife needed to see the doctor, someone would go to your house and pick her up and take her to the doctor, wait there with her and drive her home. In fact, they gave us two company cars that we could use however we wanted and they would get you anything you asked for. Take it for a concert or a cricket match. They'd get it for you. And even drive you there.

What was the craziest thing you saw that they offered? Oh, they had a yacht you could use. And let me tell you, in a country like Pakistan, this was extremely rare to be able to have access to a yacht. They didn't seem to care at expenses when it came to taking care of their employees. Dang man, this sounds like a great place to work. Now I want to go work at Exact.

No, no, no. Because they have you work every day. 29 days a month. That's what they required you to do. You get one day off a month. And no matter what you think you need to do, like take your kid somewhere or give your mother a birthday gift, they do it all for you. So you could really focus only on work. And that's all they wanted you to do. Just work all the time. And with students all over the world, you would always be

busy. So did they pay you well? The pay wasn't really that good. The commission was 1%. So if you got someone to enroll and they paid $300, you'd get $3. But because everything in your life is taken care of, it felt like we were living very well. Alright, so you told me step 1. Are there more steps to this? Yes. Okay, step 2. So you know, once you get them enrolled, they might be in a 1 or 2 year program to earn their degree. And new courses are released every few months for them to finish. But now that they are enrolled, I can call them up and say, hey, listen, I know you're really

itching to get done with school. I think I can talk to the dean and get more classes opened up earlier. Is that something you're interested in? Okay, but listen, what I'm going to be doing isn't easy. The dean doesn't like me doing this and I'll need a good reason to do it. So, if I can expedite your classes, so you can just take all the classes you need now instead of waiting two years, would you be willing to pay $3,000 for that? And yeah, a lot of them were happy to hear they could finish their degree

in just a week. I mean, at this point, they had to know that this is not a real school or a real degree, right? Well, see, the school website looked real. Like, it had accreditations listed. The website was approved by Secretary of State John Kerry.

You know, when the US State Department says this is an accredited school, you believe it. Even though his signature was fake and he didn't actually approve it. But yeah, I think some of them did know. And they didn't care. They'd already paid a little and were convinced it was a real school. At least at the beginning. So if they felt it was real, then maybe they thought they could get away with it.

They liked it that it seemed so real. So they could believe it and feel good about it. So when we'd send them the certificate or degree, we made it all exciting and congratulatory for them. Even sent them a gown and graduation hat and asked them to take a picture of them wearing it, holding up their certification so we can put it on our website.

And they would. Okay, what kind of degrees are we talking about here? They had civil engineering degrees, aeronautical degrees, teaching degrees, you know, English language certificates, law degrees, and a lot of high school diplomas. But we never did fake medical degrees. That was always off limits. Because someone could get hurt. Now, while Fazal told me they never sold fake medical degrees,

I did find some evidence that nurses and psychiatrists were buying degrees from this company. I mean, listen to this. This is the CBC News out there in Canada. And they tracked someone down using a fake degree they got from Exact. We're starting our investigation with counselors treating serious medical conditions with fake degrees. First up, meet Alfred Ojo. He treats ADHD, anger management, depression, PTSD, the list goes on.

You have a lot of certificates. Oh, and speaking of news stories, what is going on here? Listen to this. IATA says it is concerned by the report that nearly a third of Pakistan's civil pilots have been flying using what's called fake licenses. IATA is calling it a serious lapse in oversight. Pakistan International Airlines says it has grounded about 150 pilots and says the problem is industry-wide. Yeah, I saw that news story too. It's unrelated to what we were doing. We did not sell pilots' licenses. And that story was in Pakistan. And like I said, I never saw any Pakistanis enrolling in these universities.

And by the way, once we had one university going good and rolling, they would stand up another new university a few months later. Because after a while, these things would be discovered as fake and we'd have to start all over. So it was just good practice to always be building new universities. And they kept giving us new ones to control. We're going to take an ad break here, but stay with us. There's more steps that Fazal is going to tell us about. And I'm really curious to see who's behind this whole thing. Taking action on your company's exposure is more important than ever. I recently visited spycloud.com to check my darknet exposure and was surprised by just how much stolen identity data criminals have at their disposal.

From credentials to cookies to PII. Knowing what's putting you and your organization at risk and what to remediate is critical for protecting you and your users from account takeover, session hijacking, and ransomware. SpyCloud exists to disrupt cybercrime with a mission to end criminals' ability to profit from stolen data. With SpyCloud, a leader in identity threat protection, you're never in the dark about your company's exposure from third-party breaches, successful phishes, or info-stealer infections, get your free Darknet exposure report at spycloud.com slash darknetdiaries. The website is spycloud.com slash darknetdiaries. There was one university that was created out of thin air called Newford University, and they had a whole promotional video. Here, this is the head of the university talking.

My name is Dani Crane, and I serve as an HOD at Newford University. NU is an institution that prides itself on excellence, and as such, we strive to continually improve ourselves. Come be a part of Newford University to soar the sky of excellence. Here's another one from Drumont University, a fake university created by Agsact.

Drumont was an awesome experience for me. I was able to earn my PhD in leadership and education administration. I had the best advisor and was able to acquire a lot of experience in the education administration field. I am finishing my PhD at Drew Mountain University and I expect to graduate this fall. We had this team of sales agents,

but the other people on the team would pose as people who worked at the school. So if you wanted to speak to the dean or administration's department or professor or counselor, we had it all set up to be able to have these roles you can talk to anyone you like. Okay, I think it's pretty shady

to not only lie to your customers, to make them think that this school is real, but to also pose as a teacher and act like an expert in your field and give students a bad education. It's one thing just to sell them a fake degree, but it's a whole nother thing to like sell them a fake degree, but it's a whole other thing to give them a false sense of knowledge of anything. I just think that's

a pretty dirty trick. The marketing team was pretty good at drumming up new victims for this scam. They would spend a lot of money on Google ads, hyper-targeting certain degrees and regions, scraping resumes off job sites, targeting people on social media, and running SEO campaigns to get their school ranked higher in the search results. How much do you think this company was making from all this? Right. Our team had a goal of $2.4 million a month, and there were 23 teams in the company. You could see the leaderboard and how well each team is doing. All right.

So you told me step 1 and step 2. Are there more steps to this? Like, I just imagine you could just keep rinsing and repeating. Start over, take that victim, sell him another degree. There are more steps, yes. But here's where it gets weird. And you lose track of your steps. So, let's say I had someone pay extra to get their degree quickly and we send them the degree.

Well, we could go in a lot of different directions from here. One might be to call them up and say there's been a mistake in the degree. You could just make up whatever you wanted at this point. Like you might say, sorry to inform you but there's been an error. You didn't take all the courses you needed to earn this degree. I'm sorry but we have to revoke your degree. And then try to sell them on more courses. Or you might tell them that their certification has expired and they need a new one.

Once we told someone their degree wasn't valid until you get an authentication certificate which is signed by a senator and it costs an extra $7,500 to get that. But people were taking this to extreme levels. The company just didn't care how you got money from these people. Just get money from them. Any way you can. So, some of us would call the person and pose as the local government and say something like, Sir, I'm calling from the government about your degree.

Congratulations on your degree, but unfortunately, it's not valid in this country until you pay an importation fee of $10,000. And we'd get people to pay us all these extra fees. Dang, that's cold, dude. Yeah. Or another was that we'd call them posing as a recruiter for a big company. We'd interview them for a job, hire them,

but then say, oh no, you're missing this one qualification. You need to get an English-speaking endorsement, which I know where you can get one for $5,000. Wow, this is just getting nuttier and nuttier. And you know, it's the classic con game that once you get someone on the hook for a little bit of money, you can just keep upping it and upping it. And it works because that person has already gave you some money. We humans have this flaw in our operating system regarding sunk costs. It's hard for us to break off of something that we've already poured a lot of

money and time into. So at this point, these people have already spent thousands of dollars on their fake degree. And it's just from that alone that this whole thing becomes important to them, that they don't want to lose it. And since it's already cost them thousands, they're like, okay, I'll pay a couple thousand more. And this is called the sunk cost fallacy. And it's crazy how effective it is against us. Oh, and remember when we got them to take a picture of themselves in the graduation gown holding the degree? We'd sometimes use that photo against them and just try to scam them by acting like someone else and saying you don't know who i am but i know you bought a fake degree from the school pay me eight thousand dollars or i'll

show this photo to your boss and dude you guys are straight up extorting people yep it was bad it was really bad but it felt so weirdXACT claimed to be the largest IT provider and had these big buildings and a whole fleet of company vehicles. So everywhere you looked, it felt normal and okay. My parents were proud of me for working in the big office building, you know. And having a butler come bring us dinner at home from a five-star restaurant, it was very strange. So not only are people getting extorted by Xact, but these degrees were catching up with people. There was one guy who bought a fake degree, and then he got a job as a criminal forensic psychologist, and he used his degree to get the job. And then he worked on 700 cases,

giving his expert advice on them before they found out he had a fake degree. They arrested him and threw him in jail for that. And I think they had to reopen all those cases that he was an expert forensic psychologist on. And there was this Olympic diving coach who got in trouble for using his fake degree to get a job as a diving coach at Indiana University.

There was one other thing that we might do with the person we are scamming. Sometimes we'd call them up to try to scam them, but they were just like, no way. I know I've been scammed. I paid all this money for a fake degree. You can't scam me for anymore. I'm on to you. Right?

Well, in those cases, we would sometimes say, yeah, you know what? You're right. We are scammers. But hey, do you want in on it too? And what we do

is set up a deal with that person to funnel the money through them. Where payments would go through them and they could keep some of it. Oh my god, now they're converting the victims into money mules. Okay, so a money mule is someone who accepts like stolen money from someone else and then sends that to scammers. And this makes it harder for banks and law enforcement to detect where stolen money is going. And the money mule typically doesn't know that what they're doing is illegal. And the deal is that they can keep like a percent of the money coming through their bank account,

and they do very little to earn this. Just let the money come in and then write the check to send to someone else. And so Exact had this whole system of moving money around to avoid detection and shut down. It's easy for big banks to recognize which bank accounts that might be connected to Exact and just stop those transactions. But if they're constantly shifting the money and it's flowing all around, the big banks just can't detect this very easily to stop it. The money would get funneled through different accounts and would often end up in the account of a company in Cyprus or Latvia.

You know, places that are a little more protected for this type of thing. Dang. You know, honestly, I got to hand it to this exact company. It is really an impressive operation that they had set up. I mean, thousands of employees and a lot of them being highly skilled IT workers,

building websites and doing all kinds of pretty advanced marketing. But also they got this business model just dialed in. They figured out the perfect template to start a fake university, get victims to come onto the sites and then scam them out of a ton of money and then get that money funneled through different mules and offshore accounts. And then to do it all at scale, just hiring more and more and more and doing this every day, making their workers work 29 days a month. I mean, Exact was growing leaps and bounds, and they were setting up hundreds of sites.

Here, let me just list a whole bunch of these sites for you real quick. There was the Al Arab University, Alford High School, Alameda University. Okay, this one's got a Wikipedia entry. Let me see what's going on here. Oh, man. So apparently they were selling like some law enforcement training. And apparently a bunch of cops had gotten some fake degrees or training from this website and then got jobs based off their fake training and got in trouble for this. Gosh, it always wrecks me to see people in authority breaking the rules. It just shatters my trust in like the system every time. Okay.

So there's like so many of these sites. Barclay University, Bayview University, Bay City University, Baytown University, Chapel University, Columbiana University, Fort Jones University, McGraw University, James Harding University, Pine Hill University, Western Advanced Central University. There's just so many, just so, so many of these. It's like once they figured out the game, they just kept copying and pasting and expanding and maximizing profits. So who's masterminding this whole thing? Who figured all this out? Well, Exact was found by a guy named Shoaib Ahmed Sheikh. Yes, I met him. He would come through the office and meet with the top sales agents.

And I'll tell you, he did not seem like, you know, shady or scammy. He appeared genuine and was influential at getting you to do great work. He never talked about all the phony things going on. He only said positive things like how much of an impact we are making giving people an education and it's changing lives and he encouraged us to achieve excellence in our work. So I don't know if he was the main scammer here. Okay so this guy Shoaib not only started Exact but also started a TV network called Bol. B-O-L. Just looking at their YouTube channel, they show music

videos, game shows, talk shows, and news channels. They seem pretty popular. Their YouTube channel has 5 million subscribers and the website says they have 156 channels in 16 languages. But this is interesting, right? A guy who's running a fake degree scam

is also controlling the press. He's got a lot of money and it's pretty influential. One thing about Pakistan is if you have money, you have power. You can get away with doing things that others would be arrested for. Oh, and he was always saying about how he was donating to charities and setting up different things to help the people of Pakistan. So a lot of people liked him. The exact website says Shoaib has set up schools, food and shelter systems, and healthcare systems all through his charitable giving. And he himself graduated from one of Pakistan's most prestigious business universities, so he clearly has great business

skills. But he's not the only one running this company. But I'm having a hard time finding a clear corporate structure showing exactly who's there, and I just don't know how many executives were involved. And it's possible that one of the other executives made up this scheme and got this whole thing going. And maybe Schwabe just doesn't know that there's like a big scam going on. I can't, I just, I don't personally believe that theory that he wouldn't know that what's going on in his own company. And one reason is because of what happened in 2009. All right, so in 2009, a woman from Michigan got her online high school diploma from an exact school called Belford High School.

And I guess she felt like they lied to her. She must have paid for classes and enrolled in the school. But then when she got her diploma and realized it was fake, she sued exact. And that case got turned into a class action lawsuit. There were 30,000 people who were also listed in this lawsuit suing Xact. The lawyer representing the victim said he heard hundreds of people give stories about how they felt like they were tricked by this scheme.

So imagine being Xact in this moment, okay? 30,000 people are suing you and you need to represent yourself in court in the U.S. So do you go? Do you go to court? No, no, God, no. X-Acto does not want to show up in court because it would absolutely taint their record

no matter what the outcome would be, right? But a defendant did show up to court, some Pakistani guy, and his name was Salem Qureshi. And nobody had ever heard of him before. He doesn't seem to be involved with Xact at all. Like, he's not someone from their legal team or executive team. So what's he doing here in court? And what's he got to say?

Salem spoke up in court and he's like, okay, listen, it was me who made the Belford High School website. I just made the whole thing up inside my apartment. And yeah, I can understand why people feel tricked. I'm sorry. I'm not affiliated with Exact, but I was the one who made the thing. In fact, this guy Salam didn't even go to court. He just phoned it in.

He only did like a short video call from some dimly lit apartment. And he said he was in Karachi, Pakistan at the time. Prosecuting lawyers like, no Karachi, Pakistan at the time. Prosecuting lawyer's like, no, no, no, hold on. The mailbox for Belford High School is the same mailbox for Exact. And Salem is like, oh yeah, that must've been a mistake. I'm not connected to Exact at all. And yep, that's my mailbox. And the judge was like, the judge is like, okay, Salem, you said you did it, so you're guilty. And Salem took the fall. So in 2012, the court ordered him to pay $22.7 million to the plaintiffs.

But Salem just LOL'd right out and disappeared. He hasn't paid a cent of that since 2012. And investigators tried to find him, but nobody can. He's hiding out somewhere in Pakistan. I got to say, that is a brilliant legal move. If that was the work of Xact's legal team, right? To just grab some guy to like block your whole incoming lawsuit, and then just make the whole thing disappear. I mean, really, honestly, hats off for that. That is such a ridiculous move. And it worked so effectively. Why doesn't everyone do that? I mean, if I ever get sued, I'm just going to grab someone and be like, hey, can you say your jack and just like take the

blame? It's just so comical. That's this simple, stupid trick worked. Like, why didn't the court see through this and be like, no, no, no, no, hold on a second. Get exact in here. No, this guy Salem convinced the court it was him without even trying very hard. Oh, this is just, I can't get over this. Okay, the serious face. So at this point of the story,

a new protagonist shows up. His name is Declan Walsh. Now, I reached out to Declan like at least three times. I emailed him. I tweeted at him. I even went through some of his friends, but no response. The dude is mad busy and I don't blame him for not responding, but at least I tried, right? Anyway, it doesn't matter because he left a mark on this story and documented everything along the way. Declan Walsh is a reporter for the New York Times and he was doing a bunch of stories in Pakistan and saw this and was like, wait a minute, there's something not right about this company, Exact, and investigated. In fact, he spent two years investigating this story. He spoke with a bunch of people who worked at Exact, and he talked to people who bought fake degrees from there. He even spoke with Fazal, the same guy you heard earlier. I mean, it was really phenomenal reporting what he did.

And he published a really good article in the New York Times exposing all the shenanigans that Exact was getting up to. And he found that Exact had set up over 300 websites of fake schools and like 18 of them were accrediting bodies, fake accrediting bodies, you know, the places that confirm a school is legitimate. Dang, that's just like a lot of schools that he's made up. So much work went into building this company. Yeah, well, when Declan's New York Times article was published, it rippled through Pakistan. People were mad.

What's up with this? It looked really bad for a Pakistani company to be so scammy, you know? So the FIA, which is like Pakistan's FBI, was like, OK, OK, we'll check into it. We'll see if there's any fraud here. Meanwhile, exact lawyers are sending letters to the New, was like, okay, okay, we'll check into it. We'll see if there's any fraud here. Meanwhile, Xact's lawyers are sending letters to the New York Times like, hey, you're writing lies about us. We don't like it.

It's baseless and defamatory. We're going to pursue strict legal action against you. But the FIA was investigating Xact. And yeah, they found enough evidence to open a case. What's more is they really didn't like the kind of bullying behavior that they were trying to scam customers out of more money by threatening them and deceiving them. So the FIA took action. They raided the offices of EXACT. And they just started grabbing everything once they got in there. Computers, documents, people. But absolutely none of the executives were around during the raid, which is kind of suspicious.

Like, how did those executives know not to come in the office that day? But the people they did grab questioned them and just let them go. They found in the building next to Exact is where they were printing all the fake degrees. They had printers there and fancy paper, everything. And they just took it all. And at this point, the timeline becomes very dizzying to me. I tried my best to get it all sorted out,

but it's just, it's fuzzy. There's some gaps, I'm sure. But I'll do what I can to explain what I think happened. But I'll just let you know, the story from here on out is kind of difficult to know exactly what happened. So the FIA raids the exact offices, right? But they didn't arrest anyone. Well, with the information they gathered from the raid, they found enough evidence to put out arrest warrants for 23 people, including the CEO, Shoaib Shaikh. I can't tell if

any of them were actually caught or arrested or if they turned themselves in or did any jail time at all. And I can't even tell you who the 23 people are that had arrest warrants out for them. I'm assuming they were executives or people involved. Actually, I did see an article that said Schwabe's wife was one of the people with arrest warrants, but hers was dismissed because they didn't have enough evidence on her. But I did read that all 23 people

who did get arrest warrants were just like quickly released on bail. So I don't know if they did any jail time or just maybe a day or two before leaving. And during that FIA investigation, they found that guy Salem, the guy who took the fall for the class action lawsuit a few years back. He admitted that exact had paid him to take the fall. In fact, when he was appearing on video in court, he only acted like he was moving his lips. And then some exact official was like off camera saying the things for him.

And then they paid him $250 to go into hiding and disappear. Well, the FIA was like, okay, we did our job. We gathered the evidence. We raided the office. We arrested some folks. Court, it's now on you to finish up and sentence them. There's documents that suggest that Exact made hundreds of millions of dollars from their scams. They took money from over 200,000 people around the world.

And this means it was one of the biggest scams of all time. Stephen Colbert even joked about this. Here, listen to this. That's right. The Pakistani company AXACT was selling fake college diplomas, which explains where Bin Laden got his degree in women's studies. Luckily, Pakistani authorities arrested the AXACT CEO, charging him with illegal money transfers,

forgery, and fraud. No doubt he'll represent himself in court. I hear he's got like 20 law degrees. Well, I for one, I'm glad they caught the guy. Charging people hundreds of thousands of dollars for fake degrees is appalling. I believe that fake college should be free. Fake college should be free. I agree, Stephen.

Fake college should always be free. Now, before the sentence could be carried out, this guy, Judge Mem sentence could be carried out, this guy, Judge Memon, suddenly and out of the blue, acquitted all of the people who were accused. Like somehow the number was now at 27 people being accused. So Schwabe and 26 others just all had their charges dropped

just by the judge and they were free to go. Like, you're done. There was no explanation or anything. It was just unreal. But the Pakistani court's like, whoa, whoa, whoa, hold on. Wait, what just happened? And they looked into this guy, Judge Memon, further, and they found that he accepted a bribe from Shoaib

for about $18,000 to just acquit everyone. And once the court found out about this bribe, they fired the judge and unacquitted all 27 people involved and reopened all the cases. And one guy was pretty unlucky in all this, Umair Hameed. He was the vice president of EXACT. And guess what? He was living in the US. So the authorities were able to nab him and he pled guilty. He had no escape from the U.S. justice system. There was no one to like put in front of him and say, oh, it's this other guy. So he went to prison for like a year and a half.

In 2018, the Pakistani Sessions Court found 23 exact employees and executives guilty of impersonation, cheating and dishonesty, forgery and aiding and abetting. And the judge is like, okay, I'm going to give you all your sentence now. But there's this moment in court where the judge is like, where is everyone? None of the 23 defendants showed up to their sentencing hearing. None. So the judge is like, well, that's rude. I'm removing all your bail, and I'm calling for your rearrest with no bail option this time. And then the court issued prison sentences for all 23 people. I think the highest that someone got was seven years in prison, but collectively it all added up to 20 years prison time.

On top of that, they were all fined like a significant amount of rupees too. And also, somewhere in here, Shoaib lost control over Bowl, that TV studio he started. It looks like the Pakistan Electronic Media Regulatory Authority revoked the broadcasting license that Bowl had, I guess until Shoaib stepped down or something. But then in 2023, a different company came in and bought Bull. So it's definitely out of his hands now. Okay. So that's that, right? 23 people sentenced to prison for this whole exact degree mail scam. You'd think exact would just like shutter its business and the CEO would just face his punishment. Well, no. Not from what I could tell. even though he was sentenced in 2018, it wasn't until 2023 that he was arrested.

And don't ask me how he managed to stay free all that time. Like I said, the details here are just baffling to say the least, and I have a lot of questions, but apparently business went on as normal in exact. And there's a video of the FIA arresting the CEO of Schwabe at the Islamabad airport. I'll try to describe the scene to you. Schwab's wearing like a black polo shirt.

And he's looking very calm and a little confused, but not struggling or yelling or anything. And they put him in a car and they drive him away. Kind of uneventful. And even after all that, there's still a lot of people on his side. Like the Bol News station was saying things like, he's being abducted. We don't know where they took him. And they're only arresting him because he supports Imran Khan. And this whole arrest is a violation of freedom of speech. Well, you can guess his arrest didn't last long. I believe he only spent two days in jail and then was released. And all I can find

is that he submitted documents to the FIA, who then let him go based off those documents. Are you still working there? No, no, no. My wife was not happy with me being part of this and wanted me to quit. So I did. Yeah, I don't work there anymore. I've gone to work for a different tech company. So yeah, that's where we stand today.

Exact, it looks to me that they're still in operation. And the CEO did not serve his prison sentence and I guess is doing just fine out in the world. I guess, what could he be doing? Appealing the case? That's possible. Maybe he just has some deals with people

to like, don't like arrest him anymore or just like drop the case. I don't know. It's just too hard for me to cut through the noise to find answers of what's going on over there. My guess is that with his wealth and power, he just has a lot of pull in that country. Politicians and government officials have been very vocal that they're on his side. And who knows what they're doing to help him get out of all this mess. I have a feeling that this is not the last time we'll hear about Exact. And I'm really curious what they get up to next. A big thank you to Fazal, which is not his real name, for sharing this story with us. And if it wasn't for him bringing me this story

and telling me all about this, I wouldn't even know about this. Oh, and thanks to Srikanth Joshi for doing the voice acting on this one. If you're looking for a new shirt, I got your back. Go to shop.darknetdiaries.com and check it out. I think there are over 50 different shirt designs there, and I guarantee you're going to find one you love.

So please check out the shop. This episode was created by me, the TikTok Tiger, Jack Recyder. Sound design by the wily whiskered Andrew Merriweather. This episode was assembled by the strewn perfumed raccoon Tristan Ledger. Mixing done by Proximity Sounder. Our theme music is by the mysterious Breakmaster Cylinder. What happens if you severely overclock a PC? It goes up in frames.

This is Darknet Diaries.