How Hushpuppi's fake school loan worked: the Instagram star who laundered scam money

A man with more than 2 million Instagram followers, who posted private jets, luxury cars and designer watches, was quietly moving money for online fraud crews. One of his victims was a businessman in Qatar who only wanted a loan to build a school.^[1][2] This case file covers how the fake loan worked, how the watch in the photos was paid for, what the sentence was, and the one control that would have saved the victims their money.

What happened

How it worked

The scheme did not need to break into anything. It relied on trust, paperwork and urgency. The victim dealt with people he believed were bankers and investment advisers, received documents that looked official, and was told each new payment was the last step before the money would be released.^[1]

Each request came through the same channel the fraudsters controlled, so every time the businessman checked, he was checking with them. Abbas's role was to provide and manage accounts that received the money and moved it on, turning fraud proceeds into things like luxury goods.^[1]

The same approach showed up in other schemes he admitted to. He directed nearly $923,000 taken from a New York law firm into accounts the group controlled, and he conspired to launder millions of pounds stolen from a British company and a U.K. soccer club.^[1][2] He also helped move money from a theft of about $14.7 million from a bank in Malta, which U.S. authorities linked to North Korean hackers.^[1][2]

How it was caught

Abbas was arrested in Dubai in June 2020 and prosecuted in federal court in Los Angeles.^[1] In April 2021 he pleaded guilty to conspiracy to engage in money laundering.^[1]

Court coverage said that over about 18 months he conspired to launder more than $300 million, though not every scheme succeeded.^[2] A Canadian money launderer who worked with him was sentenced separately to 140 months in prison and ordered to pay more than $30 million in restitution.^[1]

What it cost

On November 7, 2022, a federal judge in Los Angeles sentenced Abbas to 135 months, just over 11 years, in federal prison.^[1][2] He was ordered to pay $1,732,841 in restitution: $922,857 to the law firm and $809,983 to the businessman in Qatar.^[1]

The U.S. attorney in Los Angeles called money laundering and business email compromise a massive international crime problem.^[1] For the victims, the bigger lesson is how ordinary the requests looked. None of them required a hacker to beat a firewall. They required someone to send money without checking who was really on the other end.

The missing control

The missing control: independently verifying a payee's identity before sending funds. That means confirming who you are paying, and that the request is real, through a channel the requester did not give you.

In the Qatar case, every new fee and tax came from the same people who were running the scam. A call to a bank's publicly listed number, a search of the lender in official registries, or a check with a lawyer the businessman chose himself would have found no lender and no loan. The same holds for the law firm: a call to a known number before sending the money would have exposed the fake instructions.

What to do in your business

• Verify by a second channel. Before paying a new payee or changing bank details, call a number you already have on file or find independently, never one in the email or document asking for money.
• Be suspicious of up-front fees. A lender or investor who needs you to pay first to release funds is a classic warning sign. Stop and verify before the first payment, not the fourth.
• Use two-person approval for large payments. Require a second person to sign off on wires over a set amount, especially to new or overseas accounts.
• Confirm the name matches the account. Ask your bank whether it offers payee name checks, and question any payment where the account holder does not match the company you think you are paying.
• Report fast. If you sent money to a fraudster, call your bank at once to try to recall the transfer, then report it to the FBI's Internet Crime Complaint Center at ic3.gov.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.