LOS ANGELES – Thirty-eight people in the U.S. and Romania were charged in federal indictments unsealed in Los Angeles and Hartford, Conn., yesterday with operating an international identity theft ring that tapped into accounts from thousands of credit union and bank customers that they used to manufacture phony credit and debit cards.
The ring tapped into accounts at: Langley FCU, North Island CU, Arizona FCU, Allegheny FCU, Teachers CU, NASA FCU, BECU, Telco CU, Mountain America CU, Schools Financial CU, Waterbury Teachers FCU, Bowdoinham FCU, Credit Union One, Jeffco Schools CU, Premier CU, Artesian City FCU, Washington State Employees CU, Franklin Mint FCU, Desert Schools FCU, Iowa Central Corporate CU, Southwest Corporate FCU as well as Payment Systems for CUs and PSCU Financial Services.
Customers at Bank of America, Citibank, Capital One Bank, Flagstar Bank, Valley National Bank, First Merit Bank, American National Bank, Downey Savings and Loan, Regions Bank and Bank of the West were also hit.
"We have been the target of several phishing attacks over the last few months. It’s good to know that they’ve been able to pin down who the responsible parties are," said Brett Noll, vice president at Langley FCU, who noted that credit union officials have been working with the FBI on the investigation.
Ring members stole the account information by phishing and smishing–a new scheme used to obtain confidential account information via text messaging.
Smishing is like phishing, except instead of using Internet emails to entice customers to giveout their personal account information the thieves use cellphone text messages. The text messages look like official correspondences from that person’s credit union or bank that direct the person to a website that is similar or identical to their credit union’s or bank’s. The person is asked at the so-called spoofed website to provide account information and PINs.
The information was obtained by the Romanians, then sent to cashiers in the U.S. with Internet handles like bonecrusher, cryptmaster, the.vortex and loco, through live chat rooms, according to the indictment, obtained yesterday by The Credit Union Journal. The cashiers then used credit card encoders to make bogus credit and debit cards which were used to withdraw cash from ATMs with the highest withdrawal limits, and to buy millions of dollars in merchandise.
Some of those facing charges used blank hotel door access cards, with their magnetic stripes reprogrammed, to withdraw cash from ATMs.
Langley FCU’s Noll said his credit union was one of the first financial institution in the country known to be hit by a smishing attack last fall when text message sent to members and non-members in the Norfolk, Va., area were sent to a spoof of the Langley website and asked to input personal account information. The credit union was able to limit the fraud and succeeded in shutting down several sites. "Losses have been extremely minimal," he told The Credit Union Journal yesterday.
The Romania-based members of the ring obtained the personal information on thousands of accounts by phishing, with more than 1.3 million spam emails sent in one phishing attack, according to the indictment.
The individuals named in the indictment operated from locations in the United States and abroad including Canada, Pakistan, Portugal and Romania, and include both U.S. citizens and foreign nationals.
Sonny Duc Vo, Alex Chung Luong and Leonard Gonzales are U.S. citizens. Nga Ngo, Thai Hoang Nguyen, Loi Tan Dang and Dung Phan are permanent legal residents of Vietnam. Hiep Thanh Tran is a U.S. permanent resident from Vietnam. Caroline Tath is a permanent legal resident of Cambodia. Hassan Parvez is a citizen of Pakistan. Rolando Soriano is a Mexican citizen and is currently charged in Los Angeles with illegal entry by an alien following deportation. Ovidiu-Ionut Nicola-Roman; Petru Bogdan Belbita; Stefan Sorin Ilinca; Sorin Alin Panait; Costel Bulugea; Nicolae Dragos Draghici; Florin Georgel Spiru; Marian Daniel Ciulean; Irinel Nicusor Stancu; Didi Gabriel Constantin; Mihai Draghici; Marius Sorin Tomescu; Lucian Zamfirache; Laurentiu Cristian Busca; Dan Ionescu; Marius Lnu; Alex Gabriel Paralescu; and Andreea Nicoleta Stancuta are Romanian citizens.
Four other suspects known only by their aliases, "Cryptmaster"; "PaulXSS"; "euro_pin_atm" and "SeleQtor" are believed to be Romanian citizens.
Romanian authorities are participating in the investigation and were executing search warrants yesterday in Romania.
