LOS ANGELES - A group of U.S. and foreign nationals were charged last week with a variety of Internet schemes–including the newly emerging “smishing,” or phishing by test messaging–that tapped into credit union and bank accounts to steal millions of dollars.
Thirty-eight people in the U.S. and Romania were charged in federal indictments unsealed in Los Angeles and Hartford, Conn., with operating an international identity theft ring that used the information to manufacture phony credit and debit cards.
The ring tapped into accounts at: Langley FCU, North Island CU, Arizona FCU, Allegheny FCU, Teachers CU, NASA FCU, BECU, Telco CU, Mountain America CU, Bowdoinham FCU, Credit Union One, Jeffco Schools CU, Premier CU, Artesian City FCU, Washington State Employees CU, Franklin Mint FCU, Desert Schools FCU, Iowa Central Corporate CU, Southwest Corporate FCU as well as PSCU Financial Services, among others.
Customers at Bank of America, Citibank, Capital One Bank, Flagstar Bank, Valley National Bank, First Merit Bank, American National Bank, Downey Savings and Loan, Regions Bank and Bank of the West were also hit.
“We have been the target of several phishing attacks over the last few months. It’s good to know that they’ve been able to pin down who the responsible parties are,” said Brett Noll, vice president at Langley FCU, who noted that credit union officials have been working with the FBI on the investigation.
Steve Ruwe, chief risk officer for PSCU Financial, which was cited as one entity hit by the ring, played down the affects of the arrests. “These guys work in cells and there’s probably 10 guys to pick up where these guys left off,” said Ruwe.
Phishing And Smishing
Ring members stole the account information by phishing and smishing–a new scheme used to obtain confidential account information via text messaging. Smishing is like phishing, except instead of using Internet e-mails to entice customers to giveout their personal account information the thieves use cellphone text messages. The text messages look like official correspondences from that person’s credit union or bank that direct the person to a website that is similar or identical to their CU’s or bank’s. The person is asked at the so-called spoofed website to provide account information and PINs.
The information was obtained by the Romanians, then sent to cashiers in the U.S. with Internet handles like bonecrusher, cryptmaster, vortex and loco, through live chat rooms, according to the indictment, obtained by Credit Union Journal. The cashiers then used credit card encoders to make bogus credit and debit cards which were used to withdraw cash from ATMs with the highest withdrawal limits, and to buy millions of dollars in merchandise.
Langley FCU’s Noll said his credit union was one of the first financial institution in the country known to be hit by a smishing attack last fall when text message sent to members and non-members in the Norfolk, Va., area were sent to a spoof of the Langley website and asked to input personal account information. The credit union was able to limit the fraud and succeeded in shutting down several sites. “Losses have been extremely minimal,” he said.
The Romania-based members of the ring obtained the personal information on thousands of accounts by phishing, with more than 1.3 million spam e-mails sent in one phishing attack, according to the indictment.
Individuals Named In Indictment
The individuals named in the indictment operated from locations in the United States and abroad including Canada, Pakistan, Portugal and Romania, and include both U.S. citizens and foreign nationals.
Sonny Duc Vo, Alex Chung Luong and Leonard Gonzales are U.S. citizens. Nga Ngo, Thai Hoang Nguyen, Loi Tan Dang and Dung Phan are permanent legal residents of Vietnam. Hiep Thanh Tran is a U.S. permanent resident from Vietnam. Caroline Tath is a permanent legal resident of Cambodia. Hassan Parvez is a citizen of Pakistan. Rolando Soriano is a Mexican citizen and is currently charged in Los Angeles with illegal entry by an alien following deportation. Ovidiu-Ionut Nicola-Roman; Petru Bogdan Belbita; Stefan Sorin Ilinca; Sorin Alin Panait; Costel Bulugea; Nicolae Dragos Draghici; Florin Georgel Spiru; Marian Daniel Ciulean; Irinel Nicusor Stancu; Didi Gabriel Constantin; Mihai Draghici; Marius Sorin Tomescu; Lucian Zamfirache; Laurentiu Cristian Busca; Dan Ionescu; Marius Lnu; Alex Gabriel Paralescu; and Andreea Nicoleta Stancuta are Romanian citizens. Four other suspects known only by their aliases, “Cryptmaster”; “PaulXSS”; “euro-pin-atm” and “SeleQtor” are believed to be Romanian citizens.
Romanian authorities are participating in the investigation and were executing search warrants last week in Romania.
