“Cyber crime” generally calls to mind a cunning geek in a Guy Fawkes mask, typing out the recipe for a dangerous virus or phishing up Bank of America passwords from his parents’ basement. The perpetrators of the INSIDERS case had no such savvy (and indeed, neglected to make their Facebook photos private).
“This is a cyber crime because of the way the crimes were committed,” Mr. Szuchman said in an email. “BlackBerrys and smartphones were key components to committing the crimes from communicating to trafficking the personal identifying information.”
Even so, the investigators were arguably the ones doing most of the cybering. Investigators eavesdropped on the suspects’ phone calls, read their text messages and of course peeked at their social media profiles (with a bag of popcorn, we imagine, based on portraits of Pepsi pouring bottles of Champagne and liquor onto the floor at a night club). The indictment even cites emails the conspirators sent each other with credit card account numbers. “It’s a strong case,” Mr. Szuchman said.
Pepsi was one of seven accused “buyers,” who paid for the stolen personal data, then used it or resold it. These buyers, with nicknames like “Gucci,” “Chin,” “Tugs” and “Tigga,” tied together what would otherwise have been a set of similar but disconnected crimes.
The other commonality was the source of the credit information: lowly employees at institutions who happened to have access to the finances of strangers.
One of the reputed four key “insiders” was Tracey Nelson, a 24-year-old who pushed papers at the UJA. Ms. Nelson snapped pictures of donor information with her BlackBerry or simply walked out with papers in her purse; she sobbed openly during her arraignment.
Glenn Abolafia is the court-appointed attorney for Ms. Nelson, who pleaded not guilty. “We’re just at the beginning of the case and there is a lot of investigation to do to see if any of the accusations make any sense,” he said.
Ms. Nelson’s live-in boyfriend, Robbie Millar, 26, worked at Audi and was “a big player,” according to the DA. The other two, smaller fries, were Nicola Bennett, a pretty 30-year-old employee of residential property manager AKAM Associates, and Karen Chance, a 32-year-old teller at Chase Bank at 36th Street and Seventh Avenue.
The DA has divided the conspiracy by roles: insiders, identity buyers, accomplice recruiters, check-makers and collusive account holders. The thieves had to get access to a bank account or credit card information and then cash out as fast as possible before the account was flagged for suspicious activity. Therefore, some conspirators allegedly printed fake checks at home and forged signatures. Other defendants cashed counterfeit checks and accepted fraudulent transfers through their own legitimate bank accounts from sources that, to any observer, would seem incredibly unlikely. In a typical transaction from the indictment, an unnamed conspirator used a debit card belonging to a defendant to deposit a fake check for $9,536 from hedge fund Paulson & Co. on June 18, 2010. The American Institute of Certified Public Accountants paid out $2,769 to defendant Cassilda Mitchell via a counterfeit check; defendant Nicole Leach Vitalis received a phony $9,000 bank transfer from viral marketing company Oddcast. The crew also bought electronics and other big-ticket items, which they got cash for from their 33-year-old fence, Younis Abidar, who sold them on the black market.
Others like the appropriately named “Treasure,” one 25-year-old Umar Credle, cashed USPS money orders, the practice that eventually got the ring busted.
Insiders stealing identities got hundreds of dollars per account, although rates varied. Chase accounts could fetch a higher price because the ring had at least three insiders working behind the counter who ensured the fraud didn’t set off internal alarms. Collusive bank account holders got perhaps a $100 or $200 cut per transaction.
In the end, Mr. Greenberg, Mr. Rennert, Ms. Oreck and the estimated 200 or so victims were reimbursed by the banks for their losses. “The Manhattan DA’s office informed us that this type of breach can happen in any organization, no matter how stringent its controls,” UJA said in a statement issued after the indictment; the organization declined to elaborate beyond its press release to The Observer. Calls to Open Road Audi were not returned.
The 55 defendants are being charged with various degrees of conspiracy, possession of stolen property, grand larceny and identity theft. As the DA tells it, JP Morgan Chase, TD Bank, Citibank, Discover and American Express took the hit for the $2 million or so that paid for flights, movie tickets and electronics and kept the defendants in Louis Vuitton and Yves Saint Laurent. Prosecutors say they have stacks of evidence against the accused, whose first pretrial hearings are scheduled for February. If convicted, at least they got to do it big for a while.