Bogdan Boceanu, Phishing, Connecticut 2005

Two Romanian nationals, Bogdan Boceanu and Andrei Bolovan, have been sentenced to federal prison for participating in a large-scale phishing scheme targeting banks and financial institutions in Connecticut.

On June 2005, a resident of Madison, Connecticut, contacted the FBI in New Haven about a suspicious email that she had received from People’s Bank. The email stated that the recipient’s online banking access profile had been locked and instructed the recipient to click on a link to a web page where the recipient could enter information to ‘unlock’ his or her profile.

The web page appeared to originate from People’s Bank, but was actually hosted on a compromised computer in Minnesota. Any personal identifying and financial information provided by the individual would be sent by email to individuals in Romania, or to a ‘collector’ account, which was an email account used to receive and collect the information obtained through phishing.

Boceanu and Bolovan were part of a loose-knit conspiracy of individuals from Craiova, Romania, and neighboring areas that shared files, tools, and stolen information obtained through phishing. The co-conspirators used and shared a number of collector accounts, which contained thousands of email messages that contained credit or debit card numbers, expiration dates, CVV codes, PIN numbers, and other personal identification information such as names, addresses, telephone numbers, dates of birth, and Social Security numbers.

The investigation revealed that Boceanu was a prolific trafficker of stolen information. He exchanged with a co-conspirator emails that contained numerous credit card numbers that had been obtained through the scheme, and received from another co-conspirator credit card numbers, account user names and passwords, as well as other identifying information of numerous victims. More than 12,000 credit or debit card numbers were found in Boceanu’s email accounts between 2004 and 2009. Boceanu also purchased a machine used to encode stolen account information on magnetic strips on credit and debit cards.

Bolovan was involved in the phishing conspiracy from 2004 through 2007, buying and selling stolen information, harvesting email addresses, and spamming. Analysis of Bolovan’s email accounts revealed more than 1,200 stolen credit or debit card numbers.

On [Date: June 2005], Boceanu, 30, was sentenced to 80 months of imprisonment, and Bolovan, 29, was sentenced to 27 months of imprisonment. The defendants were found guilty of participating in an extensive Internet phishing scheme.

Related Federal Cases