Three Romanian citizens sentenced to federal prison for their roles in a multi-million dollar comput

[nitpicker]

https://www.justice.gov/usao-ndga/pr/three-romanian-citizens-sentenced-federal-prison-their-roles-multi-million-dollar

Department of Justice
U.S. Attorney’s Office
Northern District of Georgia

FOR IMMEDIATE RELEASE
Tuesday, July 23, 2019

Three Romanian citizens sentenced to federal prison for their roles in a multi-million dollar computer hacking and fraud scheme

ATLANTA - Teodor Laurentiu Costea, Robert Codrut Dumitrescu, and Cosmin Draghici have been sentenced to federal prison on wire fraud conspiracy, computer fraud and abuse, and aggravated identity theft charges. Their scheme originated from Romania and resulted in the illegal intrusion into computer servers in the United States. They also deployed phishing messages to thousands of victims and subsequently stole victims’ social security numbers and bank account information.
(snip)

According to U.S. Attorney Pak, the charges, and other information presented in court: From approximately October 2011 through February 2014, Robert Codrut Dumitrescu, Teodor Laurentiu Costea and Cosmin Draghici conducted a “vishing” and “smishing” scheme from Romania. “Vishing” is a type of phishing scheme that communicates a phishing message, or a message that purports to be from a legitimate source, in this case the victims’ banks, through a voice recording. “Smishing” is similar to “vishing,” but communicates a phishing message through text messages.

As part of the scheme, the defendants compromised computer servers located in the Northern District of Georgia, and elsewhere, and installed both interactive voice response and bulk emailing software. That software initiated thousands of telephone calls and text messages to victims in the Northern District of Georgia, and across the United States, tricking them into disclosing Personally Identifiable Information (PII) such as financial account numbers, PINs, and Social Security Numbers.

When a victim received a telephone call, they would be greeted by a recorded message falsely claiming to be a bank. The interactive voice response software would then prompt the victim to enter their PII.

When a victim received a text message, the message purported to be from a bank and directed the recipient to call a telephone number hosted by a compromised Voice Over Internet Protocol server. When the victim called the telephone number, they were prompted by the interactive voice response software to enter their PII. The stolen PII was stored on the compromised computer servers and accessed by Dumitrescu and Costea, who then sold or used the fraudulently obtained information with the assistance of Draghici.

At the time of their arrests in Romania, Dumitrescu possessed 3,278 financial account numbers, Costea possessed 36,050 financial account numbers, and Draghici possessed 3,465 financial account numbers – all fraudulently obtained through this scheme. Based upon these numbers alone, the loss amount exceeded $21,000,000.
(snip)