Six plead guilty to $1.5 million Virginia furniture store hack
RICHMOND, Va. (WRIC) – Six men have pleaded guilty in Richmond District Court to a $1.5 million fraud involving identity theft, a chain of fictitious furniture stores and a server hack by Phishing, located in Virginia, containing sensitive financial data. .
According to a statement of facts – confirmed by the six defendants as a condition of their plea agreements – over a five-year period from April 2017 to January this year, the defendants posed as customers at various furniture stores, compromised information from other furniture stores, and ultimately defrauded stores and financial institutions of nearly $1.5 million.
The six men – Mahmoud Aljibawi, Wael Jibawi, Yanal Khrisat, Mohammad Jibawi, Jamel Eljebawe and Alaelddin Aljibawi – faced 18 counts ranging from identity theft to computer fraud, and were ordered to pay $1,487 $957.86 in restitution.
Play both sides
Key to the men’s fraud was the existence of “lease-to-own” financing, a model often used by furniture and appliance stores, where an intermediary finance company pays for the goods to advance, then collects payments, with interest, from the customer over the following months and years.
Below is an illustrated example using one of the defrauded companies, West Creek Financial.
This is how the process normally works, but the six defendants used an elaborate sleight of hand to take the money and get away.
They operated 25 furniture stores – some of which were legit stores and some that never existed – and used them to ask finance companies, like Richmond-based West Creek, for a partnership to offer credit consumption to their customers.
Once they were allowed to offer “rent-to-own” deals to paying customers, they began submitting credit card and rental applications to companies using a mixture of stolen identities and information. manufactured.
After the applications were improved, the company’s “customers” began to buy furniture for thousands of dollars, which the stores then assured the companies had successfully delivered.
Companies dutifully prepaid stores for goods, only to lose it all when “customers” failed to pay what they owed.
Expansion of the operation
They didn’t stop there. Once they had an account with West Creek, they called the company’s support hotline posing as employees of a store called “Bernie and Phyl’s”, an existing customer of West Creek’s based in Massachusetts.
They were able to convince West Creek to let them set up an online payment account for the store, then quickly redirect the funds intended for the stores to their own bank accounts.
Then, using a tool called a VPN to hide their identities, they accessed servers at West Creek in Northern Virginia, submitting several fake rental agreements and siphoning off that money as well.
While all of this fraud happened in Virginia – committed against a Virginia company and on Virginia-based servers – the six defendants were all 700 miles away in Chicago, Illinois.
Over the next five years, and using their 25 businesses, the men would defraud Okinus, Greenwave Finance, Synchrony Bank, and Wells Fargo, netting approximately $1.5 million.
Synchrony Bank, which offers credit cards for retail stores, lost more than $500,000 in six months in 2018.
One hundred and thirty-three Synchrony cards were used in just one of the men’s ventures. The bank only realized the purchases were fraudulent when the owners of the cards – some from as far away as California and Florida – called to complain.
The defendants pleaded guilty to the following charges and were ordered to pay compensation in the following amounts:
- Mahmoud Aljibawi – 2 counts of wire fraud, 1 count of computer fraud, 1 count using a fictitious name – $514,744.80
- Wael Jibawi – 2 counts of wire fraud, 1 count of computer fraud, 1 count using a fictitious name – $189,935
- Yanal Khrisat – 2 counts of wire fraud, 1 count of computer fraud, 1 count using a fictitious name – $56,500.33
- Mohammad Jibawi – 2 counts of wire fraud, 1 count of computer fraud, 1 count using a fictitious name – $297,713.73
- Jamel Eljebawe – 2 counts of wire fraud, 1 count using fictitious name – $122,260
- Alaelddin Aljibawi – 2 counts of wire fraud, 1 count using a fictitious name – $306,804