Phishing, Bank Fraud and Conspiracy

After a jury found him guilty of guilty of conspiracy to commit bank fraud in violation of 18 U.S. Code § 1349 and conspiracy to commit fraud in connection with access devices in violation of 18 U.S.Code § 1029(b)(2), Bogdan Boceanu filed a motion under Rule 29 of the Federal Rules of Criminal Procedure to set aside the jury’s verdict on the bank fraud conspiracy charge and enter a judgment of acquittal.  U.S. v. Boceanu, 2013 WL 441072 (U.S. District Court for the District of Connecticut 2013). 

According to this press release, the charges against Boceanu arose from “a sophisticated Internet phishing scheme”.  This is how the press release describes the scheme in question:

[I]n 2005, a resident of Madison, Conn., contacted the FBI in New Haven about a suspicious email she had received that purported to be from Connecticut-based People’s Bank.  The email stated that the recipient’s online banking access profile had been locked and instructed the recipient to click on a link to a web page where the recipient could enter information to `unlock’ his or her profile. 

The web page appeared to originate from People’s Bank, but, as the investigation revealed, was actually hosted on a compromised computer in Minnesota.  Any personal identifying and financial information provided by the individual would be sent by email to individuals in Romania, or to a `collector’ account, which was an email account used to receive and collect the information obtained through phishing.

The co-conspirators were part of a loose-knit conspiracy of individuals from Craiova, Romania, and neighboring areas that shared files, tools, and stolen information obtained through phishing. 

The co-conspirators used and shared a number of collector accounts, which contained thousands of email messages that contained credit or debit card numbers, expiration dates, CVV codes, PIN numbers, and other personal identification information such as names, addresses, telephone numbers, dates of birth, and Social Security numbers. 

The co-conspirators then used the personal and financial information to access bank accounts and lines of credit and to withdraw funds without authorization, often from ATMs in Romania.

More specifically, the opinion cited above explains that during Boceanu’s three-day trial in December of 2012, the evidence presented to establish the bank fraud conspiracy consisted of:

(1) the testimony of Suzanne Novak, a former People's Bank customer, who received a phishing email targeting customers of People's Bank that had been sent around June 13, 2005; (2) the testimony of David Cracauer -- on whose compromised computer the fake People's Bank website was hosted -- that the information provided by customers duped into responding to the email was sent to the email address Vercartil@yahoo.com; (3) the testimony of cooperating witness Gabriel Sain that he engaged in the phishing scheme with others, including Boceanu; that Boceanu used the email address damnedasp@yahoo.com; and that Boceanu exchanged emails that contained stolen information, including names, addresses, Social Security numbers, credit card numbers, and bank identification numbers as well as a program for harvesting email addresses; (4) emails between damnedasp@yahoo.com and other members of the conspiracy, including an email sent to vercartil @yahoo.com in June 2005, asking for a list of credit numbers that were `good,’ i.e., working, and an email in response containing a subset of the numbers contained in the original email; and (5) testimony from FBI Special Agent Martin McBride that co-defendant Ovidiu–Ionut Nicola Roman used the email address vercartil@yahoo.com.

U.S. v. Boceanu, supra. 

The district court judge who has this case began her analysis of Boceanu’s Rule 29 motion by explaining that

Rule 29(a) provides that district courts `must enter a judgment of acquittal of any offense for which the evidence is insufficient to sustain a conviction.’ . . . Rules 29(b) and (c) permit a court to reserve the decision on the motion until after the jury returns a verdict. 

`A defendant challenging the sufficiency of the evidence that was the basis of his conviction at trial bears a “heavy burden.”’ U.S. v. Hawkins, 547 F.3d 66 (U.S. Court of Appeals for the Second Circuit 2008) (quoting U.S. v. Parkes, 497 F.3d 220 (U.S. Court of Appeals for the Second Circuit 2007)).

In deciding whether to grant a motion pursuant to Rule 29, the court should view the evidence in the light most favorable to the government, drawing all inferences in the government's favor and deferring to the jury's assessments of the witnesses' credibility.’ U.S. v. Hawkins, supra. A jury verdict shall be sustained so long as any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’ U.S. v. Hawkins, supra. . . .

U.S. v. Boceanu, supra. 

In his Rule 29 motion, Boceanu argued that

the evidence adduced at trial is insufficient to sustain his conviction for conspiracy to commit bank fraud because the only evidence connecting Boceanu to the conspiracy to commit bank fraud -- as opposed to the conspiracy to commit credit card fraud -- were the emails he exchanged with co-defendant Nicola-Roman around the same time that Nicola-Roman sent the People's Bank phishing email.

U.S. v. Boceanu, supra. 

The district court judge noted that to prove a conspiracy to commit bank fraud,

the Government must establish the following two elements: (1) that two or more persons entered into the alleged agreement to commit bank fraud, and (2) that the defendant knowingly and willfully joined in the agreement. 

The agreement to commit bank fraud must have been an agreement to engage in a scheme or artifice to defraud, or obtain money or property from, a federally-insured financial institution by means of materially false or fraudulent pretenses, representations, or promises. See 18 U.S.C. § 1344.

U.S. v. Boceanu, supra. 

Boceanu did not “challenge the sufficiency of the evidence related to the first element of the crime of conspiracy.” U.S. v. Boceanu, supra. As the judge noted, “an agreement existed to engage in bank fraud as evidenced by the phishing email directing recipients to a fake website for People's Bank, which is a federal-insured bank.” U.S. v. Boceanu, supra. 

Instead, Boceanu predicated his Rule 29 motion on the argument that the evidence was not sufficient to establish the second element of a conspiracy to commit bank fraud:

Boceanu argues that the only evidence introduced by the government connecting him to the bank fraud conspiracy were the emails containing credit card numbers that he exchanged with Nicola-Roman in June 2005. Those emails were sent within the same month that Nicola-Roman sent the People's Bank email.

Boceanu argues that there is no evidence that those emails -- and the credit card numbers contained therein -- were related to the People's Bank scheme. 

Because the evidence related to the People's Bank scheme was the only evidence of a scheme to defraud a federally-insured bank, without connecting Boceanu to the People's Bank phishing scheme, Boceanu argues that he cannot be found guilty of conspiracy to commit bank fraud.

U.S. v. Boceanu, supra.

The district court judge did not agree.  She explained that the prosecution

did not ask the jury to make the inference that the emails exchanged between Boceanu and Nicola-Roman contained credit card information obtained from the People's Bank scheme.

Rather, the government asked the jury to infer that Boceanu was involved with the People's Bank scheme because he worked `closely with Nicola–Roman and others as part of the conspiracy at a time when one of the targets of the conspiracy was People's Bank.’ Government’s Memorandum in Opposition to Motion for Judgment of Acquittal at 9.

Given the extensive evidence that Boceanu participated in a phishing scheme with his codefendants, that he obtained a program to extract email addresses, and that he worked closely with Nicola-Roman on the phishing scheme at the same time that Nicola-Roman was engaging in the People's Bank website scam, the court concludes that, taking the evidence in a light most favorable to the government, a reasonable jury could find that Boceanu knowingly and willfully joined the agreement to commit bank fraud against People's Bank.

U.S. v. Boceanu, supra.

The judge therefore denied Boceanu’s motion for judgment of acquittal.  U.S. v. Boceanu, supra.  The press release noted above say that when Boceanu is sentenced, he “faces a maximum term of imprisonment of 35 years.”