You are on page 1of 17

.l ~lVJJli4132

Document 1

Case 1:19-cr-00391-AT

Filed 04/26/19

.

Page 1 of 17

'

'

OR\G\NAL

Approved:

 

MICHAEL

R.

HERMAN

Assistant

United

States

Attorneys

Before:

THE

HONORABLE

HENRY

B.

PITMAN

United

States

Magistrate

Judge

Southern

District

of

New

York

------------------------------------x

UNITED

STATES

OF

AMERICA

 

SEALED

COMPLAINT

 

-v.-

GERALD

VASQUEZ,

 

Violations

of

 

a/k/a

"Gera,"

18 u.s.c.

§§

1341,

GARY

BIERD,

1349,

1028A,

and

2

a/k/a

"V.O.,"

IRVIN

CASTILLO,

 

a/k/a

"Mune,"

COUNTY

OF

OFFENSE:

DAUBRIEL

DISLA,

NEW

YORK,

BRONX,

a/k/a

"Felipe

Disla,"

WESTCHESTER

a/k/a

"Mate,"

a/k/a

"Jason

Rodriguez,"

a/k/a

"Michael

Martinez,"

WILKIN

DE

LOS

SANTOS,

JOSE

a/k/a

VARGAS,

"Sep

550,"-and

a/k/a

"Jeffre

Pizarro,"

a/k/a

"Melvin

Perez,"

a/k/a

"Pejecito,"

Defendants.

-----------------------------------x

SOUTHERN

DISTRICT

OF

NEW

YORK,

ss.:

ARMANDO

COUTINHO,

being

duly

sworn,

deposes

and

says

that

he

is

a

Detective

with

the

New

York

City

Police

Department

("NYPD"),

and

charges

as

follows:

'\.,,

-

.

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 2 of 17

COUNT

ONE

(Mail

Fraud)

1. From at least in or about 2012 up to and including the

present, in the Southern District of New York and elsewhere, GERALD

VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO, a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jeffre Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, willfully and knowingly, having devised and intending to devise a scheme and artifice to defraud, and for obtaining money and property by means of false and fraudulent pretenses, representations, and promises, for the purpose of executing such scheme and artifice and attempting so to do, did place in a post office and authorized depository for mail matter, matters and things to be sent and delivered by the Postal Service, and did deposit and cause to be deposited matters and things to be sent and delivered by private and commercial interstate carriers, and did take and receive therefrom, such matters and things, and did cause to be delivered by mail and such carriers, according to the directions thereon, and at the places at which they were directed to be delivered by the person to whom they were addressed, such matters and things, to wit, VASQUEZ, BIERD, CASTILLO, DISLA, DE LOS SANTOS, and VARGAS used the personally identifying information ("PII") of others to fraudulently acquire valuable electronic devices and used the Postal Service and other commercial interstate carriers to transmit PII and mobile phones to and from, among other places, New York, New York and the Bronx, New York.

!

(Title

18,

United

States

Code,

Sections

1341

and

2.)

(Conspiracy

COUNT

TWO

to

Commit

Mail

Fraud)

2. From at least in or about 2012 up to and including the

present, in the Southern District of New York and elsewhere, GERALD

VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO, a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jeffre Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, and others known and unknown, willfully and knowingly, did combine, conspire, confederate, and agree together and with each other to commit mail fraud, in violation of Title 18, United States Code, Section 1341.

2

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 3 of 17

3. It was a part and object of the conspiracy that ·GERALD

VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO, a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jeffre Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, and others known and unknown, willfully and knowingly, having devised and intending to devise a scheme and artifice to defraud, and for obtaining money and property by means of false and fraudulent pretenses, representations and promises, for the purpose of executing such scheme and artifice and attempting so to do, would and did place in a post office and authorized depository for mail matter, matters and things to be sent and delivered by the Postal Service, and did deposit and cause to be deposited matters and things to be sent and delivered by private and commercial interstate carriers, and would and did take and receive there from, such matters and things, and would and did cause to be delivered by mail and such carriers according to the directions thereon, and at the places at which they were directed to be delivered by the person to whom they were addressed, such matters and things, in violation of Title 18, United States Code, Section 1341.

(Title

18,

United

States

Code,

Section

1349.)

 

COUNT

THREE

 
 

(Aggravated

Identity

Theft)

the

present, in the Southern District of New York and elsewhere, GERALD

4.

From

at

least

in

or

about

2012

up

to

and

including

VASQUEZ,

a/k/a

"Gera,"

GARY

BIERD,

a/k/a

"V.O.,"

IRVIN

CASTILLO,

a/k/a

"Mune,"

DAUBRIEL

DISLA

a/k/a

"Felipe

Disla,"

a/k/a

"Mate,"

a/k/a

"Jason

Rodriguez,"

a/k/a

"Michael

Martinez,"

WILKIN

DE LOS

SANTOS,

a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, knowingly

did transfer, possess,

a/k/a

"Sep

550,"

and

JOSE

VARGAS

a/k/a

"Jefre

Pizarro,"

a

means

and

use,

without

lawful

authority,

of

identification

of

another

person,

during

and

in

relation

to

a

felony

violation

enumerated

in

Title

18,

United

States

Code,

Section

1028A(c),

to

wit,

VASQUEZ,

BIERD,

DISLA,

DE

LOS

SANTOS,

and

VARGAS

used

the

names

and

PII

of

other

persons

during

and

in

relation

to

the

mail

fraud

and

conspiracy

to

commit

mail

fraud

charged

in

Counts

One

and

Two

of

this

Complaint.

 

(Title

18,

United

States

Code,

Sections

1028A(a) (1),

 

1028A(b),

and

2.)

 

The

bases

for

my

knowledge

and

for

the

foregoing

charges

are,

in

part,

as

follows:

 

3

I\

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 4 of 17

5. I am a Detective with the NYPD and I have been personally

involved in the investigation of this matter. This affidavit is based upon my personal participation in the investigation, my examination of reports, records, seized evidence, and photographs, and my conversations with other law enforcement officers and other individuals. Because this affidavit is being submitted for the limited purpose of establishing probable cause, it tloes not include all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions,

statements, and conversations of others are reported herein, they

are

indicated.

reported

in

substance

and

in

part,

except where otherwise

Terminology

6. Based

experience,

I

am

on

my

familiar

education,

training,

research,

with

the

following

relevant

terms:

and

identifying

information that can be used, together with other information, or alone, to identify a particular individual. Such information can include an individual's name, date of birth, and/or social security number.

a. Personally

information,

or

PII,

is

b. An International Mobile Equipment

Identity

("IMEI")

number is a unique numerical code associated with each cellphone or mobile device. A device's IMEI number is often necessary to

unlock the

use

from a particular cellular service company or to policy.

device

an

insurance

Overview

of

the

Fraud

Scheme

7.

Since

in or around 2014,

the

NYPD and

the

Federal

Bureau

of

individuals - the "Fraud Ring" - who operated in, among other places, the Southern District of New York, including the Bronx, Manhattan, and Westchester County. From at least 2012 to the present, the Fraud Ring perpetrated a wide-ranging scheme to obtain valuable, new electronic devices, predominantly Apple iPhones. During the course of the conspiracy, the Fraud Ring fraudulently obtained more than $19 million worth of devices. To facilitate the scheme, the Fraud Ring traveled to approximately 34 different states, but often brought or shipped the fraudulently obtained cellphones back to the Bronx, where they regularly sold them through fencing operations.

of Investigation

("FBI")

have

been

investigating

a

group

8. The

Fraud

exi5ting

customers'

Ring

regularly

engaged

accounts

with

cgllulcir

in

intrusions

into

sGrvicg

companiGg

in

4

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 5 of 17

order to obtain iPhones. The Fraud Ring frequently obtained new phones or "upgrade" phones by paying only a small fee in the store, while charging the vast majority of the purchase price to existing customers' accounts, without the consent or knowledge of these existing customers. In addition to exploiting existing customers' accol:mts, at times the Fraud Ring also created new fraudulent accounts. Thus, the scheme's victims include (1) customers, whose identities were stolen and/or whose accounts were accessed without authorization; and (2) cellphone service providers, which typically bore financial losses inflicted by the scheme.

9.

In

order

to

access

customer

accounts,

members

of

the

Fraud Scheme would create fake identification ("ID") cards and obtain fraudulent credit and debit cards to allow members of the Fraud Scheme to pose as an authorized accountholder. In reality, however, these modes of identification utilized the stolen PII of others.

10. The Fraud Ring would typically send participants on

"trips," fanning out across the country to fraudulently acquire iPhones. The Fraud Ring's participants held differing roles within the ring: At the top were the Fraud Ring's leaders, termed "Top Dogs" by the Fraud Ring's participants. Top Dogs organized and funded trips, sold fraudulently obtained iPhones, and made the lion's share of the profits. Second were participants who worked with the stolen PII and forged identifying materials. Finally,

the Fraud Ring included lower-level trip participants, the runners and drivers, who were actually responsible for using the stolen PII to fraudulently acquire iPhones and then shipping the phones back to Top Dogs in the New York City area.

Summary

of

Information

Provided

by

a

Cooperating Witness

11. From my participation in the investigation and my

conversations with other law enforcement officers, I have learned

that a cooperating witness ("CW-1") 1 engaged in several proffer session with law enforcement. During these proffer sessions, CW- 1 informed law enforcement, in substance and in part, of the following:

or

Fraud

about

a.

2013.

CW-1

was

recruited

he

went

on

to

join

the

Fraud

Ring

the

in

That

year,

his

first

trip

with

1 CW-1 has pleaded guilty to multiple offenses

pursuant

to

a

cooperation agreement with the Government.

Thus

far,

the

information provided by CW-1 has been reliable corroborated by other aspects of this investigation.

and

has

been

5

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 6 of 17

Ring, traveling from New York to a different state, in order to acquire iPhones. On this trip, he was given fake IDs and other

bank cards and he visited numerous stores, posing as third-parties

in

order

to

acquire

iPhones

at

little

to

no

personal

cost.

 

b.

In

total,

CW-1

believes

he

went

on

approximately

eighteen

trips

to

acquire

iPhones

for

the

Fraud

Ring.

CW-1

was

generally

paid

$100

for

each

iPhone

he

acquired

on

one

of

these

trips.

 

c.

On each trip,

CW-1 would be accompanied by a

driver.

In advance of the trip, CW-1 would receive a fake ID and bank card. The bank card was to be used as a secondary form of identification

in case CW-1 was questioned as to his identity. Members of the Fraud Ring would send electronic messages to CW-1 with the PII of the accountholders whose account CW-1 was supposed to access in order to acquire iPhones. Every few days on these trips, CW-1 would send back to the New York area, via overnight delivery, the iPhones he had acquired on the trip and since the last shipment.

d. The individual organizing a trip would pay for CW-

1 and his driver's travel to the trip location and would cover expenses while the trip was in progress, whether through reimbursement on return from the trip or wire transfers while the trip was in progress.

organized by

GERARD VASQUEZ, a/k/a "Gera" and WILKIN DE LOS SANTOS, a/k/a "Sep 550," the defendants.

e.

Among

other people,

CW-1

went

on trips

Information

from

Commercial

Carriers

review

of information provided by a commercial shipper ("Shipper-1"), and conversations with representatives of Shipper-1, I have learned,

among other things, the following:

12. Based on my involvement in

this investigation,

my

 

a.

In or about December 2014,

a

Shipper-1

employee

observed

two

notable patterns in certain packages

it

was

processing:

i. The first pattern ("Shipping Pattern-1") had

the following characteristics: (i) the packages were shipped with a check, cash, or credit card payment method, indicating that the shipper did not hold an account with Shipper-1, (ii) the packages were shipped at an express domestic rate, (iii) the packages were shipped to specific Shipper-1 stores or desk locations (rather

th~m o.ctuo.l bu~in~~~ Q;r; h<Jm~ Qdd.i;e~rne~) ,

6

(.iv)

the~e

5hipper-l

 

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 7 of 17

 

stores

were

the

same

two

locations,

one

in

Bronx,

New

York,

and

the

always

other

in Mount Vernon,

from

states

shipped

New

other

York,

than

(v) the packages were almost

(vi) however, the

New

York,

packages

carried

return

addresses

located

in

New

York

State.

ii.

The

second

pattern

("Shipping

Pattern-2")

had

the following characteristics: (i) the packages were shipped with

a check, cash, or credit card payment method, indicating that the

shipper did not hold an account with Shipper-1, (ii) the packages were shipped at an express domestic rate, (iii) the packages were shipped from the same Bronx and Mount Vernon Shipper-1 store

locations to Shipper-1 store or desk locations in other states.

iii.

As

Shipper-1

began

tracking

Shipping

Pattern-

1

and

Shipping

Pattern-2,

Shipper-1

began

to

notice

common

trends

in

the

recipients

and

shippers

of

the

packages

falling

within

the

Patterns.

b. Between in or about 2014 and in or about July 2017,

Shipper-1 identified numerous packages that fit within the parameters of Shipping Pattern-1. Of these, consistent with its terms and conditions of service, Shipper-1 opened 39 packages. Each of these packages contained electronic devices. Based on information provided by telephone providers and electronics manufacturers~ upon searching records associated with the IMEI numbers of the electronic devices encountered, I have learned that all of the electronic devices contained in the packages opened by Shipper-1 were classified as having been obtained through fraudulent activity. Specifically, the packages opened included:

i.

Sixteen

a/k/a "V.O.," the defendant. total of approximately 178 fraudulent means.

packages

addressed

to

GARY

BIERD,

These sixteen packages contained a electronic devices acquired through

ii. Five

packages

addressed

to

WILKIN

DE

LOS

SANTOS, a/k/a "Sep 550," the defendant. These five packages contained a total of approximately 55 electronic devices acquired

through fraudulent means.

iii. Two

packages

addressed

to

DAUBRIEL

DISLA,

a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," the defendant. These two packages contained

a total of approximately 20 electronic devices acquired through

fraudulent

means.

Bhipper-1

c. Between

in or about

2014

and

in

or about July 2017,

identified nume~ou~ p~~kages that

fit

within

the

7

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 8 of 17

parameters of Shipping Pattern-2. Of these, consistent with its terms and conditions of service, Shipper-1 opened 4 packages. Each

of

these

packages

contained

fraudulent

credit

cards,

driver's

licenses,

and

other

forms

of

ID.

Specifically,

the

packages

opened

included:

i.

Two packages shipped by DISLA. 2 These two

packages contained approximately 14 fraudulent credit cards and

approximately

14

fraudulent

driver's

licenses.

 

ii.

One

"Gera," the defendant.

package shipped by GERALD VASQUEZ, a/k/a This package contained approximately 10

fraudulent Credit cards

and

10

fraudulent

passport

cards.

iii. One package shipped by JOSE VARGAS a/k/a

"Jeffre Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito," the defendant. 3 This package contained approximately 10 fraudulent credit cards and 10 fraudulent driver's licenses.

d. In total, between October 2014 and the present, the

defendants have used Shipper-1 to ship and receive numerous packages. For example:

i.

GERALD

VASQUEZ,

a/k/a

"Gera,"

the

defendant,

was

listed

as

the

recipient

of

approximately

169

packages

and

the

shipper

of

approximately

8

packages.

 

as approximately 196 packages and the shipper

was

ii.

BIERD

listed

the

of

recipient

approximately

of

47

packages. DE LOS SANTOS shipped at least 21

of

the

approximately

196

packaqes

received by

BIERD.

 
 

iii.

IRVIN

CASTILLO,

a/k/a

"Mune,", the

defendant,

was

listed

as

the

recipient

of

approximately

168

packages.

2 These packages were

and "Jason Rodriguez." Based on my review of surveillance video and images provided by Shipper-1 and known photographs of DISLA, I have identified "Michael Martinez" and "Jason Rodriguez" to be

DISLA.

3 This package was sent by an indi victual named "Melvin Perez." Based on my review of surveillance video and images provided by Shipper-1 and known photographs of VARGAS, I have identified

"Melvin Perez"

sent by individuals

named

"Michael

Martinez"

to be Vl".RGl:i.S,

8

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 9 of 17

 

lV.

DISLA

was

listed

as

the

recipient

of

approximately packages. 4

76

packages

and

the

shipper

of

approximately

49

v.

DE

LOS

SANTOS

was

listed

as

the

recipient

of

approximately

23

packages

and

the

shipper

of

approximately

41

packages.

 

vi.

JOSE

VARGAS,

a/k/a

"Jeff re

Pizzarro,"

a/k/a

"Melvin

Perez,"

a/k/a

"Pejecito,"

was

listed

as

the

recipient

of

approximately

39

packages

and

the

shipper

of

approximately

250

packages.

 

Information

from

Cellular

Providers

 

13. Based on my involvement in this investigation and

conversations with cellular providers, I have learned that in the early period that the Fraud Ring was active, members of the Fraud Ring would hack into the cellphone accounts of victims and add the names of Fraud Ring members as "authorized users" on the accounts. These "authorized users" would be able to use their own names and the victim account information to fraudulently obtain new electronic devices. Later, the Fraud Ring changed practices and began adding the stolen PII of innocent third parties as users on cellphone accounts. Fraud Ring participants then started utilizing fake credit, debit, and ID cards to masquerade as these third-parties and acquire cellular phones. See, e.g., infra~ 17.

provider

the

2013 through on or

about May 29, 2015, GERALD VASQUEZ, a/k/a "Gera," the defendant, was added as an authorized user on approximately 434 accounts. VASQUEZ's addition to these accounts resulted in the acquisition of at least 137 electronic devices that Provider-1 has identified were acquired . through fraudulent means. The purchase of an additional 98 devices were attempted on these accounts, but these purchases were prevented due to fraud alerts.

14.

Based

on

I

From

information

learned

or

about

provided

October

by

a

cellular

("Provider-1"),

a.

have

on

following:

18,

August

as

an

b.

From

2014 through on or about

GARY BIERD, a/k/a "V.O.," the defendant, was adde.d

on

or

on

about

May

8,

8,

2014,

authorized

user

approximately

23

accounts.

BIERD' s

4 Several of these packages were shipped under the names "Jason Rodriguez" and "Michael Martinez," which, as previously discussed,

have been identified ao poeudonymo of D~SLA, aee oupra n.2,

9

Case 1:19-cr-00391-AT

addition to

32

through

these

accounts

that

means.

electronic

devices

fraudulent

Document 1

Filed 04/26/19

Page 10 of 17

resulted

Provider-1

in

the

has

least

identified were acquired

acquisition

of at

c. From in or about March 2014 through in or about

December 2016, DAUBRIEL DISLA, a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," the defendant, was added as an authorized user on approximately 10 accounts. DISLA's addition to these accounts resulted in the acquisition of at least 32 electronic devices that Provider-1 has identified were acquired through fraudulent means.

d. From on or about July 22, 2014 through on or about

September 16, 2016, WILKIN DE LOS SANTOS, a/k/a "Sep 550," the defendant, was added as an authorized user on approximately 5 accounts. DE LOS SANTOS's addition to these accounts resulted in the acquisition of at least 2 electronic devices that Provider-1 has identified were acquired through fraudulent means.

15. Based

("Provider-2"),

on

information

I

have

learned

provided

by

the

following:

a

cellular

provider

a. From on or about March 12, 2014 through on or about

November 7, 2014, GERALD VASQUEZ, a/k/a "Gera," the defendant, was

added as an authorized user on 55 accounts. VASQUEZ's addition to these accounts resulted in the acquisition of at least 10 electronic devices that Provider-2 has identified were acquired through fraudulent means.

b. From on or about

January 6,

2014

through on or about

March 27,

2014,

GARY

BIERD,

a/k/a

"V.O.,"

the

defendant,

was

added

as

an

authorized

user

on

16

accounts.

BIERD's

addition

to

these

accounts resulted

in

the

acquisition

of

at

least

33

electronic

devices that

Provider-2

has

identified

were

acquired

through

fraudulent

means.

c. From on or about October 20, 2014 through on or

about January 12, 2015, WILKIN DE LOS SANTOS, a/k/a "Sep 550," the defendant, was added as an authorized user on 46 accounts. DE LOS SANTOS's addition to these accounts resulted in the acquisition of at least 36 electronic devices that Provider-2 has identified were acquired through fraudulent means.

Searches

of

Shipments

16. Based on my involvement in this investigation and review

of records provided by Shipper-1 and Provider-1, I have learned

the

following:

10

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 11 of 17

law enforcement

executed a search of a package shipped by Shipper-1 pursuant to a court-ordered search warrant (the "First Searched Package") .

a.

On

or

about

February

15,

2016,

b. The First Searched Package was shipped from WILKIN

DE LOS SANTOS, a/k/a "Sep 550," the defendant, to GARY BIERD, a/k/a

"V.O.," the defendant. The package was shipped from Las Vegas, Nevada, to Mount Vernon, New York.

c.

The

First

Searched

Package

contained

16

iPhories.

Based on searches run for the IMEI numbers of these 16 iPhones, I

have learned that the iPhones were obtained as a result of fraud suffered by four different accounts maintained by Provider-1. Fifteen of these iPhones were acquired in Las Vegas, Nevada, and one was acquired in Mesa, Arizona.

 

d.

Based

on my

review

of

surveillance

images

provided

by

Shipper-1

and

a

comparison

against

known

photographs

of

BIERD,

I

have

learned

that

BIERD picked

up

the

First

Searched

Package

at

the

Shipper-1

destination

facility

in Mount Vernon,

New

York.

17. Based on my involvement in this investigation and review

of records provided by Shipper-1 and Provider-1, I have learned

the

following:

a. On

or

executed

court-ordered

a

search

of

search

about

February

7,

a

warrant

package

shipped by

"Second

(the

2017, law enforcement Shipper-1 pursuant to a Searched Package") .

b. The Second Searched Package was shipped from WILKIN

DE LOS SANTOS, a/k/a "Sep 550", the defendant, to 'DAUBRIEL DISLA, a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a

"Michael Martinez," the defendant. The package was shipped from Fullerton, California, to New York, New York.

c.

The

Second

Searched

Package

contained

10

iPhones.

Based on searches run for the IMEI numbers of these 10 iPhones, I

a suffered by an account maintained by Provider-1. Specifically, based on information provided by Provider-1, I have learned that:

have

were

learned

that

the

iPhones

obtained

as

result

of

fraud

same

Provider-1 account ("Account-1") . An individual with a San Francisco, California, home address was listed as the primary contact on Account-1.

i.

All

10

iPhones

were

acquired

on

the

 

ii.

On

or

about

January

29,

2017,

an

individual

with

an

address

in

the

Bronx

("Bronx-Based

Individual")

was

added

11

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 12 of 17

as an authorized user to Account-1. Between February 1, 2017 and February 2, 2017, an individual claiming the identity of the Bronx- Based Individual and using Account-1 acquired all 10 phones that DE LOS SANTOS shipped to DISLA in the Second Searched Package. All of these phones had been acquired at retail locations in Southern California.

t

iii. Between January 29,

2017

and February 6,

2017,

the Bronx-Based Indivictual was added as an aut(1orized user on multiple additional Provider-1 accounts resulting in the fraudulent acquisition of more than $25,000 worth of electronic devices.

iv. Based on my review of a law enforcement database compiling publicly available information, I have learned that no one by the name of the Bronx-Based Individual resided at the address associated with that individual on Account-1 during the relevant time period. Accordingly, I believe that the Bronx-

Based Individual was a pseudonym used by a Fraud Ring participant employing fraudulent ID and bank cards to acquire phones on

Account-1

and

other

Provider-1

accounts.

d.

Based on surveillance conducted by myself and other

law enforcement officers, I have learned that DISLA picked up the Second Searched Package from the Shipper-1 destination facility in

New

York.

18. Based on my involvement in this investigation and review

of records provided by Shipper-1 and Provider-2, I have learned

the

law enforcement

executed a search of a package shipped by Shipper-1 pursuant to a court-ordered search warrant (the "Third Searched Package") .

following:

a. On

or

about

February

7,

2019,

b.

The

Third

Searched

Package

was

shipped

from

an

individual who, based on my involvement in this investigation I know to be a Fraud Ring participant ("CC-1"), to GERALD VASQUEZ, a/k/a "Gera," the defendant. The package was shipped from Austin, Texas, to Fort Lee, New Jersey.

c.

The

Third

Searched

Package

contained

17

iPhones.

Based on searches run for the IMEI numbers of these 17 iPhones, I have learned that the iPhones were obtained as· a result of fraud

suffered by six

accounts

maintained

by

Provider-2.

d.

Based

on

my

review

of

surveillance

footage

and

images

produced

by

Shipper-lr

I

have

12

learned

that

VASQUEZ

pi~k~ct

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 13 of 17

up the Third Searched Package from the Shipper-1 destination facility in New Jersey.

Search

of

Vasquez's

Cellular

Phone

19. Based on my involvement in this investigation, I have learned that, in or about June 2016, law enforcement officers obtained a cellular phone belonging to GERALD VASQUEZ, a/k/a "Gera," the defendant (the "Vasquez Phone") . The Vasquez Phone was obtained incident to VASQUEZ's arrest on unrelated charges. Law enforcement officers subsequently obtained a search warrant for the Vasquez Phone.

20. Based on my review of the Vasquez Phone and conversations

with other law enforcement officers who have reviewed the Vasquez

Phone,

I

have

learned

the

following:

a.

The

Vasquez

Phone

includes

large

quantities

of

PII

of

third

parties,

including:

 

i.

On or about· January 1, 2016, the Vasquez Phone

received 12 messages from an individual who, based on my involvement in this investigation and review of the Vasquez Phone,

I know to be a member of the Fraud Ring. These messages included

login information related to 89 cellular phone accounts maintained

by Provider-1. Based on information provided by Provider-1, I have learned that these accounts were utilized to fraudulently acquire electronic devices.

ii. In or about 2016, the Vasquez Phone sent 16

messages containing the PII of 180 cellular phone accounts to a phone number (the "Vargas Phone") later associated with JOSE VARGAS a/k/a "Jeffre Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito,"

the defendant. 5 Specifically, these messages included the names,

5 VARGAS was identified as the user of the Vargas Phone based on running searches of this phone number against a database maintained by Shipper-1. Based on information obtained from this Shipper-1 database, law enforcement agents identified that the Vargas Phone was used both to communicate with VASQUEZ and to ship and receive packages under the name "Melvin Perez." Furthermore, based on information obtained by a money transmitter service, law enforcement established that the Vargas Phone was associated with wire transfers conducted by "Jeffre Pizarro," an individual with

a Pennsylvania driver's license. Based on a review of surveillance videos and photographs prov.lded by ~h.lpper-1, law enforcement

13

,.

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 14 of 17

addresses, social security numbers, and dates of birth of third parties (the "Vasquez-Vargas PII"). As is set forth above, see

by VARGAS and opened by

Shipper-1 contained fraudulent bank cards and identification cards. Based on my training, experience, and involvement in this investigation, I believe that VARGAS was involved in manufacturing these fraudulent bank and ID cards for VASQUEZ and other members of the Fraud Ring.

supra <JI 12 (c) (iii), a packages sent

lll.

Based

on

information

provided

by

Provider-1,

I have learned that the accounts associated with the Vasquez- Vargas PII were used to fraudulently obtain approximately 1,218 iPhones valued at approximately $620,000.

b.

The

Vasquez

Phone

included

other

photographs

demonstrating VASQUEZ and other Fraud involvement in the Fraud Ring, including:

Ring

participants'

i. The Vasquez Phone contained a photograph of a

February 25, 2016, receipt in the name of a victim of identity theft ("Victim-1") . According to this receipt, at least four new iPhones were purchased under Victim-l's name. Three of these four iPhones had assigned phone numbers with area codes belonging to the Lexington, Kentucky region. Also on the Vasquez Phone was a picture of a Kentucky driver's license in the name of Victim-1. However, rather than bearing a picture of Victim-1, this driver's license had a picture of an individual who, based on my involvement in this investigation, I know to be a Fraud Ring member and resident of the New York City area.

 

ii.

The

Vasquez

Phone

included

photographs

of

receipts

from money transmitter

services,

showing that

VASQUEZ

had

wired money to

Fraud Ring participants

located in

various

areas

of

the country.

 

iii.

The

Vasquez

Phone

included

photographs

of

driver's licenses and other forms of ID for a number of states;

however, the individuals' whose pictures were included in these ID devices do not match the individual whose information is included.

These

were

individuals

 

who,

based

on

my

involvement

in

this

investigation,

I

know

to

be

participants

in

the

Fraud

Ring

and

residents

of

the

New

York

City

area.

 

officers

able

to

establish

that

"Melvin

Perez"

is

the

same

were individµal c;i

;>

"J~ff.i:;-e Fi;;:;~;i;;i;;o" o.nd V.A.RG.A.S, Bee oupra n.3.

 

14

Case 1:19-cr-00391-AT

Document 1

iv. The Vasquez

Phone

Filed 04/26/19

Page 15 of 17

included photographs

of bank

cards

in

the

names

of

individuals

whose

identities

were

stolen.

 

Search

of

Castillo's

Devices

 

21.

Based on my involvement in this investigation, I have

learned that in or about July 2017, law enforcement officers obtained electronic devices belonging to IRVIN CASTILLO, a/k/a "Mune," the defendant. These devices were obtained incident to an unrelated arrest. These devices included a laptop computer (the "Castillo Laptop") and a cellular phone (the "Castillo Phone"). Law enforcement officers subsequently obtained search warrants for the Castillo Phone and the Castillo Laptop.

my conversations with other law enforcement officers

reviewed the Castillo Laptop, I have learned the following:

22.

Based

on

review

of

the

Castillo

Laptop

who

and

have

a. The user(s) of the Castillo Laptop .utilize the Tor

Browser ("Tor") and virtual private networks ("VPNs"). Based on my training and experience, I know that Tor and VPNs are computer and inte.rnet services used by individuals who hope to maintain anonymity in their online traffic and activities.

often

b. Provider-l's

visited by the

user(s)

website

of

the

is

one

Castillo

of

the

Laptop.

websites

most

c. Although the Castillo LaP.top retained little search

history, the Castillo Laptop did preserve several "cookies," cache, and temporary internet files saved in browsers, from past website visits. Based on my training and experience, I know that "cookies," cache, and temporary internet files saved in browsers are a terms for a small piece of data that is saved on a computer after visiting a particular website, which allows a .website or company to determine, among other things, which computer or browser visited the website, and how many different accounts have been accessing a given website from the same device and web browser.

d. Based on a review of the Castillo Laptop cookies,

cache, and temporary internet ·files, I have learned that the user(s) of the Castillo Laptop ran repeated queries for a number of accounts associated with an email host ("Email Host-1"). One of these accounts utilized the name of a particular individual ("Victim-2" and the email account being "Victim-2 Email Account").

23.

Based

on

my

conversations with representatives of

Provider-1

and

review

of

documents produced by Provider-1, I have

learned

the

following:

15

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 16 of 17

a. Provider-1 searched its system for the Victim-2

Email. A search of the system revealed that Victim-2 has an account with Provider-1. This search al so revealed that on or about May 27, 2017, a user utilizing a particular.IP Address ("IP Address-1"), logged on to Victim-2's account and added the Victim- 2 Email to the account. Previously, Victim-2's account was linked to an email operated by a different email host ("Email Host-2"). Based on my training and experience, I understand that members of the Fraud Ring added the Victim-2 Email, hosted by Email Host-1, to Victim-2's account so that the Fraud Ring would have access to, and receive updates regarding, Victim-2' s account. Following, this alteration, Victim-2's account suffered fraud, with multiple cellular phones being fraudulently obtained on the account.

b. Provider-1 searched its system for other accounts

that had been accessed by IP Address-1. This search revealed fifty-three cellular phone accounts, hosted by Provider-1, that

had been accessed by a user utilizing IP Address-1. Many of these accounts also had email addresses hosted by Email Host-1. Based

an

on my training and experience, I know that Email Host-1 is

infrequently used email provider. Furthermore, 52 of these 53 accounts were utilized to fraudulently acquire at least

approximately 383 electronic devices valued at approximately

$360,000.

 

c.

The

only

account

accessed

by

a

user

utilizing

IP

Address-1

was

the

account

in

the

name

of

IRVIN

CASTILLO,

a/k/a

"Mune,"

the

defendant.

One

of

the

phone

numbers

serviced

by

Provider-1

on

Castillo's

behalf

carries

a

929

area

code

(the

"Castillo

Phone

Number") .

24.

provider

Based

on ("Provider-3") I have learned that IP Address-1 is

service

information

obtained

from

an

online

serviced by Provider-3 and is associated with an individual

Based on my

involvement in this investigation,

enforcement officers have been unable to identify a real person

law

("Individual-1")

with

a

New

Jersey

I

address.

have

learned

that

with the

name

and

address

claimed by

Individual-1.

 

25.

Based

on

information

provided

by

Provider-3,

I

have

learned that the account associated with IP Address-1 lists the

Castillo

Phone

Number

as

one

of

the

two

phone

numbers

of

record.

26.

Based on my review of the Castillo Phone, which is the

device assigned the Castillo Phone Number,

Castillo Phone includes a picture of a Provider-3 bill addressed

I have learned that the

to Individual-1 for the billing period of March 2017.·

16

., '

I

'\

Case 1:19-cr-00391-AT

Document 1

Filed 04/26/19

Page 17 of 17

27. Based on the foregoing, I believe that Individual-1 is

a false identity utilized by IRVIN CASTILLO, a/k/a "Mune," the defendant to cloak the fact that he is the subscriber of IP Address-1 and uses that account to hack into and alter telephone accounts in furtherance of the Fraud Ring.

 

28.

Based on my review

of

the

Castillo

Phone,

I

have

learned

that

the

phone

includes

a

note

listing

fourteen

different

sets

of

PII

and

account

information

("Castillo

PII

Note").

Some

of

these

sets

include

a

username,

password,

activated

phone

numbers,

home

addresses,

social

security

numbers,

and

email

address

associated

with

an

account

and/or

individual.

29.

Based on information provided by Provider-2, I have

learned that the individuals and account listed in the Castillo

PII Note have been victims of the ,Fraud Ring, with their accounts being used to fraudulently obtain at least approximately 114

electronic

devices

valued

at

approximately

$103,000.

WHEREFORE, the deponent respectfully requests that warrants be issued for the arrests of GERALD VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO, a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jeff re Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, and that they be arrested and imprisoned, or bailed, as the case may be.

ARMANDO

COUTINHO

Detective

New

York

City

Police

17

Department