.l ~lVJJli4132 .

Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page

'
'
1 of 17
OR\G\NAL
Approved:

MICHAEL R. HERMAN
Assistant United States Attorneys

Before: THE HONORABLE HENRY B. PITMAN

United States Magistrate Judge
Southern District of New York

------------------------------------x
UNITED STATES OF AMERICA
SEALED COMPLAINT
-v.-

GERALD VASQUEZ, Violations of

a/k/a "Gera," 18 u.s.c. §§ 1341,
GARY BIERD, 1349, 1028A, and 2
a/k/a "V.O.,"
IRVIN CASTILLO,
a/k/a "Mune," COUNTY OF OFFENSE:
DAUBRIEL DISLA, NEW YORK, BRONX,
a/k/a "Felipe Disla," WESTCHESTER
a/k/a "Mate,"
a/k/a "Jason Rodriguez,"
a/k/a "Michael Martinez,"
WILKIN DE LOS SANTOS,
a/k/a "Sep 550,"-and
JOSE VARGAS,
a/k/a "Jeffre Pizarro,"
a/k/a "Melvin Perez,"
a/k/a "Pejecito,"

Defendants.

-----------------------------------x
SOUTHERN DISTRICT OF NEW YORK, ss.:

ARMANDO COUTINHO, being duly sworn, deposes and says

that he is a Detective with the New York City Police Department
("NYPD"), and charges as follows:
'\.,, - . Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 2 of 17

COUNT ONE
(Mail Fraud)

1. From at least in or about 2012 up to and including the

present, in the Southern District of New York and elsewhere, GERALD
VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO,
a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate,"
a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS
SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jeffre Pizarro,"
a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, willfully
and knowingly, having devised and intending to devise a scheme and
artifice to defraud, and for obtaining money and property by means
of false and fraudulent pretenses, representations, and promises,
for the purpose of executing such scheme and artifice and
attempting so to do, did place in a post office and authorized
depository for mail matter, matters and things to be sent and
delivered by the Postal Service, and did deposit and cause to be
deposited matters and things to be sent and delivered by private
and commercial interstate carriers, and did take and receive
therefrom, such matters and things, and did cause to be delivered
by mail and such carriers, according to the directions thereon,
and at the places at which they were directed to be delivered by
the person to whom they were addressed, such matters and things,
to wit, VASQUEZ, BIERD, CASTILLO, DISLA, DE LOS SANTOS, and VARGAS
used the personally identifying information ("PII") of others to
fraudulently acquire valuable electronic devices and used the
Postal Service and other commercial interstate carriers to
transmit PII and mobile phones to and from, among other places,
New York, New York and the ! Bronx, New York.

(Title 18, United States Code, Sections 1341 and 2.)

COUNT TWO
(Conspiracy to Commit Mail Fraud)

2. From at least in or about 2012 up to and including the

present, in the Southern District of New York and elsewhere, GERALD
VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO,
a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate,"
a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS
SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jeffre Pizarro,"
a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, and others
known and unknown, willfully and knowingly, did combine, conspire,
confederate, and agree together and with each other to commit mail
fraud, in violation of Title 18, United States Code, Section 1341.

2
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 3 of 17

3. It was a part and object of the conspiracy that ·GERALD

VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO,
a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate,"
a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS
SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jeffre Pizarro,"
a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, and others
known and unknown, willfully and knowingly, having devised and
intending to devise a scheme and artifice to defraud, and for
obtaining money and property by means of false and fraudulent
pretenses, representations and promises, for the purpose of
executing such scheme and artifice and attempting so to do, would
and did place in a post office and authorized depository for mail
matter, matters and things to be sent and delivered by the Postal
Service, and did deposit and cause to be deposited matters and
things to be sent and delivered by private and commercial
interstate carriers, and would and did take and receive there from,
such matters and things, and would and did cause to be delivered
by mail and such carriers according to the directions thereon, and
at the places at which they were directed to be delivered by the
person to whom they were addressed, such matters and things, in
violation of Title 18, United States Code, Section 1341.

(Title 18, United States Code, Section 1349.)

COUNT THREE
(Aggravated Identity Theft)

4. From at least in or about 2012 up to and including the

present, in the Southern District of New York and elsewhere, GERALD
VASQUEZ, a/k/a "Gera," GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO,
a/k/a "Mune," DAUBRIEL DISLA a/k/a "Felipe Disla," a/k/a "Mate,"
a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," WILKIN DE LOS
SANTOS, a/k/a "Sep 550," and JOSE VARGAS a/k/a "Jefre Pizarro,"
a/k/a "Melvin Perez," a/k/a "Pejecito," the defendants, knowingly
did transfer, possess, and use, without lawful authority, a means
of identification of another person, during and in relation to a
felony violation enumerated in Title 18, United States Code,
Section 1028A(c), to wit, VASQUEZ, BIERD, DISLA, DE LOS SANTOS,
and VARGAS used the names and PII of other persons during and in
relation to the mail fraud and conspiracy to commit mail fraud
charged in Counts One and Two of this Complaint.

(Title 18, United States Code, Sections 1028A(a) (1),

1028A(b), and 2.)

The bases for my knowledge and for the foregoing charges

are, in part, as follows:

3
I\
Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 4 of 17

5. I am a Detective with the NYPD and I have been personally

involved in the investigation of this matter. This affidavit is
based upon my personal participation in the investigation, my
examination of reports, records, seized evidence, and photographs,
and my conversations with other law enforcement officers and other
individuals. Because this affidavit is being submitted for the
limited purpose of establishing probable cause, it tloes not include
all the facts that I have learned during the course of my
investigation. Where the contents of documents and the actions,
statements, and conversations of others are reported herein, they
are reported in substance and in part, except where otherwise
indicated.

Terminology

6. Based on my education, training, research, and

experience, I am familiar with the following relevant terms:

a. Personally identifying information, or PII, is

information that can be used, together with other information, or
alone, to identify a particular individual. Such information can
include an individual's name, date of birth, and/or social security
number.

b. An International Mobile Equipment Identity ("IMEI")

number is a unique numerical code associated with each cellphone
or mobile device. A device's IMEI number is often necessary to
unlock the device from a particular cellular service company or to
use an insurance policy.

Overview of the Fraud Scheme

7. Since in or around 2014, the NYPD and the Federal Bureau

of Investigation ("FBI") have been investigating a group of
individuals - the "Fraud Ring" - who operated in, among other
places, the Southern District of New York, including the Bronx,
Manhattan, and Westchester County. From at least 2012 to the
present, the Fraud Ring perpetrated a wide-ranging scheme to obtain
valuable, new electronic devices, predominantly Apple iPhones.
During the course of the conspiracy, the Fraud Ring fraudulently
obtained more than $19 million worth of devices. To facilitate
the scheme, the Fraud Ring traveled to approximately 34 different
states, but often brought or shipped the fraudulently obtained
cellphones back to the Bronx, where they regularly sold them
through fencing operations.

8. The Fraud Ring regularly engaged in intrusions into

exi5ting customers' accounts with cgllulcir sGrvicg companiGg in

4
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 5 of 17

order to obtain iPhones. The Fraud Ring frequently obtained new

phones or "upgrade" phones by paying only a small fee in the store,
while charging the vast majority of the purchase price to existing
customers' accounts, without the consent or knowledge of these
existing customers. In addition to exploiting existing customers'
accol:mts, at times the Fraud Ring also created new fraudulent
accounts. Thus, the scheme's victims include (1) customers, whose
identities were stolen and/or whose accounts were accessed without
authorization; and (2) cellphone service providers, which
typically bore financial losses inflicted by the scheme.

9. In order to access customer accounts, members of the

Fraud Scheme would create fake identification ("ID") cards and
obtain fraudulent credit and debit cards to allow members of the
Fraud Scheme to pose as an authorized accountholder. In reality,
however, these modes of identification utilized the stolen PII of
others.

10. The Fraud Ring would typically send participants on

"trips," fanning out across the country to fraudulently acquire
iPhones. The Fraud Ring's participants held differing roles within
the ring: At the top were the Fraud Ring's leaders, termed "Top
Dogs" by the Fraud Ring's participants. Top Dogs organized and
funded trips, sold fraudulently obtained iPhones, and made the
lion's share of the profits. Second were participants who worked
with the stolen PII and forged identifying materials. Finally,
the Fraud Ring included lower-level trip participants, the runners
and drivers, who were actually responsible for using the stolen
PII to fraudulently acquire iPhones and then shipping the phones
back to Top Dogs in the New York City area.

Summary of Information Provided by a Cooperating Witness

11. From my participation in the investigation and my

conversations with other law enforcement officers, I have learned
that a cooperating witness ("CW-1") 1 engaged in several proffer
session with law enforcement. During these proffer sessions, CW-
1 informed law enforcement, in substance and in part, of the
following:

a. CW-1 was recruited to join the Fraud Ring in or

about 2013. That year, he went on his first trip with the Fraud

1 CW-1 has pleaded guilty to multiple offenses pursuant to a

cooperation agreement with the Government. Thus far, the
information provided by CW-1 has been reliable and has been
corroborated by other aspects of this investigation.

5
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 6 of 17

Ring, traveling from New York to a different state, in order to

acquire iPhones. On this trip, he was given fake IDs and other
bank cards and he visited numerous stores, posing as third-parties
in order to acquire iPhones at little to no personal cost.

b. In total, CW-1 believes he went on approximately

eighteen trips to acquire iPhones for the Fraud Ring. CW-1 was
generally paid $100 for each iPhone he acquired on one of these
trips.

c. On each trip, CW-1 would be accompanied by a driver.

In advance of the trip, CW-1 would receive a fake ID and bank card.
The bank card was to be used as a secondary form of identification
in case CW-1 was questioned as to his identity. Members of the
Fraud Ring would send electronic messages to CW-1 with the PII of
the accountholders whose account CW-1 was supposed to access in
order to acquire iPhones. Every few days on these trips, CW-1
would send back to the New York area, via overnight delivery, the
iPhones he had acquired on the trip and since the last shipment.

d. The individual organizing a trip would pay for CW-

1 and his driver's travel to the trip location and would cover
expenses while the trip was in progress, whether through
reimbursement on return from the trip or wire transfers while the
trip was in progress.

e. Among other people, CW-1 went on trips organized by

GERARD VASQUEZ, a/k/a "Gera" and WILKIN DE LOS SANTOS, a/k/a "Sep
550," the defendants.

Information from Commercial Carriers

12. Based on my involvement in this investigation, my review

of information provided by a commercial shipper ("Shipper-1"), and
conversations with representatives of Shipper-1, I have learned,
among other things, the following:

a. In or about December 2014, a Shipper-1 employee

observed two notable patterns in certain packages it was
processing:

i. The first pattern ("Shipping Pattern-1") had

the following characteristics: (i) the packages were shipped with
a check, cash, or credit card payment method, indicating that the
shipper did not hold an account with Shipper-1, (ii) the packages
were shipped at an express domestic rate, (iii) the packages were
shipped to specific Shipper-1 stores or desk locations (rather
th~m o.ctuo.l bu~in~~~ Q;r; h<Jm~ Qdd.i;e~rne~) , (.iv) the~e 5hipper-l

6
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 7 of 17

stores were the same two locations, one in Bronx, New York, and
the other in Mount Vernon, New York, (v) the packages were almost
always shipped from states other than New York, (vi) however, the
packages carried return addresses located in New York State.

ii. The second pattern ("Shipping Pattern-2") had

the following characteristics: (i) the packages were shipped with
a check, cash, or credit card payment method, indicating that the
shipper did not hold an account with Shipper-1, (ii) the packages
were shipped at an express domestic rate, (iii) the packages were
shipped from the same Bronx and Mount Vernon Shipper-1 store
locations to Shipper-1 store or desk locations in other states.

iii. As Shipper-1 began tracking Shipping Pattern-

1 and Shipping Pattern-2, Shipper-1 began to notice common trends
in the recipients and shippers of the packages falling within the
Patterns.

b. Between in or about 2014 and in or about July 2017,

Shipper-1 identified numerous packages that fit within the
parameters of Shipping Pattern-1. Of these, consistent with its
terms and conditions of service, Shipper-1 opened 39 packages.
Each of these packages contained electronic devices. Based on
information provided by telephone providers and electronics
manufacturers~ upon searching records associated with the IMEI
numbers of the electronic devices encountered, I have learned that
all of the electronic devices contained in the packages opened by
Shipper-1 were classified as having been obtained through
fraudulent activity. Specifically, the packages opened included:

i. Sixteen packages addressed to GARY BIERD,

a/k/a "V.O.," the defendant. These sixteen packages contained a
total of approximately 178 electronic devices acquired through
fraudulent means.

ii. Five packages addressed to WILKIN DE LOS

SANTOS, a/k/a "Sep 550," the defendant. These five packages
contained a total of approximately 55 electronic devices acquired
through fraudulent means.

iii. Two packages addressed to DAUBRIEL DISLA,

a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a
"Michael Martinez," the defendant. These two packages contained
a total of approximately 20 electronic devices acquired through
fraudulent means.

c. Between in or about 2014 and in or about July 2017,

Bhipper-1 identified nume~ou~ p~~kages that fit within the

7
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 8 of 17

parameters of Shipping Pattern-2. Of these, consistent with its

terms and conditions of service, Shipper-1 opened 4 packages. Each
of these packages contained fraudulent credit cards, driver's
licenses, and other forms of ID. Specifically, the packages
opened included:

i. Two packages shipped by DISLA. 2 These two

packages contained approximately 14 fraudulent credit cards and
approximately 14 fraudulent driver's licenses.

ii. One package shipped by GERALD VASQUEZ, a/k/a

"Gera," the defendant. This package contained approximately 10
fraudulent Credit cards and 10 fraudulent passport cards.

iii. One package shipped by JOSE VARGAS a/k/a

"Jeffre Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito," the
defendant. 3 This package contained approximately 10 fraudulent
credit cards and 10 fraudulent driver's licenses.

d. In total, between October 2014 and the present, the

defendants have used Shipper-1 to ship and receive numerous
packages. For example:

i. GERALD VASQUEZ, a/k/a "Gera," the defendant,

was listed as the recipient of approximately 169 packages and the
shipper of approximately 8 packages.

ii. BIERD was listed as the recipient of

approximately 196 packages and the shipper of approximately 47
packages. DE LOS SANTOS shipped at least 21 of the approximately
196 packaqes received by BIERD.

iii. IRVIN CASTILLO, a/k/a "Mune,", the defendant,

was listed as the recipient of approximately 168 packages.

2 These packages were sent by individuals named "Michael Martinez"

and "Jason Rodriguez." Based on my review of surveillance video
and images provided by Shipper-1 and known photographs of DISLA,
I have identified "Michael Martinez" and "Jason Rodriguez" to be
DISLA.
3 This package was sent by an indi victual named "Melvin Perez."
Based on my review of surveillance video and images provided by
Shipper-1 and known photographs of VARGAS, I have identified
"Melvin Perez" to be Vl".RGl:i.S,

8
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 9 of 17

lV. DISLA was listed as the recipient of

approximately 76 packages and the shipper of approximately 49
packages. 4

v. DE LOS SANTOS was listed as the recipient of

approximately 23 packages and the shipper of approximately 41
packages.

vi. JOSE VARGAS, a/k/a "Jeff re Pizzarro," a/k/a

"Melvin Perez," a/k/a "Pejecito," was listed as the recipient of
approximately 39 packages and the shipper of approximately 250
packages.

Information from Cellular Providers

13. Based on my involvement in this investigation and

conversations with cellular providers, I have learned that in the
early period that the Fraud Ring was active, members of the Fraud
Ring would hack into the cellphone accounts of victims and add the
names of Fraud Ring members as "authorized users" on the accounts.
These "authorized users" would be able to use their own names and
the victim account information to fraudulently obtain new
electronic devices. Later, the Fraud Ring changed practices and
began adding the stolen PII of innocent third parties as users on
cellphone accounts. Fraud Ring participants then started
utilizing fake credit, debit, and ID cards to masquerade as these
third-parties and acquire cellular phones. See, e.g., infra~ 17.

14. Based on information provided by a cellular provider

("Provider-1"), I have learned the following:

a. From on or about October 18, 2013 through on or

about May 29, 2015, GERALD VASQUEZ, a/k/a "Gera," the defendant,
was added as an authorized user on approximately 434 accounts.
VASQUEZ's addition to these accounts resulted in the acquisition
of at least 137 electronic devices that Provider-1 has identified
were acquired . through fraudulent means. The purchase of an
additional 98 devices were attempted on these accounts, but these
purchases were prevented due to fraud alerts.

b. From on or about May 8, 2014 through on or about

August 8, 2014, GARY BIERD, a/k/a "V.O.," the defendant, was adde.d
as an authorized user on approximately 23 accounts. BIERD' s

4Several of these packages were shipped under the names "Jason

Rodriguez" and "Michael Martinez," which, as previously discussed,
have been identified ao poeudonymo of D~SLA, aee oupra n.2,

9
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 10 of 17

addition to these accounts resulted in the acquisition of at least

32 electronic devices that Provider-1 has identified were acquired
through fraudulent means.

c. From in or about March 2014 through in or about

December 2016, DAUBRIEL DISLA, a/k/a "Felipe Disla," a/k/a "Mate,"
a/k/a "Jason Rodriguez," a/k/a "Michael Martinez," the defendant,
was added as an authorized user on approximately 10 accounts.
DISLA's addition to these accounts resulted in the acquisition of
at least 32 electronic devices that Provider-1 has identified were
acquired through fraudulent means.

d. From on or about July 22, 2014 through on or about

September 16, 2016, WILKIN DE LOS SANTOS, a/k/a "Sep 550," the
defendant, was added as an authorized user on approximately 5
accounts. DE LOS SANTOS's addition to these accounts resulted in
the acquisition of at least 2 electronic devices that Provider-1
has identified were acquired through fraudulent means.

15. Based on information provided by a cellular provider

("Provider-2"), I have learned the following:

a. From on or about March 12, 2014 through on or about

November 7, 2014, GERALD VASQUEZ, a/k/a "Gera," the defendant, was
added as an authorized user on 55 accounts. VASQUEZ's addition to
these accounts resulted in the acquisition of at least 10
electronic devices that Provider-2 has identified were acquired
through fraudulent means.

b. From on or about January 6, 2014 through on or about

March 27, 2014, GARY BIERD, a/k/a "V.O.," the defendant, was added
as an authorized user on 16 accounts. BIERD's addition to these
accounts resulted in the acquisition of at least 33 electronic
devices that Provider-2 has identified were acquired through
fraudulent means.

c. From on or about October 20, 2014 through on or

about January 12, 2015, WILKIN DE LOS SANTOS, a/k/a "Sep 550," the
defendant, was added as an authorized user on 46 accounts. DE LOS
SANTOS's addition to these accounts resulted in the acquisition of
at least 36 electronic devices that Provider-2 has identified were
acquired through fraudulent means.

Searches of Shipments

16. Based on my involvement in this investigation and review

of records provided by Shipper-1 and Provider-1, I have learned
the following:

10
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 11 of 17

a. On or about February 15, 2016, law enforcement

executed a search of a package shipped by Shipper-1 pursuant to a
court-ordered search warrant (the "First Searched Package") .

b. The First Searched Package was shipped from WILKIN

DE LOS SANTOS, a/k/a "Sep 550," the defendant, to GARY BIERD, a/k/a
"V.O.," the defendant. The package was shipped from Las Vegas,
Nevada, to Mount Vernon, New York.

c. The First Searched Package contained 16 iPhories.

Based on searches run for the IMEI numbers of these 16 iPhones, I
have learned that the iPhones were obtained as a result of fraud
suffered by four different accounts maintained by Provider-1.
Fifteen of these iPhones were acquired in Las Vegas, Nevada, and
one was acquired in Mesa, Arizona.

d. Based on my review of surveillance images provided

by Shipper-1 and a comparison against known photographs of BIERD,
I have learned that BIERD picked up the First Searched Package at
the Shipper-1 destination facility in Mount Vernon, New York.

17. Based on my involvement in this investigation and review

of records provided by Shipper-1 and Provider-1, I have learned
the following:

a. On or about February 7, 2017, law enforcement

executed a search of a package shipped by Shipper-1 pursuant to a
court-ordered search warrant (the "Second Searched Package") .

b. The Second Searched Package was shipped from WILKIN

DE LOS SANTOS, a/k/a "Sep 550", the defendant, to 'DAUBRIEL DISLA,
a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez," a/k/a
"Michael Martinez," the defendant. The package was shipped from
Fullerton, California, to New York, New York.

c. The Second Searched Package contained 10 iPhones.

Based on searches run for the IMEI numbers of these 10 iPhones, I
have learned that the iPhones were obtained as a result of fraud
suffered by an account maintained by Provider-1. Specifically,
based on information provided by Provider-1, I have learned that:

i. All 10 iPhones were acquired on the same

Provider-1 account ( "Account-1") . An individual with a San
Francisco, California, home address was listed as the primary
contact on Account-1.

ii. On or about January 29, 2017, an individual

with an address in the Bronx ("Bronx-Based Individual") was added

11
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 12 of 17

as an authorized user to Account-1. Between February 1, 2017 and

February 2, 2017, an individual claiming the identity of the Bronx-
Based Individual and using Account-1 acquired all 10 phones that
DE LOS SANTOS shipped to DISLA in the Second Searched Package.
All of these phones had been acquired at t
retail locations in
Southern California.

iii. Between January 29, 2017 and February 6, 2017,

the Bronx-Based Indi victual was added as an aut(1orized user on
multiple additional Provider-1 accounts resulting in the
fraudulent acquisition of more than $25,000 worth of electronic
devices.

iv. Based on my review of a law enforcement

database compiling publicly available information, I have learned
that no one by the name of the Bronx-Based Individual resided at
the address associated with that individual on Account-1 during
the relevant time period. Accordingly, I believe that the Bronx-
Based Individual was a pseudonym used by a Fraud Ring participant
employing fraudulent ID and bank cards to acquire phones on
Account-1 and other Provider-1 accounts.

d. Based on surveillance conducted by myself and other

law enforcement officers, I have learned that DISLA picked up the
Second Searched Package from the Shipper-1 destination facility in
New York.

18. Based on my involvement in this investigation and review

of records provided by Shipper-1 and Provider-2, I have learned
the following:

a. On or about February 7, 2019, law enforcement

executed a search of a package shipped by Shipper-1 pursuant to a
court-ordered search warrant (the "Third Searched Package") .

b. The Third Searched Package was shipped from an

individual who, based on my involvement in this investigation I
know to be a Fraud Ring participant ("CC-1"), to GERALD VASQUEZ,
a/k/a "Gera," the defendant. The package was shipped from Austin,
Texas, to Fort Lee, New Jersey.

c. The Third Searched Package contained 1 7 iPhones.

Based on searches run for the IMEI numbers of these 17 iPhones, I
have learned that the iPhones were obtained as· a result of fraud
suffered by six accounts maintained by Provider-2.

d. Based on my review of surveillance footage and

images produced by Shipper-lr I have learned that VASQUEZ pi~k~ct

12
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 13 of 17

up the Third Searched Package from the Shipper-1 destination

facility in New Jersey.

Search of Vasquez's Cellular Phone

19. Based on my involvement in this investigation, I have

learned that, in or about June 2016, law enforcement officers
obtained a cellular phone belonging to GERALD VASQUEZ, a/k/a
"Gera," the defendant (the "Vasquez Phone") . The Vasquez Phone
was obtained incident to VASQUEZ's arrest on unrelated charges.
Law enforcement officers subsequently obtained a search warrant
for the Vasquez Phone.

20. Based on my review of the Vasquez Phone and conversations

with other law enforcement officers who have reviewed the Vasquez
Phone, I have learned the following:

a. The Vasquez Phone includes large quantities of PII

of third parties, including:

i. On or about· January 1, 2016, the Vasquez Phone

received 12 messages from an individual who, based on my
involvement in this investigation and review of the Vasquez Phone,
I know to be a member of the Fraud Ring. These messages included
login information related to 89 cellular phone accounts maintained
by Provider-1. Based on information provided by Provider-1, I
have learned that these accounts were utilized to fraudulently
acquire electronic devices.

ii. In or about 2016, the Vasquez Phone sent 16

messages containing the PII of 180 cellular phone accounts to a
phone number (the "Vargas Phone") later associated with JOSE VARGAS
a/k/a "Jeffre Pizarro," a/k/a "Melvin Perez," a/k/a "Pejecito,"
the defendant. 5 Specifically, these messages included the names,

5 VARGAS was identified as the user of the Vargas Phone based on

running searches of this phone number against a database maintained
by Shipper-1. Based on information obtained from this Shipper-1
database, law enforcement agents identified that the Vargas Phone
was used both to communicate with VASQUEZ and to ship and receive
packages under the name "Melvin Perez." Furthermore, based on
information obtained by a money transmitter service, law
enforcement established that the Vargas Phone was associated with
wire transfers conducted by "Jeffre Pizarro," an individual with
a Pennsylvania driver's license. Based on a review of surveillance
videos and photographs prov.lded by ~h.lpper-1, law enforcement

13
,. Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 14 of 17

addresses, social security numbers, and dates of birth of third

parties (the "Vasquez-Vargas PII"). As is set forth above, see
supra <JI 12 ( c) (iii), a packages sent by VARGAS and opened by
Shipper-1 contained fraudulent bank cards and identification
cards. Based on my training, experience, and involvement in this
investigation, I believe that VARGAS was involved in manufacturing
these fraudulent bank and ID cards for VASQUEZ and other members
of the Fraud Ring.

lll. Based on information provided by Provider-1,

I have learned that the accounts associated with the Vasquez-
Vargas PII were used to fraudulently obtain approximately 1,218
iPhones valued at approximately $620,000.

b. The Vasquez Phone included other photographs

demonstrating VASQUEZ and other Fraud Ring participants'
involvement in the Fraud Ring, including:

i. The Vasquez Phone contained a photograph of a

February 25, 2016, receipt in the name of a victim of identity
theft ("Victim-1") . According to this receipt, at least four new
iPhones were purchased under Victim-l's name. Three of these four
iPhones had assigned phone numbers with area codes belonging to
the Lexington, Kentucky region. Also on the Vasquez Phone was a
picture of a Kentucky driver's license in the name of Victim-1.
However, rather than bearing a picture of Victim-1, this driver's
license had a picture of an individual who, based on my involvement
in this investigation, I know to be a Fraud Ring member and
resident of the New York City area.

ii. The Vasquez Phone included photographs of

receipts from money transmitter services, showing that VASQUEZ had
wired money to Fraud Ring participants located in various areas of
the country.

iii. The Vasquez Phone included photographs of

driver's licenses and other forms of ID for a number of states;
however, the individuals' whose pictures were included in these ID
devices do not match the individual whose information is included.
These were individuals who, based on my involvement in this
investigation, I know to be participants in the Fraud Ring and
residents of the New York City area.

officers were able to establish that "Melvin Perez" is the same

individµal c;i..;> "J~ff.i:;-e Fi;;:;~;i;;i;;o" o.nd V.A.RG.A.S, Bee oupra n.3.

14
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 15 of 17

iv. The Vasquez Phone included photographs of bank

cards in the names of individuals whose identities were stolen.

Search of Castillo's Devices

21. Based on my involvement in this investigation, I have

learned that in or about July 2017, law enforcement officers
obtained electronic devices belonging to IRVIN CASTILLO, a/k/a
"Mune," the defendant. These devices were obtained incident to an
unrelated arrest. These devices included a laptop computer (the
"Castillo Laptop") and a cellular phone (the "Castillo Phone").
Law enforcement officers subsequently obtained search warrants for
the Castillo Phone and the Castillo Laptop.

22. Based on my review of the Castillo Laptop and

conversations with other law enforcement officers who have
reviewed the Castillo Laptop, I have learned the following:

a. The user(s) of the Castillo Laptop .utilize the Tor

Browser ("Tor") and virtual private networks ("VPNs"). Based on
my training and experience, I know that Tor and VPNs are computer
and inte.rnet services used by individuals who hope to maintain
anonymity in their online traffic and activities.

b. Provider-l's website is one of the websites most

often visited by the user(s) of the Castillo Laptop.

c. Although the Castillo LaP.top retained little search

history, the Castillo Laptop did preserve several "cookies,"
cache, and temporary internet files saved in browsers, from past
website visits. Based on my training and experience, I know that
"cookies," cache, and temporary internet files saved in browsers
are a terms for a small piece of data that is saved on a computer
after visiting a particular website, which allows a .website or
company to determine, among other things, which computer or browser
visited the website, and how many different accounts have been
accessing a given website from the same device and web browser.

d. Based on a review of the Castillo Laptop cookies,

cache, and temporary internet ·files, I have learned that the
user(s) of the Castillo Laptop ran repeated queries for a number
of accounts associated with an email host ("Email Host-1"). One
of these accounts utilized the name of a particular individual
("Victim-2" and the email account being "Victim-2 Email Account").

23. Based on my conversations with representatives of

Provider-1 and review of documents produced by Provider-1, I have
learned the following:

15
 Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 16 of 17

a. Provider-1 searched its system for the Victim-2

Email. A search of the system revealed that Victim-2 has an
account with Provider-1. This search al so revealed that on or
about May 27, 2017, a user utilizing a particular.IP Address ("IP
Address-1"), logged on to Victim-2's account and added the Victim-
2 Email to the account. Previously, Victim-2's account was linked
to an email operated by a different email host ("Email Host-2").
Based on my training and experience, I understand that members of
the Fraud Ring added the Victim-2 Email, hosted by Email Host-1,
to Victim-2's account so that the Fraud Ring would have access to,
and receive updates regarding, Victim-2' s account. Following,
this alteration, Victim-2's account suffered fraud, with multiple
cellular phones being fraudulently obtained on the account.

b. Provider-1 searched its system for other accounts

that had been accessed by IP Address-1. This search revealed
fifty-three cellular phone accounts, hosted by Provider-1, that
had been accessed by a user utilizing IP Address-1. Many of these
accounts also had email addresses hosted by Email Host-1. Based
on my training and experience, I know that Email Host-1 is an
infrequently used email provider. Furthermore, 52 of these 53
accounts were utilized to fraudulently acquire at least
approximately 383 electronic devices valued at approximately
$360,000.

c. The only account accessed by a user utilizing IP

Address-1 was the account in the name of IRVIN CASTILLO, a/k/a
"Mune," the defendant. One of the phone numbers serviced by
Provider-1 on Castillo's behalf carries a 929 area code (the
"Castillo Phone Number") .

24. Based on information obtained from an online service

provider ("Provider-3") I have learned that IP Address-1 is
serviced by Provider-3 and is associated with an individual
("Individual-1") with a New Jersey address. Based on my
involvement in this investigation, I have learned that law
enforcement officers have been unable to identify a real person
with the name and address claimed by Individual-1.

25. Based on information provided by Provider-3, I have

learned that the account associated with IP Address-1 lists the
Castillo Phone Number as one of the two phone numbers of record.

26. Based on my review of the Castillo Phone, which is the

device assigned the Castillo Phone Number, I have learned that the
Castillo Phone includes a picture of a Provider-3 bill addressed
to Individual-1 for the billing period of March 2017.·

16
., '
I '\ Case 1:19-cr-00391-AT Document 1 Filed 04/26/19 Page 17 of 17

27. Based on the foregoing, I believe that Individual-1 is

a false identity utilized by IRVIN CASTILLO, a/k/a "Mune," the
defendant to cloak the fact that he is the subscriber of IP
Address-1 and uses that account to hack into and alter telephone
accounts in furtherance of the Fraud Ring.

28. Based on my review of the Castillo Phone, I have learned

that the phone includes a note listing fourteen different sets of
PII and account information ("Castillo PII Note"). Some of these
sets include a username, password, activated phone numbers, home
addresses, social security numbers, and email address associated
with an account and/or individual.

29. Based on information provided by Provider-2, I have

learned that the individuals and account listed in the Castillo
PII Note have been victims of the ,Fraud Ring, with their accounts
being used to fraudulently obtain at least approximately 114
electronic devices valued at approximately $103,000.

WHEREFORE, the deponent respectfully requests that

warrants be issued for the arrests of GERALD VASQUEZ, a/k/a "Gera,"
GARY BIERD, a/k/a "V.O.," IRVIN CASTILLO, a/k/a "Mune," DAUBRIEL
DISLA a/k/a "Felipe Disla," a/k/a "Mate," a/k/a "Jason Rodriguez,"
a/k/a "Michael Martinez," WILKIN DE LOS SANTOS, a/k/a "Sep 550,"
and JOSE VARGAS a/k/a "Jeff re Pizarro," a/k/a "Melvin Perez," a/k/a
"Pejecito," the defendants, and that they be arrested and
imprisoned, or bailed, as the case may be.

ARMANDO COUTINHO
Detective
New York City Police Department

17