Feeds

Romanian phisher gets 50 month prison term

No credit for good grammar

High performance access to file storage

A Romanian man has been sentenced to serve more than four years in US prison for taking part in a sophisticated phishing scam that cost financial institutions at least $150,000.

Ovidiu-Ionut Nicola-Roman, 23, of Craiova, Romania, received 50 months in federal prison, followed by three years of supervised release. In July, he pleaded guilty to a single felony count of conspiracy to commit fraud. He's the first foreign defendant to be convicted in the US for phishing offenses, as federal prosecutors were quick to point out in a sentencing memorandum to the judge hearing the case.

"The Court is therefore presented with a unique opportunity, to demonstrate that criminals overseas cannot conduct their phishing schemes with impunity, by imposing a Guidelines sentence on the defendant," they wrote.

An indictment filed in January 2008 accused Nicola-Roman and six other Romanians of running a well-organized operation that used a combination of social engineering and computer hacking to dupe recipients into divulging payment card numbers and other sensitive information. The suspects then withdrew money from the customers' bank accounts or made purchases using their debit cards, prosecutors allege.

In one episode, the defendants sent an email purporting to come from the Brattleboro Savings & Loan Ass'n that informed customers their online accounts were temporarily unavailable while administrators upgraded the bank's website. To give the claim credibility, the gang made the site inaccessible by unleashing a denial-of-service attack on it.

The email was notable because it contained good English usage and grammar, unlike many phishing come-ons. It went on to say accounts would be automatically deleted unless customers accessed a secure online database and confirmed their account details.

Other financial institutions targeted by the attackers included PayPal, Capital One, Citibank, JPMorgan Chase, Comerica Bank, LaSalle Bank, US Bank, Wells Fargo, and People's Bank.

The gang stored the stolen social security numbers, bank account numbers, and other financial information using shared email accounts from Yahoo and Gmail. They then used the purloined information to access bank accounts and lines of credit to withdraw funds without authorization.

Nicola-Roman was located in Bulgaria and apprehended on an Interpol warrant in June 2007. He was extradited to the US the following November. The remaining suspects have yet to be apprehended. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.