I, Gary L. Neff, Jr., having been duly sworn, do hereby depose and state:

Transcription

1 Case 2:13-cr HCM-TEM Document 5 Filed 09/19/13 Page 1 of 6 PageID# 12 REDACTED AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT \l{rsl -W JoO I, Gary L. Neff, Jr., having been duly sworn, do hereby depose and state: 1) I am a Postal Inspector with the United States Postal Inspection Service (USPIS) and have been so employed since April I am currently assigned to the Charlotte Division, Norfolk Domicile, and I am responsible for the investigation of various crimes relating to the United States Mail. I have completed a twelve-week federal law enforcement basic training course in Potomac, Maryland. 2) During my employment as a federal law enforcement officer, I have personally conducted or participated in several fraud and identity-theft related investigations. During the course of those investigations, I have conducted numerous interviews of suspects, witnesses, and victims. Based on my training and experience, I am familiar with methods that individuals utilize to commit fraud and identity-theft related crimes. 3) As a federal agent, I am authorized to investigate violations of laws of the United States and to execute warrants issued under the authority ofthe United States. 4) This affidavit is submitted in support ofa criminal complaint charging that KATECHA R. THOMAS: (a) did knowingly and with intent to defraud and in a manner affecting interstate commerce, use and attempt to use one or more unauthorized access devices (a credit card in the name of A.A.) during a one-yearperiod and by such conduct obtained, and attempted to obtain, anything of value aggregating $1, or more within that period, in violation of Title 18, United States Code, Sections 1029(a)(2) and 1029(b)(1); and (b) did knowingly possess and use, without lawful authority, a means of identification of another person (A.A.) during and in relation to a felony violation contained in chapter 47 of Title 18, United States Code (namely access device fraud in violation of Title 18, United States Code, Sections 1029(a)(2) and 1029(b)(1)), all in violation of Title 18, United States Code, Sections 1028A(a)(l) and 1028A(c)(4). Because this affidavit is being submitted for the limited purpose of securing a criminal complaint and arrest warrant, I have not included each and every fact known to me concerning this investigation. Background ofinvestigation 5) In July 2012,1 was contacted by a fraud investigator working for Capital One Bank (Capital One), who reported that eight (8) credit card accounts had been fraudulently opened and used to obtain more than $11, The investigator reported that the fraudulently activity started in December The Capital One investigator also reported that twenty-six (26) additional accounts were opened, but were suspended before any fraudulent transactions could be completed. 6) The Capital One investigator provided me with detailed bank and credit card records documenting the activities related to the fraudulent credit card accounts. I

2 Case 2:13-cr HCM-TEM Document 5 Filed 09/19/13 Page 2 of 6 PageID# 13 noted that, by the end of August 2012, approximately eighty-five (85) Capital One applications were submitted via the Internet using two primary addresses, bhi^i^^hhh and ^^Bi^Bi^^^^^B- Numerous applications listed the same phonenumbers(^^^^^^ ^H ^^Hfc and_^^hhh) and mailing addresses ( ^^^^^ ^^ NorfblkTVA ^ andro. Box 41200, Norfolk, VA). 7) According to records obtained from Yahoo!, Inc., "Techa Thomas" is listed as the account owner for ^HI^HI^^HHi- The account was created on April 11, ) According to records obtained from Google, Inc., "Tisha Thomas" is listed as the account owner for ^^HHH^^I- The account was created on October 20, Google records show a Visa credit card (ending in '0185) was associated with this account. The cardholder's name listed for that credit card is KATECHA THOMAS and the phone number associated with the account is 9) According to records obtained from AT&T, the financially liable party for the account pertaining to phone number ^^^^H is KATECHA THOMAS. AT&T records list THOMAS as the account owner since February 22, ) The Post Office Box Application for P.O. Box 41200, dated May 18, 2012, lists KATECHA R. THOMAS as the applicant. THOMAS listed her address as ^^^ HNorfolk, VA ^^, and her phone number as ^^^^^^. To open this P.O. Box, THOMAS also provided two forms of identification; a Virginia State Identification Card and a Virginia Wesleyan College (VWC) Identification Card. 11) The fact that THOMAS used a VWC identification card when opening the P.O. Box described above is also consistent with other information developed during the investigation. For example, records provided by Capital One show that a particular Internet Protocol (IP) address1 was frequently used to access some of the fraudulent credit card accounts identified by Capital One. The IP address in question was ^^^^^^. The American Registry of Internet Numbers (ARIN) lists Virginia Wesleyan College, located at 1584 Wesleyan Drive, Norfolk, VA 23502, as the organization assigned IP address ^^^^^HL 12) On August 16, 2012, I met with the Director of Security for VWC. The Security Director confirmed Thomas was a student at VWC and provided a copy of her student profile, which included her studentpictureand listed her as "Staff." Her profile also listed her current address as ^^^^^^^H, Norfolk, VA ^^, an address associated with several ofthe fraudulent Capital One credit card accounts. 1 Every computer or device on the Internet is referenced by a unique IP address the same way every telephone has a unique telephone number. 2

3 Case 2:13-cr HCM-TEM Document 5 Filed 09/19/13 Page 3 of 6 PageID# 14 13) On August 24, 2012, I provided the Security Director at VWC with a detailed list of all of the names used on the fraudulent credit card applications submitted to Capital One. The Security Director was able to confirm that all ofthe names used were either alumni or current or former VWC students. 14) On September 10, 2012, I was informed by the VWC Human Resource Director that THOMAS worked at VWC as a student worker in the College Advancement Department. In that position, she had unrestricted access to the entire Datatel database containing approximately 381,000 records of current students, past students, and VWC alumni. Approximately 59,000 of these records have personal identifiers attached to them, including social security numbers, dates of birth, and addresses. The VWC Human Resource Director confirmed that all ofthe victims were associated with VWC and their personal information was included in the Datatel database. 15) As a result of my investigation, I have identified approximately 104 fraudulent credit card applications that were submitted to Capital One, American Express, or Discover, which applications made use of one or more of the addresses and telephone numbers identified in paragraphs 6 through 9 above. To date, the attempted losses associated with these accounts total approximately $142,050.00, and the actual losses total approximately $11, A.A. and V.G. 16) On February 14, 2012, a fraudulent Capital One credit card application was submitted via the Internet from VWC IP Address fllhi^b m the name of A.A. This online application used A.A.'s true name, social security number, and date of birth. The application listed amailingaddressofj^^^^^^^hi^i Norfolk, VA BH> and an address ofl^ The home phone number associated with the account is B^^^^^JCapitalOne approved the application and issued a credit card (redacted account # '1847). From February 22, 2012 to March 08, 2012, an individual calling from BHU^I called Capital One regarding the account ending in '1847 thirty (30) times. As a result of the fraudulent transactions conducted with this credit card, Capital One suffered losses of approximately $6, ) On March 26, 2012, a fraudulent Capital One credit card application was submitted via the Internet for V.G. This online application used V.G.'s true name, social security number, and date of birth. The application listed a mailing address of ^^B Norfolk, VA HH- The application also listed an address of and a home phone number of ^^^^^^. Capital One approved the application and issued a credit card (redacted account # '9592). Although attempts were made to use this account, no losses occurred.

4 Case 2:13-cr HCM-TEM Document 5 Filed 09/19/13 Page 4 of 6 PageID# 15 18) On July 31, 2012, a Wells Fargo Financial Crimes Investigator provided surveillance photos of a subject who attempted to use the aforementioned credit cards (ending in '1847 and '9592). On March 7, 2012, the credit card in A.A.'s name and ending in '1847 was used at a Wells Fargo ATM, located at Janaf Shopping Center in Norfolk, VA. The first attempt to withdraw $ was denied at approximately 2:54 PM. Seconds later, a second attempt to use the card to withdraw $ was also denied. On March 31, 2012, the second card in V.G.'s name and ending in '9592 was used at a Wells Fargo ATM located at 21st and Granby Street in Norfolk, VA. At approximately 1:18 PM, an attempt to withdraw $ was denied. Seconds later, a second attempt to withdraw $ was also denied. The subject shown in both sets of the ATM photographs appears to match the physical description of KATECHA THOMAS. At all times pertinent to the events described in this affidavit, Capital One Bank and Wells Fargo Bank were financial institutions doing business in and whose activities affected interstate commerce. 19) On May 13, 2013,1 conducted an interview with A.A.. She stated that she attended VWC from 1999 to She also stated that she did not apply for a Capital One credit card and has not ever authorized anyone to open a credit card account from any financial institution, including Capital One, in her name. M.S. 20) On May 19, 2012, a fraudulent Capital One credit card application was submitted via the Internet for M.S. This application used M.S.'s true name, social security number, and date of birth. The mailing address associated with the application was P.O. Box 41200, Norfolk, VA 23451, and listed a home phone number of HH The address associated with this account was listed as Capital One approved the application and issued a credit card (redacted account # *2478). On June 2, 2012, Capital One mailed the credit card via U.S. Express Mail (EA US) to P.O. Box in Norfolk, VA. As a result of the fraudulent transactions conducted with this credit card, Capital One suffered losses of approximately $3, ) On November 19, 2012,1 conducted an interview with M.S. M.S. stated that she attended VWC from 2006 through M.S. stated that she did not apply for a credit card from Capital One and has never authorized anyone to open a credit card account with Capital One, or any other financial institution, in her name. L.K. 22) On June 28, 2012, a fraudulent Capital One credit card application was submitted via the Internet for L.K. at^^^^^^^^b Virginia Beach, VA fl, with an address of BHHHHIIH This application used L.K.'s true name, social security number, and date ofbirth. Capital One approved the application and

5 Case 2:13-cr HCM-TEM Document 5 Filed 09/19/13 Page 5 of 6 PageID# 16 issued a credit card (redacted account # '8773). On July 3, 2012, Lpecha R. Thomas was added as an authorized user to the account. On July 4, 2012, Prina M. Thomas was also added as an authorized user to the account. Subsequently, two credit cards were mailed via the U.S. Express Mail (EA US, EA US) to ^^H 1 Norfolk,VA^MjOnJuly 24, 2012, theaddress on the account ending in *8773 was changed to H^^^HH, Norfolk, VA ^B- An additional request for a new credit card was made on July 25, Capital One also fiilfille^hisrequesmidmailed a credit card via U.S. Express Mail (EA US) to ^ Norfolk, VAj^H- From July 27, 2012 to August 6, 2012, an individual calling from flflh Hfcalled Capital One regarding this account (card ending in '8773) thirteen (13) times. As a result offraudulent transactions conducted with this credit card account, Capital One suffered losses ofapproximately $ ) On June 26, 2013,1 conducted an interview with L.K. L.K. stated that she was a student at VWC from 2008 to L.K. stated that she has never applied for a Capital One creditcard and has not authorized anyone to open a credit card account with any financial institution in her name. L.K. also stated that she has never authorized anyone to use any credit card in her name.

6 Case 2:13-cr HCM-TEM Document 5 Filed 09/19/13 Page 6 of 6 PageID# 17 Conclusion 24) Based on the foregoing, I submit that probable cause exists to believe that KATECHA R. THOMAS: (a) did knowingly and with intent to defraud and in a manner affecting interstate commerce, use and attempt to use one or more unauthorized access devices (a credit card in the name of A.A.) during a one-year period and by such conduct obtained, and attempted to obtain, anything of value aggregating $1, or more within that period, in violation of Title 18, United States Code, Sections 1029(a)(2) and 1029(b)(1); and (b) did knowingly possess and use, without lawful authority, a means of identification of another person (A.A.) during and in relation to a felony violation contained in chapter 47 of Title 18, United States Code (namely access device fraud in violation of Title 18, United States Code, Sections 1029(a)(2) and 1029(b)(1)), all in violation of Title 18, United States Code, Sections 1028A(a)(l) and 1028A(c)(4). Accordingly, I further request the issuance of a warrantfor her arrest. REDACTED COPY GaryL.NeffJr. Postal Inspector VA. Swornand subscribed to before me this day of September 2013 of Norfolk, REDACTED COPY UNITED STATE MAGISTRATE JUDGE Seen and Reviewed: REDACTED COPY Robert J. Krask Assistant United States Attorney