eBay scammer steals identity of special agent investigating him

He might get 20 years to boast about that one


A cybercriminal who ran a mere eBay scam became a more significant collar for the US Department of Justice after he successfully stole the identity of the special agent investigating him.

Rohit Jawa, 25, has pleaded guilty to eight counts of wire fraud, and one count of stealing a special agent's identity which he then used to fraudulently gain access to privileged law enforcement databases – from which he stole the personal identifying information of multiple victims.

According to court documents, Jawa's mischief began in January 2013. He controlled "a set of at least 19 eBay and 18 PayPal accounts ... engaged in a scheme to defraud eBay buyers and eBay's third-party parcel insurance company".

Investigating these fraudulent accounts, agents from the United States Postal Service's Office of the Inspector General (USPS OIG) obtained search warrants to dig into the email addresses. These were hosted by 1&!1 Mail and Media, a provider which lets users register multiple addresses under a single account.

The agents found "numerous conversations where buyers reported to the seller that they had not received a purchased item, despite Postal Service tracking history showing the item had been delivered."

In the case of insured parcels, the seller would file a claim with eBay's third-party insurance company, using the tracking history as evidence the Postal Service had lost the parcel – or it had been stolen. For uninsured parcels, the seller would use the tracking history to prove to eBay he had shipped the purchased item to the buyer, causing eBay to decide disputes in his favour.

Other messages in those accounts contained Postal Service tracking numbers for parcels the seller had sent, supposedly using eBay-generated Postal Service shipping labels, but which the buyer claimed to have never received despite Postal Service tracking history showing the parcel had been delivered.

As customers on eBay/PayPal are only provided with the five-digit ZIP code of where a package was delivered, if a shipping label address is changed to a different address within the same ZIP code, this creates a tracking history that makes it appear as if the Postal Service has delivered the package to the expected destination, rather than an unrelated address within that local area.

Agents found irregularities comparing the destination addresses eBay provided to the Postal Service, with the addresses on the labels as seen by the Postal Service's mail processing equipment.

"A seller can then use this legitimate-looking tracking history to convince eBay, a buyer, or an insurance company that he sent the purchased item to the buyer, when he actually mailed an empty box to a random address in the same ZIP code to generate tracking history," the agents said.

Special Agent John Watson stated in his affidavit in support of the criminal complaint, that in his "training and experience, this kind of manipulation of a shipping label is a strong indication of fraud."

OpSec 101

Identity theft

A victim of this fraud scheme complained to the Postal Service about his missing parcel. His complaint eventually reached a USPS OIG special agent, who began looking into it as an incident of mail theft by a Postal Service employee.

Corresponding with the seller via one of the 1&1 email addresses, the agent requested additional information about the missing parcel – doing so quite explicitly as a special agent, not suspecting any criminality on the part of the seller.

Jawa, the seller, then requested the agent provide him with a copy of his credentials as verification of his identity, which the OIG agent did.

Two days later after receiving this information, the FBI received a request using the special agent's identity with a secondary email address registered to 1&1.

This was for an account with Law Enforcement Online, a web portal which provides access to criminal intelligence and other highly privileged information for law enforcement officials. A day later, someone purporting to be the special agent phoned FBI tech support and successfully obtained a temporary username and password for that account.

Using the @leo.gov email which came with the LEO account, Jawa then corresponded with several police forces requesting accounts be made for him on their internal services. Although he was only successful in one instance, he then exploited this access to obtain sensitive personal information on at least nine people, including the special agent.

These nine subsequently had fraudulent eBay, PayPal, and other financial accounts opened using their identities.

Jawa, who is an Indian national, was indicted by a federal grand jury on 13 August 2015. He faces a mandatory minimum of two years in prison and a maximum penalty of 20 years. He will be sentenced on 12 February 2016. ®

Narrower topics


Other stories you might like

  • GPL legal battle: Vizio told by judge it will have to answer breach-of-contract claims
    Fine-print crucially deemed contractual agreement as well as copyright license in smartTV source-code case

    The Software Freedom Conservancy (SFC) has won a significant legal victory in its ongoing effort to force Vizio to publish the source code of its SmartCast TV software, which is said to contain GPLv2 and LGPLv2.1 copyleft-licensed components.

    SFC sued Vizio, claiming it was in breach of contract by failing to obey the terms of the GPLv2 and LGPLv2.1 licenses that require source code to be made public when certain conditions are met, and sought declaratory relief on behalf of Vizio TV owners. SFC wanted its breach-of-contract arguments to be heard by the Orange County Superior Court in California, though Vizio kicked the matter up to the district court level in central California where it hoped to avoid the contract issue and defend its corner using just federal copyright law.

    On Friday, Federal District Judge Josephine Staton sided with SFC and granted its motion to send its lawsuit back to superior court. To do so, Judge Staton had to decide whether or not the federal Copyright Act preempted the SFC's breach-of-contract allegations; in the end, she decided it didn't.

    Continue reading
  • US brings first-of-its-kind criminal charges of Bitcoin-based sanctions-busting
    Citizen allegedly moved $10m-plus in BTC into banned nation

    US prosecutors have accused an American citizen of illegally funneling more than $10 million in Bitcoin into an economically sanctioned country.

    It's said the resulting criminal charges of sanctions busting through the use of cryptocurrency are the first of their kind to be brought in the US.

    Under the United States' International Emergency Economic Powers Act (IEEA), it is illegal for a citizen or institution within the US to transfer funds, directly or indirectly, to a sanctioned country, such as Iran, Cuba, North Korea, or Russia. If there is evidence the IEEA was willfully violated, a criminal case should follow. If an individual or financial exchange was unwittingly involved in evading sanctions, they may be subject to civil action. 

    Continue reading
  • Meta hires network chip guru from Intel: What does this mean for future silicon?
    Why be a customer when you can develop your own custom semiconductors

    Analysis Here's something that should raise eyebrows in the datacenter world: Facebook parent company Meta has hired a veteran networking chip engineer from Intel to lead silicon design efforts in the internet giant's infrastructure hardware engineering group.

    Jon Dama started as director of silicon in May for Meta's infrastructure hardware group, a role that has him "responsible for several design teams innovating the datacenter for scale," according to his LinkedIn profile. In a blurb, Dama indicated that a team is already in place at Meta, and he hopes to "scale the next several doublings of data processing" with them.

    Though we couldn't confirm it, we think it's likely that Dama is reporting to Alexis Bjorlin, Meta's vice president of infrastructure hardware who previously worked with Dama when she was general manager of Intel's Connectivity group before serving a two-year stint at Broadcom.

    Continue reading

Biting the hand that feeds IT © 1998–2022