Romanian National Sentenced for Possessing Unauthorized Credit Card Numbers, Identity Theft

A 23-year-old Romanian national was sentenced today in federal court for possessing unauthorized credit card numbers in connection with an Internet “phishing” scheme to collect personal information of individuals and sell it.

On May 26 in Minneapolis, United States District Court Judge John Tunheim sentenced Sergiu Daniel Popa to 102 months in prison and three years of supervised release on one count of possession of 15 or more unauthorized access devices and one count of aggravated identity theft. Popa was indicted on June 19, 2007, and pleaded guilty on Oct. 6. Popa was extradited to the U.S. from Spain in June.

“Because there were so many victims who were hurt badly, the court believes the sentence is appropriate in order to protect the public,” Judge Tunheim said. “There needs to be a deterrent to others who are trying similar crimes over the Internet.”

According to Popa’s plea agreement, from June 2000 through February 2007 Popa resided in New York and Michigan, and maintained two e-mail accounts for the purpose of harvesting, via the phishing scheme, personal identification and financial information, such as names, addresses, bank account numbers, credit card numbers, Social Security account numbers and other personal identification numbers of thousands of individuals, including some Minnesota residents.

In Popa’s scheme, he created fraudulent e-mails and fraudulent Web sites to appear as if they were authorized by legitimate entities. Those victims who received his e-mails and went to his Web sites were tricked into providing their personal identification and financial information, believing that a legitimate institution had requested the information.

Popa admitted that from May 2004 to February 2007, he possessed tens of thousands of email addresses collected from various Internet sources, which he collected for the purpose of sending phishing e-mails that would direct the recipient to phishing Web sites to enter their personal identification and financial information.

Popa further admitted that on several occasions, including in February and November 2004 and in January 2005, Popa offered by e-mail to sell stolen personal identification information. During an executed search warrant at Popa’s residence, the Federal Bureau of Investigation recovered a machine for imprinting graphics on blank white cards, foil ribbons for making the holographics that appear on identification cards and credit cards, as well as blank plastic cards and partially created false drivers’ license and credit cards.

Specifically, Popa admitted that on Jan. 2, 2007, he knowingly possessed with intent to defraud, names, credit card numbers and personal identification numbers for approximately 21 individuals, including Minnesota residents. Popa also admitted that on Jan. 2, 2007, he committed aggravated identity theft by knowingly possessing without lawful authority a means of identification of another person, namely the names, credit card numbers and personal identification numbers for the 21 individuals, during and in relation to other violations of federal law.

Popa acknowledged in his plea agreement that more than 7,000 individual victims suffered actual losses totaling approximately $700,000 as a result of identity theft crimes perpetrated by him.

According to a FBI affidavit, the agency began investigating Popa’s phishing scheme in January 2005. The FBI executed a number of search warrants directed to Internet Service Providers hosting e-mail accounts, and agents found Popa’s two accounts, along with other evidence that Popa was behind the phishing scheme.

The affidavit cites an e-mail dated Jan. 16, 2005, sent from one of Popa’s e-mail accounts, that had credit card information for about 5,889 victims, 96 of which were from Minnesota, including 34 from Hennepin County.

This case was the result of an investigation by the FBI, and was prosecuted by Assistant U.S. Attorney Nicole A. Engisch.