Delaware Resident Sentenced in Manhattan Federal Court to Six Years in Prison for Trafficking in Stolen Identification Information for Over 100,000 Online Accounts

Preet Bharara, the United States Attorney for the Southern District of New York, announced that Justin Mills was sentenced today in Manhattan federal court to six years in prison for trafficking in tens of thousands of access devices, including stolen credit card numbers and stolen login information for online accounts at Paypal and other financial websites. Mills pled guilty on January 3, 2013, and was sentenced today by U.S. District Judge P. Kevin Castel.

Manhattan U.S. Attorney Preet Bharara said, “With his sentence today, Justin Mills joins the growing ranks of cybercriminals to be punished for abusing the Internet to access and exploit people’s personal financial information. Together with our law enforcement partners, including the extraordinary efforts of the FBI, this office continues its work to disrupt the networks that incubate the expanding cyber threat.”

According to the information, the complaint previously filed in the case, and statements made during today’s sentencing proceeding:

Mills was arrested in June 2012 as part of Operation Card Shop, an international law enforcement operation in which 30 defendants were ultimately arrested in 13 countries for their involvement in various “carding” crimes—offenses in which the Internet is used to traffic in and exploit stolen credit card, bank account, and other personal identification information. As part of the investigation, from June 2010 to May 2012, the Federal Bureau of Investigation (FBI) operated an undercover carding forum (the “UC site”), which, like other underground forums commonly used by carders, enabled its users to discuss various topics related to carding and to buy, sell, and exchange goods and services related to carding, including stolen credit card data. The FBI established the UC site in an effort to identify cybercriminals engaged in carding and to detect and investigate their crimes. The UC site was configured to allow the FBI to monitor and to record the discussion threads posted to the site, as well as private messages sent through the site between registered users.

Mills was a user of the UC site who used malicious software to steal usernames and passwords from Internet users that could be used to access various types of online accounts, including financial accounts at banks and online payment services such as Paypal. Mills trafficked in this stolen login information, advertising to others on the UC site that he had login information for well over 100,000 online accounts for sale, including accounts at Amazon, Facebook, eBay, and other popular websites. A search of Mills’ computer following his arrest recovered login information for 15,000 Paypal accounts alone, along with login information for tens of thousands of online accounts associated with other online services. Mills also trafficked in stolen credit card data. In addition to trafficking in stolen login information and credit card accounts, Mills himself used the access devices he stole to effect fraudulent purchases of gift cards and goods on the Internet, which he sold to others.

In addition to the prison term, Judge Castel sentenced Mills, 20, of Smyrna, Delaware, to three years of supervised release. Mills was also ordered to pay restitution and forfeiture of $50,000.

In sentencing Mills, Judge Castel said, “This man was running a business, and a business that was spreading misery and had the potential of further spreading misery to people throughout the country. Think of the disruption to the individuals, think of the losses to those who have to make good on credit card transactions, or online transactions, or frauds. There was a ripple effect that flowed from it.”

Judge Castel added, “There is also a need to deter others from crimes of this nature. This is an offense which is very difficult to detect, very difficult to find people who perpetrate it, and when they are unmasked, it is important that the word go forth that the punishments are severe.”

Mr. Bharara praised the investigative work of the FBI’s Cyber Crime Task Force.

This case is being handled by the Office’s Complex Frauds Unit. Assistant U.S. Attorney Serrin Turner is in charge of the prosecution.