He helped buy 38,000 stolen PayPal credentials — then used the owners’ money, feds say
After more than 38,000 compromised PayPal account credentials were purchased and then fraudulently used, a Texas man involved in the $1 million scheme has been sentenced to prison, authorities say.
Marcos Ponce, 37, of Austin, has been ordered to serve five years in prison and then three years of supervised release, according to a May 11 news release from the Department of Justice. He also must pay back $1.4 million in restitution.
“Today’s sentencing sends a message that the FBI will pursue cybercriminals across the globe,” wrote Assistant Director in Charge Steven M. D’Antuono of the FBI’s Washington Field Office. “Hiding behind a computer does not mean you can stay anonymous or out of reach of law enforcement.”
Ponce pleaded guilty in October 2021 to conspiracy to commit wire fraud in connection with the scheme, according to court records.
Russell D. Hunt Jr., Ponce’s defense attorney, told McClatchy News in a statement that Ponce is “deeply remorseful of his actions.”
“At the time he thought that he was only using nameless, faceless financial accounts, but he has come to understand that the actions he and his co-conspirators took inconvenienced and caused harm to a great number of real folks who owned those accounts,” Hunt said.
He said Ponce “looks forward to completing his sentence of incarceration so that he can rebuild his life and return to taking care of his family, as well as continue building a career in which he can be of service to others.”
Federal authorities say Ponce and his co-conspirators bought compromised PayPal account information from an illegal online marketplace that operates like many legal ones, including eBay and Amazon marketplace.
An account linked to Ponce bought “38,153 stolen PayPal login credentials which included username, password, name, email, address, balance, linked credit card numbers, linked bank account numbers, and other information,” according to court records. Those accounts were purchased in 757 transactions from Nov. 1, 2015, through Sept. 26, 2016.
Ponce and his partners are also accused of developing “social engineering techniques” to “trick unwitting third parties into accepting money transfers from the compromised PayPal accounts, and then transferring the money into accounts controlled by members of the conspiracy,” according to the news release.
Officials say Ponce did so by having his co-conspirators recruit “unwitting Facebook users” into accepting funds from the stolen PayPal accounts. The users were then told to send the money back to bank accounts the accused controlled.
Investigators found what are believed to be scripts Ponce used to persuade users to participate in the “cash-out scheme.”
“I sold some things online but my account is locked, could you receive some payments for me, withdraw the funds then bank transfer to me? just need paypal email X,” one script reads, according to court documents.
“Hi, do you have a Paypal account and can do me a quick favour?” another script says. “hope you are well X”
Authorities say the 38,153 PayPal login credentials purchased in the scheme were used in more than $1 million worth of “intended and completed fraudulent transactions.”
“This prosecution and sentence send a powerful message that the cyberworld is not a haven for criminals, and law enforcement will work tirelessly to bring cybercriminals to justice,” U.S. Attorney Ashley C. Hoff, for the Western District of Texas, said in the news release.
This story was originally published May 11, 2022 at 5:39 PM with the headline "He helped buy 38,000 stolen PayPal credentials — then used the owners’ money, feds say."