ATMs taken for upward of $1M, prosecutors say

05:30 PM MST on Sunday, June 25, 2006

By Scott Simonson
ARIZONA DAILY STAR

When Jacob Green-Bressler was 12, Microsoft Corp. called to offer him a job. They wanted his computer skills.

At age 17, prosecutors say, Green-Bressler found a different use for those skills. He became an online identity thief, and this spring pleaded guilty to theft and to helping to commit fraud and computer tampering .

For 2 1/2 years, prosecutors say, he and 16 other Tucsonans bought 4,500 stolen ATM card numbers on the Internet and used them to create fake cards and withdraw more than $1 million from ATMs.

The 17 are to face trial on federal charges as early as this fall. At least five, including Green-Bressler, already have pleaded guilty in a related case in Pima County Superior Court.

State and federal court documents in the case suggest thieves have harnessed the Internet to network across continents, recruit new conspirators and evade law enforcement.

Those international, electronic connections also help explain why identity theft, and theft of personal financial information, have grown to epidemic proportions — especially in Arizona, which had the nation's highest rate of reported identity theft last year, the Federal Trade Commission reports.

The costs are staggering: Nationwide in 2004, victims lost an estimated $3.2 billion, U.S. Justice Department figures show. Victims also pay a heavy cost in time and frustration; one in five victims say they spend at least a month resolving problems.

In this case, prosecutors allege card numbers traveled from unsuspecting users in the United States to countries as far away as Vietnam, Romania and Pakistan. From there, prosecutors say, thieves used Internet chat rooms to talk with and instruct accomplices, including the Tucson defendants.

Here, prosecutors say, the accused made fake debit cards, used them in ATMs around town, and wired some of the cash overseas to pay those who supplied card numbers.

The accused are young: When they were arrested, all but one were under 25. Some lived at an East Side house near South Harrison and East Golf Links roads. Most had no serious criminal record as adults. Some who have pleaded guilty said that before they joined the ring they worked as retail clerks, mechanics and landscapers.

Green-Bressler, now 20, was the youngest. Prosecutors say he was a key player in the group; his parents and attorney say he was just a kid corrupted by bad influences. His attorney, D. Jesse Smith, compares his client's situation to Pinocchio's trip to Pleasure Island, an innocent who finds trouble in the company of bad boys.

Green-Bressler may have an adult's computer skills, Smith says, but he was a teenager. And teenagers seldom can resist the promises of easy cash for cars and big screen TVs for what seems like a victimless crime, Smith says.

"There really weren't individuals that were victims, but banks," Smith says. To a teen-ager, Smith said, it seemed "like playing with monopoly money."

Chat room for criminals

Those who pleaded guilty to state charges in the fraud case include two unemployed high school dropouts; a woman who had worked in fast food and retail and as an entertainer at a nightclub; and a man who served with the Navy and then ended up working at a pizza parlor.

One was Robbin Shea Brown, who was 22 when Green-Bressler was 17.

Brown grew up in Tucson. He didn't finish high school. He told police he started his own business to design Web sites, some of them pornographic. He called it Lustful Entertainment. It didn't make much money, he later told police.

Brown told police he found card numbers in an Internet chat room. "That place is built around criminals," he told police after his arrest. "I used to just go in there and read all the time. It's pretty apparent."

Chat rooms like the one he frequented operate in something called Internet Relay Chat, or IRC, which allows people around the world to converse by keyboard in real time.

For illicit activity, IRC offers an advantage: Users can change "channels" quickly to avoid detection. The chat rooms often supply instructions on how to make counterfeit ATM cards, says Tucson Police Department Detective Roger Nusbaum, one of the investigators on the case.

The counterfeit cards had no logos or numbers, court documents show. They were white plastic, blank except for a magnetic strip, the same types of cards businesses routinely make into hotel room keys or store and restaurant gift cards.

Green-Bressler and others used computers and "mag writers" — machines that encode data onto magnetic strips — to transfer account holders' data onto the plastic cards.

When fake cards produced cash, prosecutors say, the group wired half of proceeds overseas to the sources of the numbers.

One of the group, David Lee Merrill, said in a court filing after his guilty plea that he made $5,000 to $10,000 in an average day. He estimated the group stole millions.

Used ATM at casino

On March 9, 2005, three people visited Casino del Sol, 5655 W. Valencia Road, and withdrew about $148,000 using a counterfeit ATM card.

The theft had started with an e-mail to a woman in Jackson, Miss. The e-mail appeared to be a message from eBay, the online auction site, a Tucson Police Department report says.

The woman replied, thinking she needed to update her eBay account information. She was wrong: She later discovered she had given a thief her ATM card number.

The woman did not return calls seeking comment.

On March 5, the card number was used successfully in Pakistan, the police report says.

Between March 5 and March 9, prosecutors say, the card number was obtained by the fraud ring in Tucson.

For four hours at the casino on March 9, somebody punched in the stolen card number and PIN again and again, and grabbed more and more cash.

The six-figure withdrawal caught the attention of banks and the casino. Video surveillance footage was gathered.

Soon, police and the U.S. Secret Service were looking for Green-Bressler. He and two others withdrew the cash that night, prosecutors said.

Maturity lag claimed

Green-Bressler's emotional maturity lagged behind his computer skills, his mother and stepfather, Kate and Richard Bressler, wrote to a Superior Court judge in March.

About eight years ago, Microsoft employees met Green-Bressler in a chat room, and called to offer him a job. They didn't realize Jacob was only 12.

"We were very excited for Jacob's future, but realized he was going to have to mature a great deal before anything like this would happen," the Bresslers said in their letter.

At age 13, Jacob was not growing properly, the Bresslers said, which left him less mature than most boys his age.

"Jacob's choices were not that of a normal 17-year-old when all this started," the Bresslers wrote. "Unfortunately, he met the people who brought this computer fraud scheme to Tucson in his chat room. By the time he figured out what really was going on, it was too late."

Prosecutors have not explained whether they believe the accused in Tucson initiated contact with thieves, or whether they were recruited into a fraud scheme. Within the hierarchy of the bank-card fraud ring, Green-Bressler was nowhere near the top, Tucson Police Detective Nusbaum says.

Card thieves often operate from foreign countries, Nusbaum says, but they recruit people in the United States to turn stolen card numbers into cash at ATMs. The Tucson thieves probably never knew who supplied the card numbers, Nusbaum says. The money could have gone to criminal gangs, drug traffickers or terrorists.

"They're turning Americans against Americans," he says.

Banks and credit-card companies often cover losses from fraud, but the cost is passed along to consumers in the form of higher fees and charges for other services, Nusbaum says.

"We all pay for this," he says.

Bought a Cadillac

Counterfeit cards helped buy a black Cadillac Escalade SUV that Green-Bressler drove, Brown told police. The car was bought with $60,000 in cash from a private seller, Brown said.

The Tucson thieves blew most of their money on drugs, cars, big-screen TVs and visits to strip clubs, Nusbaum says.

On Nov. 7, 2005, federal investigators said they busted the Tucson fraud ring and announced 12 arrests. Five others were later arrested.

Banks and law enforcement had identified suspects by sharing video footage from fraudulent transactions at ATMs, Nusbaum says. An apparent rift led some members of the group to report others to police, he says.

Secret Service agents and police officers tracked Green-Bressler to the East Side house.

When they arrested him, he was hiding in the attic. Beside him were a magnetic card writer, plastic cards with magnetic strips, and two books: "Complete Hackers Handbook" and "How to Do Just About Anything on a Computer."

How they did it

●Here is how thieves used e-mail to steal a woman's ATM card number and $148,000, court documents show:

1. A woman in Jackson, Miss., receives an e-mail that appears to be from eBay.

2. The woman grants the e-mail's request for her bank card number. She unknowingly sends the information to a scam artist who sent her the e-mail. His location is unknown; many operate outside the United States, in Eastern Europe, Russia, or Asia.

3. Her card number and others are bought and sold in Internet chat rooms.

4. The card number is used at an ATM in Pakistan.

5. A Tucson fraud ring buys the number on the Internet, and creates a counterfeit ATM card.

6. The counterfeit ATM card is used to withdraw about $148,000 in Tucson.

7. Security cameras catch the thieves on video.

How to avoid being a victim

Avoid being the victim of online fraud:

●Know whom you're talking to. If you have any doubt that an e-mail or Web page is legitimate, call the source. Don't share information with an anonymous e-mailer any more readily than you would share it with a person on the street.

●Most banks and credit-card companies will not ask for sensitive information, such as card numbers or PINs, in e-mail.

●Thieves often will pose as legitimate businesses or government agencies. In the Tucson case, one victim was fooled by a fraudulent e-mail that appeared to be from eBay. More recently, e-mail scam artists sent e-mails posing as the Internal Revenue Service, the Federal Deposit Insurance Corp. and MySpace.com. Beware of unsolicited e-mails, even those from sources that appear respectable.

●Thieves have started to use links in e-mails to send consumers Web pages that look real, but actually are counterfeits to steal personal information. In June, the FBI warned of e-mails that send recipients to an exact replica of the MySpace.com log-in screen — a fake designed to capture people's names and passwords, or to implant spyware on computers.

Sources: Federal Bureau of Investigation, Tucson Police Department

For more news, visit www.azstarnet.com or www.azfamily.com