Romanian man sentenced in Lexington for sophisticated international fraud scheme

Defendant Laundered Over $3.5 Million in Fraudulent Online Auction Proceeds as Part of a Scheme that Defrauded Over 900 American Victims

Via press release

LEXINGTON, Ky. – A Romanian national was sentenced on Monday to 89 months in prison for his role in a transnational, multimillion-dollar scheme to defraud American victims. He is the 24th member of the organized criminal group to be sentenced, of the 28 who were charged.

Ionut-Razvan Sandu, 35, of Romania, pleaded guilty in April 2022 to conspiracy to commit a Racketeer Influenced and Corrupt Organizations Act (RICO) offense. Four other defendants pleaded guilty to this offense and were sentenced for their roles in the conspiracy between Nov. 16 and 18, 2022, including: Rafael-Liviu Cucu, 33, of Romania to 61 months; Alexandru-Catalin Calin, 40, of Romania, to 61 months; Ciprian-Ionut Filip, 37, of Romania to 70 months; and Gabriel Constantin Georgescu, 37, of Romania to 63 months.

“This highly organized and sophisticated syndicate stole directly from the pockets of hard-working Americans. The criminals then used digital currency to launder their ill-gotten gains,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. “Today’s result is proof that the Criminal Division and our law enforcement partners will never stop pursuing cybercriminals who target the American public—no matter where these criminals reside, and no matter what tools they use to hide.”

“Cybercrime is an increasingly prevalent means for criminals to prey on the public, causing victims, from across the United States, to lose millions of dollars,” said U.S. Attorney Carlton S. Shier IV for the Eastern District of Kentucky. “To continue to protect Americans against organized cybercrime, cooperation and coordination among law enforcement is essential. This case is the result of a massive, years-long effort by the U.S. Secret Service to coordinate the investigation of this crime and identify and apprehend the offenders. I commend the exceptional work done by all our law enforcement partners, and we are proud to have joined this cooperative effort to prosecute this significant cyber fraud scheme.”

“Financial crimes that take place in the cyber domain have a very real impact on everyday Americans and their families,” said Special Agent in Charge Robert Holman of the U.S. Secret Service Louisville Field Office. “The Secret Service remains committed to investigating such crimes, and we appreciate the continued support of our local, state, federal, and international law enforcement partners as we work together to bring those responsible to justice.”

According to plea documents, beginning as early as October 2014, Sandu and other members of the criminal organization collectively developed a process and offered a service by which co-conspirators based in the United States and abroad would launder the proceeds of online auction fraud.

According to court documents, Georgescu, Filip, and other co-conspirators posted false advertisements to popular online auction and sales websites, such as eBay, for goods that did not actually exist. Members of the conspiracy created fictitious online accounts to post these advertisements and communicate with victims, sometimes using the stolen identities of Americans to do so. The advertisements typically marketed the sale of used vehicles or similar goods and targeted working-class Americans.

Members of the conspiracy used several tactics to convince victims to send money for the advertised goods. For example, they impersonated a military member who needed to sell the advertised item before deployment. In furtherance of the scheme, the defendants delivered invoices to the victims bearing trademarks of reputable companies to make the transaction appear legitimate. The defendants also set up call centers to impersonate customer support, address questions, and alleviate concerns over the advertisements.

Once victims had sent payment, members of the conspiracy engaged in a complex money laundering scheme offered by Sandu and others wherein U.S.-based conspirators received victim funds, converted those funds to cryptocurrency, and transferred proceeds in the form of cryptocurrency to foreign-based money launderers. Those foreign-based money launderers, such as Cucu and Calin, would then work with other members of the conspiracy to convert the bitcoin back into fiat currency. Sandu was held responsible for laundering over $3.5 million worth of fraudulent proceeds. To date, law enforcement has identified over 900 victims of this scheme.

The investigation was conducted by the U.S. Secret Service, Kentucky State Police, Lexington Police Department, IRS Criminal Investigation and U.S. Postal Inspection Service, and supported by the Justice Department’s Organized Crime Drug Enforcement Task Force (OCDETF) and the International Organized Crime Intelligence and Operations Center (IOC-2). Assistance was provided by the Romanian National Police (Service for Combating Cybercrime), the Romanian Directorate for Investigating Organized Crime and Terrorism (Agency for Prosecuting Organized Crime), and the Supreme Prosecutor’s Office of Cassation of the Republic of Bulgaria. The Justice Department’s Office of International Affairs and Criminal Division’s Money Laundering and Asset Recovery Section provided significant support.

This case is being prosecuted by Senior Counsel Frank Lin of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Kathryn M. Dieruf of the U.S. Attorney’s Office for the Eastern District of Kentucky.

Individuals who believe they may be victims of the online auction fraud scheme described herein are encouraged to visit the following website to obtain more information: https://www.justice.gov/usao-edky/information-victims-large-cases.

---

From the defendants’ plea agreements:

a) The Defendant is a Romanian national from Alexandria, Romania. The Defendant and his coconspirator used or accessed the online moniker, “ekathy2033”. The Defendant also personally used the following aliases: “Renee” and Razvan Intim. He associated with and was a member of the Alexandria Online Auction Fraud (“AOAF”) Network, an enterprise as defined by 18 U.S.C. § 1961(4).

(b) Starting in or before October 2014, the Defendant and his coconspirators had collectively developed a process by which they would obtain the assistance of individuals in the United States to launder the proceeds of illegal activity, for ultimate remission to the Defendant and his coconspirators in Romania. On or about September 2, 2015, AMERICANMASSIVE, through online chat, communicated with an individual, the Confidential Source (“CS”), about payment in exchange for converting money provided to him on OneVanilla prepaid gift cards and GreenDot cards. On this day, AMERICANMASSIVE initiated a relationship with the CS, who operated from the Eastern District of Kentucky, to engage in these money laundering efforts on their behalf. The fraudulent scheme involved the following:

• Members of the AOAF Network enterprise used the Internet to post advertisements for goods to auction websites, including eBay, and online sales websites. They emailed invoices that contained eBay and other entity trademarks and encouraged the victims to reach out to customer support if they had any questions.
• Members of the AOAF Network often posed as customer support representatives for eBay, or false entities that sounded as if they were affiliated with eBay, in telephone calls and email communications.
• Once the AOAF Network members convinced victims to purchase and provide payment for a falsely advertised item, victim payment was sent to the CS, and others in the United States who provided money laundering services similar to the CS, to convert into bitcoin.
• The CS, located in the Eastern District of Kentucky, worked with others in the United States to convert the victim payment into bitcoin, and remitted the bitcoin to Romania at the direction of the AOAF Network members. The Defendant knew the funds transferred through the CS constituted the proceeds of unlawful activity.
• The Defendant offered services to other AOAF Network members to cash out the ill-gotten gains now in the form in bitcoin and received some of these funds knowing they were the proceeds of the online auction fraud described herein.

(c) The Defendant engaged in this scheme at least throughout the duration of the conspiracy. This scheme concealed the source, nature, ownership and control of the fraud proceeds. The Defendant knew of the scheme’s unlawful purposes and voluntarily joined it. d) The Defendant provided services, such as cashing out services, for and worked with other members of the AOAF Network directly and indirectly, including, but not limited to, Andrei Stoica, Bogdan Popescu, and Rossen Iossifov, in furtherance of the online auction fraud scheme.

---

(a) The Defendant, Peter Jung Choi, is a United States citizen residing in Virginia, who used monikers such as “amazonexchange” and “goodtimeshaxor” online.

(b) Beginning before May 2015, the Confidential Source (“CS”) and the Defendant, who was using the moniker “amazonexchange”, communicated about the business of exchanging One Vanilla prepaid debit cards for cash over localbitcoins.com chat and through jabber chat. Over the course of their relationship, the CS and the Defendant entered an agreement to conve1t funds from prepaid debit cards and direct deposits to bank accounts into more liquid methods of payment including cash and bit coin.

(c) The CS, located in the Eastern District of Kentucky, sent funds to the Defendant, located in Virginia, typically by supplying prepaid debit card codes that the Defendant rcencoded to blank cards. The Defendant knew or should have known that the funds sent to him from the CS came from some type of illegal activity. The Defendant then redeemed those funds usually by using them to purchase money orders, which he later redeemed for cash. The Defendant then sent the funds back to the CS, less his cut, usually in the form of bitcoin.

(d) The Defendant also exchanged gift cards for other forms of payment for others, knowing or being deliberately indifferent that the source of the funds was from some type of illegal activity.

---

(a) Ciprian-Ionut Filip is a Romanian national from Lehliu Gara City, Romania. He used the following online monikers: “pinkypink,” “mrpink,” and “bkristen33”. He was associated with the Alexandria Online Auction Fraud (“AOAF”) Network, an enterprise as defined by 18 U.S.C. § 1961(4).

(b) On or about February 21, 2016, Filip, through online chat, communicated with the Confidential Source (“CS”), to discuss cashing out Visa One Vanilla gift cards.

(c) Working in conjunction with others in the enterprise, Filip and his conspirators used the Internet to post advertisements for goods to sales websites, including Craigslist and Amazon. When Filip or his coconspirators had convinced victims to purchase the falsely advertised goods, he sent the victims invoices for payment that appeared to be from legitimate sellers.

(d) Once the Defendant and his coconspirators convinced victims to purchase and provide payment for a falsely advertised item, the Defendant reached out to the CS, and others in the United States who provided money laundering services similar to the CS, to convert the victim payment to bitcoin. The Defendant knew the funds he transferred to the CS constituted the proceeds of unlawful activity.

(e) In accordance with the Defendant’s instructions, the CS would launder the proceeds of fraud by exchanging fraud proceeds into bitcoin. Specifically, the CS, located in the United States, sent the Defendant, located in Romania, bitcoin in exchange for fraud proceeds to bitcoin addresses belonging to the Defendant. This scheme concealed the source, nature, ownership and control of the fraud proceeds. The Defendant knew of the scheme’s unlawful purposes and voluntarily joined it.

(f) Filip worked with other European-based members of the AOAF Network, including Stefan-Alexandro Paiusi, Eugen-Alin Badea, Adrian Mitan, and Beniamin Ologeanu, among others, in furtherance of the scheme.