Case Document 2 Filed 10/02/19 Page 1 of 13 Page D# 2 UNDER SEAL IN UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA Alexandria Division I l] UNITED STATES OF AMERICA, -. - 2 2013 v. CLEHK.U.5.DISTRIGT count ALEXANDRIA, VIRGINIA KWASI-IIE SENAM ZILEVU, Case No. Defendant. AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT AND ARREST WARRANT Your af?ant, Flannan Soden, being duly sworn, hereby dcposes and states as follows: INTRODUCTION I. I am a Special Agent with the 'I'rcasury Inspector General for Tax Administration and have been since November 2016. I am currently assigned to the Mid-Atlantic Field Division New Maryland Office. I am a graduate of the Criminal Investigator Training Program at the Federal Law Enforcement Training Center as well as the TIGT A Special Agent Basic Training Academy. Prior to becoming a Special Agent, I was an Investigative Specialist for a year and four months with TIGTA. Prior to my career with TIGTA, I was a Taxpayer Advocate with the Internal Revenue Service For approximately 6 years. 2. As a agent, I have received instruction and training, including the use of computers, cell phones, social media, email, and the internet in connection with criminal activity. In particular, I have experience investigating the impersonation of IRS of?cials, theft of IRS property, bribery, unauthorized disclosure of tax return information, loss of IRS property and equipment, and threats to and assaults on the IRS and its employees. In the coarse ol?conducting or participating in criminal investigations, I have interviewed and debriefed witnesses and Case Document 2 Filed 10/02/19 Page 2 of 13 Page D# 3 informants; conducted physical surveillance; analyzed bank records and other ?nancial documents; analyzed telephone records; and collected and analyzed evidence. 3. I submit this af?davit in support of a criminal complaint charging KWASHIE SENAM ZILEVU with knowingly committing Access Device Fraud, in violation of Title 18, United States Code, Section 1029(a)(5). This affidavit is also submitted in support of an arrest warrant. 4. The facts and information contained in this af?davit are based upon my personal knowledge of the investigation and information conveyed to me by other state and federal law- enforcement. All observations that I did not personally make were related to me by the individuals who made them, or come from my review of reports, documents, records, and other physical evidence obtained during the course of this investigation. This af?davit contains information necessary to establish probable cause. It does not include each and every fact known by me or known by the government. PROBABLE CAUSE 5. TIGTA is investigating potential violations of 18 U.S.C. 1029(a)(5) (Access Device Fraud) and other related criminal offenses. During the course of the investigation, TIGTA identi?ed three victims, Victim A, Victim B, and Victim (collectively referred to as ?the victims?), whose identities had been stolen. Further investigation revealed that from in or about January 2016 to in or about December 2017, the victims? stolen personally identi?able information was used to obtain three credit cards. Interviews with the victims con?rmed that the credit cards were obtained without their knowledge or consent. 6. The credit card applications submitted using Victim A?s and Victim C?s PII listed 14520 General Washington Drive, Woodbridge, Virginia 22193, as Victim A?s and Victim C?s Case Document 2 Filed 10/02/19 Page 3 of 13 Page D# 4 address. The card issued in Victim A?s name and the card issued in Victim C?s name were delivered to the listed address in Woodbridge, Virginia. 7. The email account on the credit card application submitted under Victim B?s name was accessed on multiple occasions using an Internet Protocol address linked to the 14520 General Washington Drive, Woodbridge, Virginia 22193. 8. ZILEVU owns and lives at the property located at 14520 General Washington Drive, Woodbridge, Virginia 22193 (hereinafter address?). 9. Evidence obtained during the investigation shows that from in or about January 2016 to in or about February 2018, ZILEVU used the three credit cards ?'audulently issued in the - name of the victims to purchase approximately $69,000 in various goods and services. 10. On or about September 19, 2019, United States. Postal Inspection Service Postal Inspector Jackie Palmer and I interviewed ZILEVU at his place of employment- (?September 2019 Interview?). During the interview, ZILEVU made the following statements: a. He is currently employed as an Information Technology Specialist with the IRS. b. He lives at the residence located at address with his cousin, Aseye Zilevu, and another tenant to whom he rents out the basement. c. He received the credit cards issued to the three victims. (1. He routinely used'all three credit cards to purchase goods and services for his personal use. 11. The investigation has shown that ZILEVU was aware that he was using the names and identities of real persons, and not providing ?ctitious information. When a person submits a credit card application to a ?nancial institution, that institution discloses the fact that pursuant to the Bank Secrecy Act and the USA Patriot Act, all ?nancial institutions are required to obtain, Case Document 2 Filed 10/02/19 Page 4 of 13 Page D# 5 verify, and record information that identi?es each person who opens an account. ZILEVU knew that if he used ?ctitious information, his credit card applications would not be approved. So, he knowingly and without authorization used the true names, addresses, dates of birth, and Social Secmity numbers of at least three real individuals to obtain fraudulent credit cards. A. Victim A 12. On or about January 25, 2016, an American Express application was submitted electronically using Victim A?s PII. In addition to listing Victim A?s true address and telephone number, the AMEX application listed Victim A?s home address as address, and Victim A?s telephone number as Google Voice telephone number ending in 2285, which is phone number (hereinafter Gcogle number?). A review of Prince William County property records showed that ZILEVU is the current owner of the property located at address and has been the owner since on or about January 16, 2014. Google?s records established that the _Google number is assigned to ZILEVU. The I AMEX credit card was issued to Victim A, and mailed to address. 13. Between on or about April 30, 2016, and on or about February 24, 2017, approximately $49,000 was charged to the AMEX card. A review of the AMEX credit card statements showed that numerous transactions were made in Woodbridge, Virginia, within the Eastern District of Virginia. 14. On or about February 24, 2017, an American Express employee contacted the USPIS to report that a fraudulent credit card application with Victim A?s PH had been submitted. 15. On or about April 4, September 7, and December 29, 2017, among other dates, USPIS agents conducted surveillance of address and observed an individual that matches the appearance of ZILEVU at the residence. Case Document 2 Filed 10/02/19 Page 5 of 13 Page D# 6 16. Through my training and experience, I know that individuals who fraudulently obtain credit cards often try to avoid detection by dispersing charges amongst various types of retailers. The AMEX credit card statements listed multiple purchases made at various retailers. Security footages from some of the retailers showed an individual matching description making purchases at the same time and location indicated on the AMEX credit card statements. 17. For instance, on or about January 3, 2017, the AMEX credit card was used to make a purchase totaling $217.27 at Lowe?s of Dale City in Woodbridge, Virginia. Security footage from Lowe?s of Dale City shows an individual matching description inside the store on January 3, 2017, around 9:11 am. At 9:15 am, a person matching description can be seen using a credit card at the cash register and exiting the store around 9:16 am. Surveillance video of the parking lot outside of Lowes on or about January 3, 2017, shows a tan Jeep Laredo heading toward the exit of the parking lot at 9:17 am. On or about February 28, 2017, agents conducted surveillance at address, and observed a tan Jeep Laredo with a Vehicle Identi?cation Number 1J4HR48N75C732. Agents ran the VIN number through a public database and learned that the vehicle is registered to ZILEVU and his mother. 18. Surveillance footage from Floor D?cor, located in Woodbridge, Virginia, shows a transaction on or about January 9, 2017, involving a person who matches the appearance of ZILEVU. On that same date, the AMEX credit card was used to make a purchase totaling $526.93 at Floor Decor. 19. Surveillance footage from BJ Wholesale #0041 in Woodbridge, Virginia, shows a transaction on or about anuary 8, 2017, involving a person who matches the appearance of Case Document 2 Filed 10/02/19 Page 6 of 13 Page D# 7 ZILEVU. On that same date, the AMEX credit card was used to make a purchase totaling $405.67 at BJ Wholesale #0041. 20. On or about January 7, 2017, the AMEX credit card was used to make apurchase at Designer Shoe Warehouse in Woodbridge, Virginia. Surveillance footage from DSW on January 7, 2017, shows a person matching description walking into DSW, approaching the counter, and purchasing merchandise. 21. Records obtained during the investigation also indicate that ZILEVU used the AMEX credit card to make a payment to himself on PayPal. On or about May 10, 2016, a request for $7,400 was sent from kzilevu@gmail.com to an email address similar to Victim A?s true name, but does not belong to Victim A (hereinafter ?Victim A?s Fraudulent Email Account?). Google records obtained during the course of this investigation revealed that the email address kzilevu@gmail.com is registered to ZILEVU. During the September 2019 Interview, ZILEVU admitted that kzilevu@gmail.com is his email address. On or about April 11, 2017, ZILEVU received an email from service@paypal.com Even though the email was sent to kzilevu@gmail.com, the email was addressed to At the September 2019 Interview, ZILEVU acknowledged owning and operating a business called MARCROTELE. 22. A note included with the May 10, 2016, request from kzilevu@gmail.con1 to Victim A?s Fraudulent Email Account stated Within minutes of the request being sent, Victim A?s Fraudulent Email Account was accessed to transfer $7,400 to a PayPal account linked to ZILEVU admitted that the Yahoo email is his at the September 2019 Interview, and Yahoo records link this email to kzilevu@gmail.com and Case Document 2 Filed 10/02/19 Page 7 of 13 Page D# 8 Google number. A review of the AMEX credit card statement showed a payment of 400 to MARCROTELE on May 10, 2016. 23. There is also evidence showing that Victim A?s Fraudulent Email Account was accessed on multiple occasions using a Verizon IP address registered to address. 24. On or about May 13, 2016, the AMEX credit card was used to purchase two Delta plane tickets totaling $1,562.40. ZILEVU's address, Google number, and email address kzilevu@gmail.com were provided to Delta airlines in connection with this purchase. On or about May 13, 2016, ZILEVU received an email to his kzilevu@gmail.com account from Delta Air Lines con?rming two round-trip ticket purchases totaling $1,562.40 for ZILEVU and another individual from Baltimore, Maryland, to Sacramento, California. 25. On or about November 13, 2016, ZILEVU received two emails sent to his kzilevu@gmail.com account from AmericanAirlines@aa.com addressed to Victim A. The ?rst email con?rmed the purchase of an American Airlines ticket for ZILEVU from Washington, DC, to Miami, Florida, on November 13, 2018. The second email was sent to con?rm the purchase of a $21.79 seat upgrade for passenger ZILEVU on the November 13, 2016, ?ight. Both purchases were made using the AMEX credit card. 26. On or about November 14, 2016, ZILEVU received an email to his kzilevu@gmail.com account from HotelTonight con?rming a hotel reservation for ZILEVU at the Riviera South Beach. This email advised that the AMEX credit card would be charged $100 for the room reservation. The AMEX credit card statement con?rms the payment of $100. Case Document 2 Filed 10/02/19 Page 8 of 13 PagelD# 9 27. From on or about October 1 l, 2016, to on or about January 13, 2017, ZILEVU paid for 37 Uber trips totaling $1,027.98 using the AMEX credit card. Uber account showed that nine of the Uber trips taken during this time period either started or ended at address. 28. A review of Amazon?s records showed that the AMEX credit card was the primary payment method for an Amazon account in the name of father. From on or about October 26, 2016, to on or about January 2, 2017, the AMEX credit card was used to make nine Amazon purchases totaling $1,200.00. The mailing address and telephone number on the account are address and Google number. A review of Microsoft records revealed that the email address for this account is associated with Google number. ZILEVU also con?rmed that the Hotmail address is his at the September 2019 Interview. 29. VENMO records showed that on or about June 30, 2016, a VENMO account was opened in Victim A?s name. The primary payment method for this account was the AMEX credit card. The email address used to register the VENMO account is similar to Victim A?s true name and is the same email address used to create Victim A?s Fraudulent Email Account. On or about July 7, 2016, an attempt to send a $500 payment for ?Table park? to ZILEVU was made on the VENMO account opened in Victim A?s name. On or about July 12, 2016, VENMO refunded the $500 for the July 7, 2016 transaction. On or about July 14, 2016, VENMO requested identi?cation for the account opened in Victim A?s name. On or about October 11, 2016, the account was cancelled and ?agged as fraudulent. 30. A review of Congressional Federal Credit Union account revealed that approximately ten electronic payments were made to the fraudulent AMEX account from Case Document 2 Filed 10/02/19 Page 9 of 13 Page D# 10 Congressional Federal Credit Union account. It appears that ZILEVU was making the minimum payment amount to AMEX, using his Congressional Federal Credit Union account, in order to keep the AMEX account open and active. 31. In or about June 2018, agents interviewed Victim A, who con?rmed that the AMEX credit card had been taken out in his/her name, and that not have permission or authority to use his/her information to apply for the AMEX credit card. B. Victim 32. On or about August 21, 2017, an electronic credit card application was submitted to US. Bank Trust using PII of Victim B. The credit card account was approved and the credit card for this account was mailed to the address 5576 Roundtree Dr., Woodbridge, Virginia, 22193, which is the address of parents (?Parents? address?). Law enforcement databases showed that this is previous address and the current address of his parents. Additionally, agents observed ZILEVU at this residence on or about April 7 and December 29, 2017. Speci?cally, on or about April 7, 2019, agents observed ZILEVU drive from address to Parents? address, 33. An email address, which is not Victim B?s email but is similar to Victim B?s name, was listed on the US. Bank Trust credit card application for Victim B. Google records associated with that email address revealed that the email address was accessed on multiple occasions by Verizon IP addresses assigned to parents. The physical account address- for the Verizon account of parents was address. The phone number for the account subscriber was a number ending in 0490 (hereinafter number?). T- Mobile records indicated that this number was assigned to ZILEVU. The Verizon account also Case Document 2 Filed 10/02/19 Page 10 of 13 Page D# 11 listed Google number and the email address kzilevu@gmail.com as the contact information for the subscriber. 34. At least from on or around August 21, 2017, through at least on or around September 15, 2017, the U.S. Bank and Trust credit card statements repealed that a total of $1 0,273 .39 in completed transactions and $2,651.62 in attempted transactions were made using the credit card issued in Victim B?s name. 35. For instance, on or about September 8, 2017, the U.S. Bank and Trust credit card was used to make a purchase totaling $942.60 for a Delta Airlines plane ticket??om Dulles Airport in Dulles, Virginia, to Montego Bay, Jamaica, for ZILEVU. 36. In or about August of 2019, agents interviewed Victim B, who con?rmed that the fraudulent U.S. Bank Trust credit card had?been taken out-in his/her name, and that ZILEVU did not have permission or authority to use his/her information to apply for the U.S. Bank Trust Credit Card. C. Victim 37. On or about December 19, 2017, a credit card application was submitted to U.S. Bank Trust using Victim C?s PM. The primary address for the credit card listed Victim C?s true address. The secondary address listed on this application is address. When the credit card application was approved, the U.S. Bank Trust credit card was mailed to address. 38. The email address listed on the fraudulent U.S. Bank Trust credit card application for Victim is DoKayl 933@gmail.com. A review of Google records associated with DoKayl933@gmail.com revealed that DoKayl933@gmail.com was accessed on multiple occasions by an intemet protocol address assigned to Verizon subscriber ASEYE ZILEVU. The 10 Case Document 2 Filed 10/02/19 Page 11 of 13 Page D# 12 physical account address for Verizon subscriber ASEYE ZILEVU is address. The account lists number, Google number, and the email address kzilevu@gmail.com as the account holder?s contact information. 39. The U.S. Bank and Trust credit card statements revealed that a total $9,641.69 in fraudulent charges were made using this credit card. 40. For instance, on or about December 30, 2017, the U.S. Bank and Trust credit card was used to purchase an Iceland Air ticket from Dulles Airport in Dulles, Virginia, to Reykjavik, Iceland, totaling $701.92. The passenger name listed on this plane ticket is ZILEVU. 41. A review of official IRS email account, kwashie.s.zilevu@irs.gov, revealed that ZILEVU received an email from PayPal congratulating Victim for setting up his/her account on or about February 2, 2018. This same email instructs Victim to click a link in order to con?rm that his/her email address, listed as kwashie.s.zilevu@irs.gov, is accurate. On or about February 3, 2018, ZILEVU received another email to his IRS email account from PayPal advising Victim that he/she is of?cially a PayPal member. 42. In or about August of 2019, agents interviewed Victim C, who con?rmed that the ?audulent U.S. Bank Trust credit card had been taken out in his/her name, and that ZILEVU did not have permission or authority to use his/her information to apply for the U.S. Bank Trust Credit Card. D. Congressional Federal Credit Union 43. ZILEVU has a personal account with Congressional Federal Credit Union. On or about December 7, 2017, ZILEVU submitted a signed Af?davit of Loss to Congressional Federal Credit Union stating the following; was contacted by the credit union in regards to a potential deposit (check) that was made to my account which I do not have knowledge of. There 1] Case Document 2 Filed 10/02/19 Page 12 of 13 PageID# 13 were series of charges made to my account of which I am also unaware of and disputing those charges.? ZILEVU listed a total of 17 charges incurred between on or about November 29, 2017, to on or about December 5, 2017, that add up to $1,895.15. ZILEVU certi?ed on the Af?davit of Loss that swear this af?davit is true and understand that making a false sworn statement is subject to federal and/or state statutes and may be punishable by ?nes and/or imprisonment.? The af?davit was notarized in Fairfax County, Virginia. 44. A review of email account and own admissions during the September 2019 Interview suggests that ZILEVU falsely disputed at least some of the charges that he did, in fact, incur. For example, ZILEVU received booking con?rmation numbers ??om Hotels.com for two reservations at the Plaza on the River in London, England. On or about November 30, 2017, ZILEVU received an email ?'om Hotelscom. The subject of this email reads as follows; ?Hotelscom booking con?rmation 143502067830 - Plaza on the River London.? On or about November 30, 2017, ZILEVU also received an email from Visa Purchase Alerts. The subject of this email reads as follows; ?Visa Purchase Alerts: 320.57 USD at HOTELS.COM143502067830 in HOTELSCOM on Card 9595.? On or about December 1, 2017, ZILEVU received an email ?om Hotelscom. The subject of this email reads as follows; ?Hotelscom booking con?rmation 143527603137 - Plaza on the River London.? On or about December 1, 2017, ZILEVU received an email from Visa Purchase Alerts. The subject of this email reads as follows; ?Visa Purchase Alerts: 216.93 USD at HOTELS.COM143527603137 in HOTELSCOM on Card 9595.? 45. At the September 2019 Interview, ZILEVU admitted to going to London, England, on or about November 29, 2017, and returning to the United States on December 4, 2017. He also stated that he remembered staying at the Plaza on the River London. 12 Case Document 2 Filed 10/02/19 Page 13 of 13 Page D# 14 46. Law enforcement databases con?rmed that on Or about November 29, 2017', ZILEVU boarded an airplane at Dulles International Airport in Dulles, Virginia, destined for Heathrow International Airport, located in London, England, and that on or about December 4, 2017, ZILEVU boarded a return ?ight from Heathrow International Airport to Dulles International Airport. CONCLUSION Based on the information contained herein, I respectfully submit that there is probable cause to believe that from in or about January 2016 to in or about February 2018, in the Eastern District of Virginia, ZILEVU committed Access Device Fraud, in violation of Title 18, ?f Wear-a cial Agent Treasury Inspec or General for Tax Administration United States Code, Section 1029(a)(5). Subscr' -d sworn to before me on the day of October 2019. it no John F. Anderson United States Magistrate Judge The Honorable John F. Anderson United States Magistrate Judge Alexandria, Virginia 13