Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 1 of 12 PageID# 1 IN THE UNITED STATES DISTRICT COURT FOR Tm FILED OPEN COURT EASTERN DISTRICT OF VIRGINIA AUG 1 3 2015 Alexandria Division CLERK, U.S. DISTRICT COU RT ALEXANDRIA, VIRGINIA UNITED STATES OF AMERICA CRIMINAL NO.: 1:15-CR-: Count 1: Conspiracy to Commit Access Device Fraud (18 U.S.C. § 1029(b)(2)) V. ALEKSEI YURIEVICH BURKOV, a/k/a "Aleksey Yurevich Burkov,' Count 2: Access Device Fraud (18 U.S.C. §§ 1029(a)(2) and 2(a)) Defendant. Count 3: Conspiracy to Commit Wire Fraud (18 U.S.C. § 1349) Count 4: Wire Fraud (18 U.S.C. §§ 1343 and 2(a)) Forfeiture Notice Filed Under Seal AUGUST 2015 TERM - AT ALEXANDRIA, VIRGINIA INDICTMENT THE GRAND JURY CHARGES THAT: At all times material to this Indictment: 1. Defendant ALEKSEI YURIEVICH BURKOV, a/k/a "Aleksey Yurevich Burkov," is a Russian national who has resided in Tyumen and Saint Petersburg, Russia. 2. The term "carding" refers to various criminal activities associated with stealing financial information and personal identification information belonging to other individuals, including information associated with credit cards, bank cards, debit cards, or other access devices (collectively, "payment cards") - and using that information to obtain money, goods, or Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 2 of 12 PageID# 2 services without the victims' authorization or consent. The stolen payment card information often includes, among other things, the card type (e.g., credit or debit), account holder's name, account number, card verification value or code ("CVV" or "CVC"), and the expiration date of the card. The term "card shop" refers to an online store that sells stolen payment card information. The term "dump" refers to the unauthorized copying of all the information contained in the magnetic strip of an active credit card, such as the card number and expiration date, with the intention of illegally making a fake credit card that can be used by cybercriminals to make purchases. 3. In a typical payment card transaction, after a payment card is swiped through a magnetic stripe reader, the software at the point-of-sale terminal transmits payment card information and transactional information (e.g., price and merchant identification number) electronically to an acquirer. An acquireris a financial institution that initiates and maintains contractual agreements with merchants for the purpose of accepting and processing payment card transactions. The acquirer electronically routes the transactional and payment card information it receives through the appropriate card network (e.g., Banknet for Mastercards and VisaNet for Visa cards) to the cardholder's issuing bank to be approved or declined. The credit card issuer receivesthe transaction information through the card network and checks, among other things, whether the transaction is valid, the cardholder has a sufficient balance, and the account is in good standing. The card issuer then electronically transmits an approval or declination response code through the appropriate card network to the acquirer, which forwards it to the merchant. 4. At all times material to this Indictment, the data center of a particular major U.S. credit card company ("Company-1") for processing payment card transactions was located outside of the Commonwealth of Virginia. Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 3 of 12 PageID# 3 5. At all times material to this Indictment, a major bank that issues credit cards ("Bank-l") had its corporate headquarters in McLean, Virginia, in the Eastern District of Virginia. 6. From at least early 2009 through at least August 2013, BURKOV controlled and operated a card shop known as Cardplanet LLC and Cardplanet.cc ("Cardplanet"), which did business through the website www.Cardplanet.ee (the "Cardplanet Website"). The Cardplanet Website, which contained the user interface for customers who bought stolen payment card data, was hosted on a server located outside the United States. Cardplanet sold payment card data for virtually all major U.S. payment cards, including cards under the Company-1 brand and issued by Bank-1. To date, stolen card data sold on the Cardplanet Website has resulted in estimated fraud losses exceeding $20,000,000. COUNT ONE (Conspiracy to Commit Access Device Fraud) The Scheme to Defraud 7. From at least early 2009 through at least August 2013, in the Eastern District of Virginia and elsewhere, the defendant, ALEKSEIYURIEVICH BURKOV, a/k/a "Aleksey Yurevich Burkov," did knowingly and with intent to defraud, combine, conspire, confederate, and agree, with other persons known and unknown to the Grand Jury, to traffic in and use one and more unauthorized access devices, to wit, payment card account numbers and card verification values, during a one- year period, and by such conduct obtain things of value aggregating $1,000 and more during that period, to wit, lines of credit associated with numerous payment cards, including, but not limited Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 4 of 12 PageID# 4 to, Company-1 cards with account numbers ending in 1149 and 9022, respectively, in violation of Title 18, United States Code, Section 1029(a)(2). Manner and Means 8. As a part of the fraudulent scheme, in order to promote Cardplanet, BURKOV advertisedthe Cardplanet Website on underground carding forums to which he belonged. To distinguishCardplanetfrom other card shops, BURKOV advertisedCardplanet as the only service that would refund the price of invalid card data. Further, in order to maintain a constant supply of stolen credit and debit card data that would be sold on the Cardplanet Website, BURKOV solicited sales of stolen payment card data by other cyber criminals on carding forums. 9. Through the Cardplanet Website, BURKOV offered for sale data from more than 150,000 compromised payment cards - including cards branded in the names of the largest credit card companies in the United States - knowing that such stolen data would be used to create counterfeit cards in order to make fraudulent purchases. The price for stolen data from one card varied between $2.50 and $60, depending on the card type, country of origin of the card, and the availability of the cardholder's personal identifying information, such as the cardholder's name and address. The compromised cards included at least tens of thousands of cards which had been issued to cardholders in the United States, some of whom were residents of the Eastern District of Virginia. Many of the compromised cards had been issued by Bank-1, which was headquartered in the Eastern District of Virginia. 10. As a further part of the fraudulent scheme, in order to encourage potential customers to buy stolen payment card data from Cardplanet, BURKOV offered a fee-based service, named "checker," on the Cardplanet Website which enabled customers to instantly Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 5 of 12 PageID# 5 validate stolen payment card numbers that the customer purchased. BURKOV also promised to replace payment card numbers that were found to be invalid by the checker. 11. Cardplanet accepted payment through digital currency services such as Liberty Reserve and WebMoney, which were favored by cyber criminals because these services generally did not verify the identity of their account holders. Cardplanet also used conventional money transfer systems such as Western Union and MoneyGram, through which transactions could be completed using intermediaries known as "money mules," thereby concealing the true identities of the customers. 12. As a further part of the fraudulent scheme, co-conspirators who purchased stolen payment card data on the Cardplanet Website encoded the data on counterfeit cards embossed with the corresponding payment card company's logo, without the payment card company's knowledge or consent. These co-conspirators then used the counterfeit payment cards to purchase goods and services fi-om merchants throughout the United States and elsewhere, including merchants located in the Eastern District of Virginia. A portion of the fraudulent purchases were made in person, by presenting the counterfeit payment card to the merchant. Other purchases were made over the Internet, without the fraudulent card being present. To date, the stolen payment card data that BURKOV sold on the Cardplanet Website were used in fraudulent transactions with an estimated aggregate value exceeding $20,000,000. Overt Acts 13. It was a further part of the conspiracy that the following acts in furtherance of and to effect the object of the above-described conspiracy were committed in the Eastern District of Virginia and elsewhere: Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 6 of 12 PageID# 6 a. On or about November 13,2011, BURXOV made a posting on a Russian- language carding forum which advertised the Cardplanet Website as a purveyor of "CVV2 Cards & DUMPS." The posting indicated that prices for "CVV2 Cards" were between $2.5 and $10 per card, while the price for "dumps" were between $12 and $35. b. On or about November 17,2011, BURKOV made another posting on another Russian-language carding forum to promote the Cardplanet Website. That posting indicated that Cardplanet used automated billing through WebMoney and Liberty Reserve, had a good selection of cards and dumps, and based prices on market demand. c. On or about February 3, 2012, a co-conspirator not named as a defendant herein engaged in a financial transaction at a fast food restaurant in Richmond, Virginia, in the Eastern District of Virginia, using a counterfeit Company-1 small business charge card encoded with stolen card data sold on the Cardplanet Website. d. On or about March 15,2013, a co-conspirator not named as a defendant herein engaged in a financial transaction at a convenience store in Fredericksburg, Virginia, in the Eastern District of Virginia, using another counterfeit Company-1 credit card encoded with stolen card data sold on the Cardplanet Website. e. On or about December 3, 2013, BURKOV sold stolen data for six credit cards to an undercover agent through the Cardplanet Website. (All in violation of Title 18, United States Code, Section 1029(b)(2)) Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 7 of 12 PageID# 7 COUNT TWO (Access Device Fraud) THE GRAND JURY FURTHER CHARGES THAT: 14. The factual allegations in Paragraphs 1 through 6 and 8 through 12 are re-alleged and incorporated as if fully set forth here. 15. From at least early 2009 through at least August 2013, ALEKSEI YURIEVICH BURKOV, knowingly and with intent to defraud, did traffic in and use one and more unauthorized access devices, to v^t, payment card account numbers and card verification values, during a one-year period, and by such conduct did obtain things of value aggregating $1,000 and more during that period, to wit, lines of credit associated with numerous payment cards, including, but not limited to, Company-1 cards with account numbers ending in 1149 and 9022, respectively. (All in violation of Title 18, United States Code, Sections 1029(a)(2) and 2(a)) COUNT THREE (Conspiracy to Commit Wire Fraud) THE GRAND JURY FURTHER CHARGES THAT: 16. The factual allegations in Paragraphs 1 through 6 and 8 through 12 are re-alleged and incorporated as if fully set forth here. 17. From at least early 2009 through at least August 2013, in the Eastern District of Virginia and elsewhere, the defendant, ALEKSEI YURIEVICH BURKOV, did knowingly combine, conspire, confederate, and agree, with other persons known and unknown to the Grand Jury, to devise and intend to devise a scheme and artifice to defraud, and Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 8 of 12 PageID# 8 for obtainingmoney and property, to wit, the scheme described in Paragraphs 8 through 12, such scheme affecting a financial institution, by means of materially false and fraudulent pretenses, representations, and promises, and for the purpose of executing such scheme and artifice, and attemptingto do so, to transmit and cause to be transmitted, by means of wire communication in interstate and foreign commerce, certain writings, signs, signals, pictures, and sounds, to wit, payment card-related information was transmitted over the Internet from merchant point-of-sale terminals in the Eastern District of Virginia to computers outside the Commonwealth of Virginia, in violation of Title 18, United States Code, Section 1343. Overt Acts 18. It was a further part of the conspiracy that the following acts in furtherance of and to effect the object of the above-described wire fraud conspiracy were committed in the Eastern District of Virginia and elsewhere: a. On or about November 13, 2011, BURKOV made a posting in a Russian- language carding forum which advertised the Cardplanet Website as a purveyor of "CVV2 Cards & DUMPS." The posting indicated that prices for "CVV2 Cards" were between $2.5 and $10 per card, while the price for "dumps" were between $12 and $35. b. On or about November 17,2011, BURKOV made another posting on another Russian-language carding forum to promote the Cardplanet Website. That posting indicated that Cardplanet used automated billing through WebMoney and Liberty Reserve, had a good selection of cards and dumps, and based prices on market demand. c. On or about February 3, 2012, a co-conspirator not named as a defendant herein caused a point-of-sale terminal at a fast food restaurant in Richmond, Virginia, in the Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 9 of 12 PageID# 9 Eastern District of Virginia, to transmit via the Internet payment card data acquired from the Cardplanet Website to a Company-1 server located outside the Commonweahh of Virginia. d. On or about March 15, 2013, a co-conspirator not named as a defendant herein caused another point-of-sale terminal at a convenience store in Fredericksburg, Virginia, in the Eastern District of Virginia, to transmit via the Internet payment card data acquired from the Cardplanet Website to a Company-1 server located outside the Commonwealth of Virginia. e. On or about December 3, 2013, BURKOV sold stolen data for six credit cards to an undercover agent through the Cardplanet Website. (All in violation of Title 18, United States Code, Section 1349) COUNT FOUR (Wire Fraud) THE GRAND JURY FURTHER CHARGES THAT: 19. The factual allegations in Paragraphs 1 through 6 and 8 through 12 are re-alleged and incorporated as if fully set forth here. 20. From at least early 2009 through at least August 2013, in the Eastern District of Virginia and elsewhere, the defendant, ALEKSEIYURIEVICH BURKOV, did knowingly devise and intend to devise a scheme and artifice to defraud, and for obtaining money and property, to wit, the scheme described in Paragraphs 8 to 12, such scheme affecting a financial institution, by means of materially false and fraudulent pretenses, representations, and promises, and for the purpose of executing such scheme and artifice, and attempting to do so, did transmit and cause to be transmitted, by means of wire communication in interstate and foreign commerce, certain writings, signs, signals, pictures, and sounds, to wit, payment card-related information was transmitted via the Internet from merchant point-of-sale terminals in the Eastern 9 Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 10 of 12 PageID# 10 District of Virginia to computers outside the Commonwealth of Virginia, in violation of Title 18, United States Code, Section 1343. (All in violation of Title 18, United States Code, Sections 1343 and 2(a)) NOTICE OF FORFEITURE 1. The defendant is hereby notified, pursuant to Fed.R.Crim.P. 32.2(a), that upon conviction of the offense set forth in Count 1 of this Indictment, the defendant, ALEKSEIYURIEVICH BURKOV, shall forfeit to the United States of America, pursuant to Title 18, United States Code, Section 982(a)(2)(B), and Title 28, United States Code, Section 2461(c), any property, real or personal, involved in such violation, or any property traceable to such property; and pursuant to Title 18, United States Code, Section 1029(c)(1)(C), any personal property used or intended to be used to commit the offense described in Count I of this Indictment. Specifically, the United States seeks forfeiture of: a. a sum of money equal to at least $21,400,000 in United States currency, representing or traceable to the gross receipts obtained as a result of such violation; and b. 2. the domain name Cardplanet.cc. Upon conviction of the offense set forth in Count 2 of this Indictment, the defendant, ALEKSEI YURIEVICH BURKOV, shall forfeit to the United States of America, pursuant to Title 18, United States Code, Sections 981(a)(1)(C), and Title 28, United States Code, Section 2461(c), any property, real or personal, constituting, or derived from, proceeds traceable to such violation. Specifically, the United 10 Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 11 of 12 PageID# 11 States seeks a sum of money equal to at least $21,400,000 in United States currency, representing the amount of proceeds obtained as a result of such violation. 3. If any of the property described above as being forfeitable pursuant to Title 18, United States Code, Section 981(a)(l){C); 982(a)(2)(B); 1029(c)(1)(C); and Title 28, United States Code, Section 2461(c), as a result of any act or omission of the defendant: a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third party; c. has been placed beyond the jurisdiction of the court; d. has been substantially diminished in value; or e. has been commingled with other property which cannot be divided without difficulty; it is the intention of the United States of America, pursuant to Title 21, United States Code, Section 853(p), as incorporated by Title 28, United States Code, Section 2461(c); and Title 18, United States Code, Sections 982(b)(1) and 1029(c)(2), to seek forfeiture of all other property of the defendant up to $21,400,000, asdescribed in paragraphs 1 and 2 above. (All pursuant to Title 18, United States Code, Sections 981(a)(1)(C); 982(a)(2)(B); 1029(c)(1)(C), and Title 28, United States Code, Section 2461(c)) 11 Case 1:15-cr-00245-TSE Document 1 Filed 08/13/15 Page 12 of 12 PageID# 12 A TRUE BILL: to the H Goverament Act, tb3 original of Ihiii page has been f;icd un^ler seal :V. Ike Clerk's Forepersonof the Grand Jury DANAJ. BOENTE UNITED STATES ATTORNEY Kellen S. Dwyer Assistant United States Attorney Robert E. Wallace Sarah Y. Lai Senior Counsel, U.S. Department of Justice ComputerCrime & Intellectual Property Section 12