Case Document 3-3 Filed 01/23/20 Page 1 of 62 PageID 61 UNITED STATES DISTRICT COURT DISTRICT OF RHODE ISLAND IN RE: CRIMINAL COMPLAINT Misc.No. I:g0-? LDH MOTION TO SEAL The Government moves to have this Motion to Seal, along with the attached Criminal Complaint, Affidavit, Cover Sheet and Arrest Warrant, sealed until further Order of this Court. Disclosures may impede investigation and effectuation of an arrest warrant. The Government is permitted to share the attached Criminal Complaint, Affidavit, Cover Sheet and Arrest Warrant with law enforcements agents, as necessary for the effectual-ion of arrest and with the Court and probation officials in any arresting district, as necessary for initial appearance and detention proceedings. Respectfully submitted, UNITED STATES OF AMERICA By its attorneys, AARON L. WEISMAN . 1.120 1? MILIND S. SHAH Assistant United States Attorney US. Attorney's Office 50 Kennedy Plaza, 8?11 Floor Providence, RI 02903 (401) 709-5000 (401) 709-5001 (fax) SO ORDERED: INCOLN D. ALMOND UNITED STATES GISTRATE JUDGE 2-3 2.4? 20 Case Document 3-3 Filed 01/23/20 Page 2 of 62 PageID 62 A0 442 {Rev Hill} Arrest Warrant UNITED STATES DISTRICT COURT for the United States of America v. CaseNo. A0- We 01 fold . Abrar Anjum (YOB: 1986) De?andanr ARREST WARRANT To: Any authorized law enforcement officer YOU ARE COMMANDED to arrest and bring before a United States magistrate judge without unnecessary delay (name of person to be arrested) Abrar Anium who is accused of an offense or violation based on the following document ?led with the court: CI Indictment Cl Superseding Indictment Cl Information Superseding Information dComplaint Cl Probation Violation Petition CI Supervised Release Violation Petition Cl Violation Notice CI Order of the Court This offense is briefly described as follows: Wire fraud: 18 USS. 1343. Conspiracy to commit wire fraud: 18 1349, and Telemarketing or email marketing fraud: 18 U.S.C. 52326. Date: 13/2524) WW VW signature City and state: Providence, RI Lincoln 0. Almond+ U.S. Magistrate Judge Printed name and title Retu rn This warrant was received on (date) . and the persm was arrested on (date) at (city and store) Date: Arresting o?cer '3 signature Primed name and title Case Document 3-3 Filed 01/23/20 Page 3 of 62 PagelD 63 A0 91 (Rev. 11H Criminal Complain: UNITED STATES DISTRICT COURT for the District of Rhode Island United States of America Abrar Anjum Defendantfs} CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief. On or about the date-(S) of May. 2019 in the county of in the District of Rhode Island the defendant(s) violated: Code Section (?ame Description 18 Wire fraud: 18 U.S.C. 1349; and Conspiracy to commit wire fraud; and 1B U.S.C. 2325. Telemarketing or email marketing fraud. This criminal complaint is based on these facts: See the attached Af?davit of Special Agent, Craig A. Graham. of the Federal Bureau of Investigation 3? Continued on the attached sheet. a; . . Compfoinam Signature pecial Agent. Craig A. Graham FBI Printed name and title Sworn to before me and signed in my presence. Date: I 23/202? t'r I Judge '5 signature 3 CRY and state: Providence. Rhode Island Lincoln D. Almond, U.S. Magistrate Judge Printed name and tide Case Document 3-3 Filed 01/23/20 Page 4 of 62 PageID 64 PER 18 U.S.C. DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN U.S. DISTRICT COURT INFORMATION INDICTMENT COMPLAINT CASE NO. MatterSealed: Juvenile Otherthan Juvenile USA US. I HJF oq Pro-Indictment Plea Su ersedin Defendant Added Abrar An'um CI Defendant: I Indictment ChargesrCounts Added information Unknown Name of District Court, anoior JudgeIMagistrate Location (City) Address: IndIa UNITED STATES DISTRICT oouer RHODE ISLAND DISTRICT OF RHODE ISLAND Divisional foioe AARON WEISMAN Name and Of?ce of Person Furnishing Information on .U.S. Atty I:IOther LLS. Agency . . THIS FORM Phone NO. (401) 71395000 Interpreter Reqmred DIalect. Name of Asst. us. Attorney M. Shah (ifassignedt gig: 7i23f1936 IE Male El Alien ifa Iioable PROCEEDING CI emate I pp Name of Complainant Agency. or Person Is Title. if any} Craig A. Graham. Special Agent - FBI Social Securlty Number '3 person is awaiting trial in another Federal or State Court Igiye name of court) DEFENDANT Issue: Warrant Summons this personfproceeding transferred from another district per (circle one} 2t]. 21 or 40. Show District Location Status: Arrest or Date Transferred to Federal Custody this is a reprosecmion of charges . previously dismissed which were Currently Federal dlsm'md on mom" or Currently in State Custody this My El Dafense snow Writ Required this prosecution relates to a DOCKET NO. Currently on bond pending case involving this same defendant. (Notice of Related FugItIye Case must still be ?led with the Clem} MAG JUDGE - prior proceedings or appearancets) CASE NO. Defense Counsel (If any}: before US. Magistrate Judge regarding this defendant were A recorded under FPD Appointed on Target Letter Place of offense RHODE ISLAND County I: This report amends A0 25? previously submitted OFFENSE CHARGED - U.S.C. CITATION STATUTORY MAXIMUM PENALTIES - ADDITIONAL INFORMATION OR COMMENTS Total of Counts 3 Set Title 8? Section! Offense Level Description of Offense Charged tPettv 1 Misdemeanor 3! Felony Fetony See Attachment Misdemeanor Felony Misdemeanor Felony Misdemeanor Felony Misdemealry; Felony Misdemeanor Estimated Trial Days: 5 Case Document 3-3 Filed 01/23/20 Page 5 of 62 PageID 65 ATTACHMENT TO DEFENDANT COMPLAINT RELATIVE TO A CRIMINAL ACTION - IN US. DISTRICT COURT DEFENDANT: Abrar Anjum COUNT I: 18 U.S.C. 1343: Wire Fraud - Felony. MAXIMUM PENALTIES: Imprisonment: 20 years; Supervised release: 3 years; Fine: $250,000; and Special assessment: $100. COUNT II: 18 U.S.C. 1349: Conspiracy to Commit Wire Fraud Felony. MAXIMUM PENALTIES: Imprisonment: 20 years; Supervised release: 3 years; Fine: $250,000; and Special assessment: $100. COUNT 18 U.S.C. 2326: Telemarketing or email marketing fraud Felony. MAXIMUM PENALTIES: Imprisonment: 5 years; Supervised release: 3 years; Fine: $250,000; and Special assessment: $100. Case Document 3-3 Filed 01/23/20 Page 6 of 62 PagelD 66 AFFIDAVIT OF FBI SPECIAL AGENT CRAIG A. GRAHAM I. INTRODUCTION I, Craig A. Graham, having been duly sworn, state as follows: 1. Since 2010, I have been a special agent with the Federal Bureau of Investigation Early in my career, I focused on counterintelligence investigation. Starting in 2015, my responsibilities expanded to include the investigation of wire fraud, mail fraud, and other white collar offenses, and since July 2018, when I was assigned to the Providence Resident Agency, I have focused primarily on white collar investigation. I have experience in the investigation of telemarketing fraud, and through that work have gained a familiarity with computer or smartphone based communication applications such as WhatsApp, Snapchat, and Skype. 2. I submit this af?davit in support of criminal complaints and arrest warrants (bom? and Abrar Arljum (born July 1986) (?Anjum?), all Indian residents, with the following offenses: wire fraud, in violation of 18 U.S.C. ??1343, (ii) conspiracy to commit wire fraud, in violation of 18 U.S.C. 1349, and telemarketing or email marketing fraud, in violation of 18 U.S.C. 2326. 3. The information in this af?davit comes from my personal observations and investigation, my training and experience, other law enforcement agents, an FBI source of information, and other sources as specified in the body of this affidavit. This affidavit is intended to show that there is sufficient cause for the requested warrant and does not set forth all of my knowledge about this matter or investigation. 4. Based on my investigation, I believe that there is probable cause to believe that a. - and others conspired to and did defraud or attempt to defraud multiple victims by misleading them into believing that ?1eir computers had been attacked by Case Document 3-3 Filed 01/23/20 Page 7 of 62 PageID 67 malware, by obtaining remote access to the victims computers, and by extracting money from the victims; b. -and others conspired to and did defraud or attempt to defraud multiple victims by misleading them into believing that their computers had been attacked by malware, by obtaining remote access to the victims? computers, and by extracting money from the victims; c. - Anjum, and-and others conspired to and did defraud or attEInpt to defraud multiple victims by misleading them into believing that their computers had been attacked by malware, by obtaining remote access to the victims? computers, and by using that remote access or some other means to extract money from the victims? accounts; d. -, Abrar, and-on one occasion conspired to and did defraud or attempt to defraud a victim, PH, by misleading her into believing that her computer had been attacked by malware, by obtaining remote access to her computer, and by using that remote access or some other means to extract money from her accounts. 11. INVESTIGATION Summary of Investigation 5. The investigation described below involved two phases. The first involved a review of records and recordings that indicated that- and- engaged in tech support fraud with others. 6. The second phase of this investigation involved using a cooperating informant who at the direction offered to provide- a bank account through which to funnel money obtained from victims. In communications with- that were roughly contemporaneous to money transfers to the account, the informant was able to obtain evidence of how the money had been obtained from the victims. Those commrmications also revealed that-rid Anjum were acting in concert with or assisting- in obtaining that victim money, and ultimately the informant was able to communicate directly with both- and Anjum and further establish the nature of their actions. 2 Case Document 3-3 Filed 01/23/20 Page 8 of 62 PageID 68 Initial Infomotion Provided by Infomant In May 2019, the FBI arrested a male in the United States on charges that included conspiracy to defraud and multiple instances of wire fraud and bank fraud. The male shortly after his arrest began cooperating with the FBI in the hope of receiving leniency in the disposition of the pending charges. The male is hereinafter referred to as the ?Informant.? 8. The Informant, an Indian citizen and resident, has not previOusly been convicted of any crimes in the United States. The FBI is not aware of whether the Cooperator has ever been convicted of crimes in India, but the Cooperate: reports that he has never been jailed in India. 9. In May 2019, after his arrest, the Informant told me that an acquaintance who resided in India,- was involved in telemarketing scams that defrauded people residing in the United States. The Informant referred to these specific types of scams or schemes as ?tech support fraud." 10. The Informant described himself and- as brokers engaged in tech support fraud. He explained that they bought telephone call traffic, specifically calls placed by people who, based on advertising that they had seen on their computers, believed that their computers had been or were being attacked by malware. The Informant explained that such advertising was not based on any information indicating that the callers? computers had malware problems and also explained that the advertising was often targeted toward those likely to lack computer or software expertise. 11. The Informant explained that he had sold such call traf?c to-and had per -instructions directed that call traffic to call center operators who solicited the callers to purchase purported computer assistance services. 12. In December 2019, the Informant told me that another acquaintance who resided in India, -, was also separately involved in tech support fraud. The Informant also told me - used to work at a call center and then later started his own call center in India and began buying calls from the Informant. Case Document 3-3 Filed 01/23/20 Page 9 of 62 PagelD 69 13. The Informant described the role of publishers? in the tech support fraud. He explained that publishers created various forms of online advertising, including pop-up ads,1 designed to mislead viewers into believing that malicious software or malware was attacking their computers. For example, the Informant suggested that a publisher could place ads on Facebook offering travel agent services for retirees interested in cruise vacations. A viewer who clicked on the ads would be directed to a page that would state that the viewer's computer had been infected by a virus or was being attacked by malware and advise the viewer to call a particular telephone number. 14. The Informant explained that brokers could purchase from a publisher the calls generated by such advertising. Using call routing technologies, the publisher would route incoming calls to the broker. The broker in turn could sell the calls by re-routing them directly to call centers or to other brokers who ultimately had the calls routed to call centers. 15. The Informant explained that call centers, specifically those involved in telemarketing fraud, were facilities designed to accept incoming calls and extract money from the callers. Typically, call centers were comprised of multiple operators, each of whom would be familiar with the sort of advertising that had been seen by the callers. The operators would accept the calls generated by the publishers? advertising and seek to extract money from the callers by purporting to provide computer protection services. 16. The Informant said that prior to his arrest by FBI and prior to becoming a source of information for the FBI, he had routed call traf?c to- and - knowing that the callers would be defrauded or that there would be attempts to defraud the callers, and that call traffic routed by the Informant to-and separately to - included many calls from U.S. telephone numbers. The Informant also explained that the informant sold and directed call 1 The Cooperator explained, and I know from my training and experience, that pop-up ads are a particular form of online advertising. While one is browsing internet sites, a separate browser window pops up, and that new window must be closed or disabled in order to continue browsing activities. Case Document 3-3 Filed 01/23/20 Page 10 of 62 PageID 7O traffic to buyers, including-and other call centers by utilizing at least two, third party call-tracking and call routing software platforms. For convenience, Irefer to these call routing software platforms as and Identi?cation of- The Informant identified a particular WhatsApp account?- as belonging to -The telephone number associated with that account was? an Indian telephone number. The accounts profile picture shows an individual who the lnformant identified as-An enlarged copy of the profile picture is attached as Exhibit 1. 18. The Informant also identified a particular Skype account3 as belonging to -That account listed the vanity name, a user selected name, and a Skype account name of ?techs247." The account also indicated that the account holder?s date of birth was ?11/26.? 19. Visa application records obtained from the Department of State show that -visa application listed a birthdate of November 26, 198? and a home telephone number of the same number that is associated with the WhatsApp account identified by the Informant. The visa application included a photograph of the applicant, which the Informant identified as a photograph of-The visa photograph is attached as Exhibit 2, and the person pictured in it is visually similar to the male pictured in- WhatsApp profile photograph, Exhibit 1. 2 WhatsApp is a communications applications for mobile devices and desktop computers that allows users to send and receive text and voice messages, make and receive voice and video calls, and share images, documents, user location, and other media. All users of the application must have an account or access to an account. in the account creation process, users provide a cellular mobile number. WhatsApp is owned by Pacebook, Inc. 3 Skype is a communications application for mobile devices and desktop computers that allows users to send and receive text and voice messages, make and receive voice and video calls, and share images and other media. All users of the application must have an account or access to an account. Skype is owned by Microsoft Corporation. 5 Case Document 3-3 Filed 01/23/20 Page 11 of 62 PageID 71 Identification ofMishr-a 20. The Informant identified a particular Tl.IVlLatsApp account as belonging to - The telephone number associated with that account was an Indian telephone number. The account?s profile picture shows an individual who the informant identified as - An enlarged copy of the profile picture is attached as Exhibit 3. 21. The Informant also identified a particular Skype acc0unt as belonging to -. The accoont listed the vanity name and Skype account name The account listed the holder?s location as "new delhi, (The account listed the holder?s birthdate as "11/ Ti?) On the Skype pro?le page, there is account holder entered text that reads ?Zelle and Wire Accounts available.? 22. Visa application records obtained from the Deparhnent of State show that -s visa application listed a home telephone number of the same number that is associated with the WhatsApp account identified by the Informant. (The ?91? that begins the number sequence in the WhatsApp account is the country code for lndia.) The visa application included a photograph of the applicant, which the Informant identi?ed as a photograph of - (The application listed -s date of birth as - I -) The visa photograph is attached as Exhibit 4, and the person pictured in it is visually similar to the male pictured int-?5 WhatsApp profile photograph, Exhibit 3. 23. On January 14, 2020, - arrived at the Miami International Airport. A photograph of - was taken upon his entry into the United States. That photograph is included as Exhibit 5 and is visually similar to both -'s Visa application photo and his WhatsApp profile picture, respectively Exhibits 3 and 4. Identification ofAnjum 24. The Informant communicated with Anjum through two separate WhatsApp accounts, one of which was associated with U5. telephone number and the other was associated with Indian telephone number -. An enlarged copy of the profile picture for each account is attached as Exhibit 6. 6 Case Document 3-3 Filed 01/23/20 Page 12 of 62 PageID 72 25. Visa application records obtained from the Department of State show that Anjum?s visa application listed a date of birth of July 23, 1986 and a home telephone number of the same number associated with one of the aforementioned WhatsApp accounts. The visa application included a photograph of the applicant, and that photograph is attached as Exhibit 7. The person pictured in it is visually similar to the person pictured in Anjum?s WhatsApp profile photographs. Call Traffic Sold to-Usr'ng CRSI and Call Center Operators?Attempts to Scam the Callers 26. A review of records, including recorded calls, indicates that the Informant directed call traffic to a telephone number associated with- and that calls forwarded to that number resulted in the. call recipients attempting to exact money from the callers by posing as providers of computer protection services. Efforts were made to suggest that Microsoft was involved in detecting viruses on the callers? computers or that the call recipients were affiliated with Microsoft. However, Microsoft policy makes plain that it would not have been involved in those purported instances of virus detection and was not affiliated with the call recipients. The Informant provided access to his current CR51 account, and from the account records, I was able to isolate, as further described below, calls that had been directed from the Informant to- and was able to determine that the Informant sold those calls to -CR51 has multiple features to aid account holders in managing and tracking calls which are routed through the account. These features included the ability to create a ?Target" name for the person to whom the Informant was selling call traf?c. then monitored and tracked, among other information, how many calls were sent from the Informant to the buyer, whether the call was connected, and whether or not the call was a duplicate call. The Informant provided agents with a user ID and password for his CRSI account. The user ID was in the form of the lnformant?s email which had previoust been identified and associated with the Informant independently. Case Document 3-3 Filed 01/23/20 Page 13 of 62 PageID 73 28. According to CRSI, in 2019, the Informant sold approximately eight calls to - on January 29, 2019, and approximately five calls on February 4, 2019. Within the Informant's account, the Informant identi?ed the Target name - - - The Informant said that that he assigned that Target name to- using- first name. The Informant explained that by setting up a Target name for- the Informant could track the number of calls he sold to- 29. FBI agents reviewed CRSI records for all thirteen calls, each from a unique telephone number, that were sold by the Informant to-Twelve of the thirteen calls were dialed from U.S. telephone numbers; one call was dialed from a Canadian number. CRSI generally preserves recordings of the sold calls. Agents were able to locate and review recordings for ten of the calls made from US. telephone numbers. Review of those calls revealed the following: I In conversation with call center operators, the ten callers each said that they had received computer error messages that appeared to have locked or frozen their computers and that the messages indicated that their computers had been infected by a virus. - In two calls, the callers stated that they were calling because messages on their computers, which appeared to have become frozen or blocked, directed them to call the particular telephone number. - Five of the callers told the operators that the error message they received were from Microsoft. 0 The call center operators identified themselves as ?technical support" or "support." 0 A call center operator told one caller that the toll free number that the caller had dialed was for Microsoft Security Toll Free." Other call center operators said that the callers had reached ?Global Windows Support," "Windows Support,? and a ?Windows Technician." I- The call center operators said that they needed to connect remotely to the callers? computers and directed the callers to Case Document 3-3 Filed 01/23/20 Page 14 of 62 PageID 74 to enable the operators to obtain a remote connection. After obtaining remote access, the call center operators attempted to sell the callers computer service packages. 30. One of those calls from early 2019 originated from a telephone number with the area code of 561, which is assigned to the area of Palm Beach County, Florida. In conversation with the operator who received the call, the caller can be heard reporting that he received a pop- up on his computer and that his computer was making an audible sound. The operator can be heard directing the caller to use a screen sharing service called "Supremo Control? to enable the operator to access remotely the caller?s computer. The operator indicates that remote access has been obtained and then reports to the caller that ?bad guys? were accessing the caller?s network and that his computer was not secured. The operator then said that he for $200 could connect the caller to a network engineer who would fix the computer in two hours. The caller stated that he did not have $200. The caller ended the call after the operator suggested that the caller postdate a check. 31. Through publicly available information and the inbound telephone number captured by the FBI was able to identify the caller, who is for convenience referred to as PK. 32. On September 30, 2019, FBI agents spoke to PK via phone while PK was traveling outside of the United States. He identi?ed ldmself as PK and further identified himself through his address, phone number, and date of birth. PK relayed the following concerning the aforementioned call: - PK received a pop-up on his computer while trying to access an online university. The pop?up stated that it was from Microsoft and provided a 1? 800 number to fix the virus on his computer. 0 PK dialed the number and spoke to a representative. at The representative remotely connected to his computer using ?Supreme Control.? - PK saw the representative moving around on his desktop. 9 Case Document 3-3 Filed 01/23/20 Page 15 of 62 PageID 75 The representative asked PK to pay an amount of money, over $500, to fix his computer. I PK did not pay the representative and bought a new computer. 33. In relation to the calls described above, Microsoft policy indicates that the call centers had no relationship with the call center operators and that the messages appearing on the victims? computers did not come from Microsoft. Microsoft policy, as set forth on its publically accessible website, in the section entitled Protect yourself from tech support scams,? specifies that Microsoft error and warning messages never include a telephone number." -Buying Call Tra??icfrom the Infomant 34. Records of communications between- and the Informant indicate that - bought call traffic from the Informant, and that those purchases occurred during time periods that included January and February 2019, when as described above the lnformant?s CR9 account showed calls being routed to- 35. The Informant, after he was arrested arrest in May 2019, allowed investigators to extract electronic records from his cellular telephone. The extraction revealed WhatsApp and Skype text cominunications between the Informant's WhatsApp and Skype accounts and _WhatsApp and Skype accounts. In the text messages set forth below, which fall between August 2018 and February 2019,- and the Informant negotiate the purchase of call traffic and- commits to the purchase of call traffic. 36. In the following Skype exchange between the Informant and? asked about the price for calls, advised about his call center 5 cc? capacity (which means, as the Informant explained, the concurrent call capacity of the call center or the number of simultaneous calls that the call center could handle), indicated that money would be sent for 100 calls, and sought to provide the Informant with a toll free number (referred to as according to the Informant) to which to direct the calls. The Informant directed-to share the via ?group chat." 10 Case Document 3-3 Filed 01/23/20 Page 16 of 62 PageID 76 Date From Body 08/28/ 2018 - So wharme price you can 08/28/2018 Informant how many cc 08 28/2018 i 70:: 08/28/2018 Informant $14 08/28/2018 - 0k, should I 08/28/2018 Informant you can if you want i dont have issues 08 28 2018 - Ok Will transfer for 100 calls Zmoro Let?s test 08/28/2018 - Can you send calls today 08/28/2018 Informant yeah i can 08/ 28 2018 - should i share 08 28 2018 Informant group chat 08/ 28 2018 - 0k 37. The Informant told El agents that he had an office manager (hereinafter, Manager?) who assisted him and that he had had that person create a chat group to facilitate communications between the Informant, the Manager, and-. 38. In the following Skype exchange between the Informant, the Manager, and - the Informant instructed- to share the toll free number, with the group, and- provided it. Information about the Informant?s US. bank account was also shared, which would have enabled-to direct payment for the purchase of calls. 08/28/2018 please share TFN here [Manager] US bank details 08/28/2018 Manager [Informant?s US bank account details] 08/ 28 2018 Informant sir here 08/28/2018 i Yes 11 Case Document 3-3 Filed 01/23/20 Page 17 of 62 PageID 77 39. In the following Skype exchange between the Informant, the Manager, and -, the Manager described to- that the calls have a of $70 - $100, and- agreed to pre?pay and asked to test 50 calls. The Informant explained that RPC stood for return per call," the likely amount of money that could be extracted from the callers. Date From Body 01 10/ 2019 Manager High quality calls with guaranteed RPC over 1320-1 00 any cc doable .. if you dont get the RFC then dont pay 01 25/ 2019 Post payr or prepay 01/ 25/ 2019 Informant Pre pay 01 25/2019 Can we test with 50 calls 01/ 25/ 2019 Informant Yes when ever you want 01 25/ 2019 i Share your details Please I will get the wire done let?s test from Monday - 01 25/ 2019 Informant Ok let me send you sir 01 28/ 2019 [Informant] Still waiting for details 01 28/ 2019 Manager do know the pricing? 01/ 28/ 2019 Informant [Manager] send us bank details 01/ 28/ 2019 Manager [Informant?s US bank account details] (11/28/2019 i [Informant] do you know me 01 28 ,1 201 9 Manager Regarding 01/ 28/ 2019 i We have taken calls from you earlier was just checking if you can send few calls for now - I will wire today - 01/ 28/2019 Manager no sir sorry onlt prepay if want can make payment in indian account for some calls 01/23/ 2019 - Send me Indian account details 01 28 2019 Manager [lnformant?s Indian account details] 01/ 29/ 2019 sending $200 01 29 201 9 Manager 0k 01 29/ 2019 i Will we get calls today 12 Case Document 3-3 Filed 01/23/20 01/ 29/ 2019 Manager Yes 1.1 want calls? 01 29 2019 informant Yes sir you will [11/29/2019 - Yeahv I to waiting for USA guy to send me 55 Meanwhile I can transfer in India for few calls if you say Toll free 01 29 2019 Manager yes payment then we start 01 /29 /2019 Doing 20k Now [screen shot showing twenty thousand rupees transferred to the Informant} 01/29/ 2019 Manager 01 29 2019 - Transferred 01 29/ 2019 Manager its not showing amount 01 29 2019 - It should be with you ,you can check too 01 29 2019 Manager Ok (11/29/2019 i Please start Sec 01 29 2019 Manager Ok 1/3 01 29 2019 - Thanks Got it 01 29 2019 Manager Welcome 2 3 01 mew/2019 Calls 01 29 2019 Manager coming sir dont worry 01/ 29 2019 - Bhai can you refund us money for rest of calls 01 29 2019 Manager Why 01 29 2019 8 calls came in and everyr one said same thing You can deduct for 8 calls 01 29/ 2019 Manager they said 13 Page 18 of 62 PageID 78 Case Document 3-3 Filed 01/23/20 Page 19 of 62 PageID 79 01 29/2019 - They said 3rd party Microsoft sarne Lines So I don?t need more calls No hard feeling You can transfer me 101: back And rest you can keep Don?t send more calls 01 29/ 2019 Manager no issue sir we can refund these days all customers are familiar with these types of pop up ok pausing 01 29/ 2019 Thanks ?82? ICIC0001400 40. In the following Skype exchange between the InfOIInant and-- provided a telephone number and instructed the Informant to direct calls to it. The Informant instructed-to text the information to the group, rather than in a private message or II prn. Date Body 02/04/2019 Guys use this Make sure please send good quality BCC 02 05 2019 - Guys anyone there 02/ 05/ 2019 lnforrnant This is pm 02 05 2019 i [brother] connect me there Can?t Find Group 14 Case Document 3-3 Filed 01/23/20 Page 20 of 62 PageID 8O 41. In the following WhatsApp group exchange between the Informant, the lnforrnant?s manager, and_ provided a telephone number and requested that the Informant direct calls to the number. Date From Body 02/05/2019 - Hi guys Please send on this number Good quality 02/ 05/ 2019 - Anyone here Guys send 3 cc 02 05 2019 Manager Yes 02/ 05/ 2019 i Please start SCC good quality this time 02/05/2019 i 02/ 05/ 2019 Manager live 02/05/ 2019 - Thanks 02/ 05/ 2019 - No call yet Not even 1 02/ 05/2019 Manager sir budget exhaust ho gaya tha updating funds wait p12 (sir budget got exhausted updating funds wait)4 02/05/ 2019 i? Ok thanks Please do - 02/ 05/2019 Manager 1 live 02/05/2019 - Guys Send us calls 02/ 05/ 2019 Manager 1 running 02 05 2019 Manager 5 calls yesterday 4 A linguist fluent in Hindi and English provided the text translations for this af?davit. 15 Case Document 3-3 Filed 01/23/20 Page 21 of 62 PageID 81 Call Tra?ic Sold to- 42. Records of communications between- and the Informant indicate that in August and September of 201?- bought call traffic from the Informant and had that call traffic directed to a particular telephone number. From late Ma}r through early June of that same year, there were complaints of that number being used by individuals misrepresenting themselves to be Microsoft representatives. 43. The Informant advised that he sold calls to - using his CRSZ account. The Informant advised that all of the calls were sold for the purpose of conducting tech support fraud. 4-1. In the following August 201? Skype exchange between the Informant and -, which were extracted from the Informant?s cellular telephone, - discusses purchasing 10 which the Informant explained references the capacity to receive ten concurrent or simultaneous calls. The Informant advises that the calls would be priced at $10 per call. - then provides the Informant with an email address so that- could track the calls being sold to him. At the end of the exchange - confirmed that only 58 calls were sent to him. Date From Body 08/ 04/ 2017 10cc de doge (Will you give 10cc?) 08 04 2017 Informant ji (Yes) 08/04/ 2017 - what rate 08 04/ 2017 Informant 810 08/04/2017 - INR mei batao baba (tell me in Indian rupees friend) 08 04 2017 Informant 650 08/04/2017 - ok when can start? 08/ 04/ 2017 Informant in 12 mins 08/ 04/ 2017 ok ping me when started 16 Case Document 3-3 Filed 01/23/20 Page 22 of 62 PageID 82 08/04/2017 Informant ok 08/04/2017 start nhi hua? (did it start) 08/04/2017 Informant started hai but slow hai (it started but is slow) 08/04/2017 5 cc hi de do jab tak slow (friend give me 5cc till it is slow) baba har baar hi apna count difference ata (everytime I get a count difference) 08/04/2017 Informant baba (friend) yr email dedo (give me email) access deta hu ka (will give you access to (C853) dekh Iena (take a look) khud (yourself) aur kya olu (and what can I say) bolu (tell me) I use (I use not [other call routing system] (not (other call routing system? 08/04/2017 jada difference bhia (there is a lot of difference brother) aroond 10-15 calls ka (for aroond 1045 calls) 08/05/2017 baba i have 58 calsl only (friend I have 58 calls only) check again (pls check again) 08/05/2017 Informant Dat end (that end) 08/05/2017 ok baba (ok friend) 17 Case Document 3-3 Filed 01/23/20 Page 23 of 62 PageID 83 08/ 04/ 2017 Informant ok 08/04/2017 start nhi hua? (did it start) 08/04/2017 Informant started hai but slow hai (it started but is slow) {18/04/ 2017 5 cc hi de do jab talc slow (friend give me 5cc till it is slow) baba har baar hi apna count difference ata I get a count difference) 08/04/2017 Informant 08/04/2017 baba (friend) yr email dedo (give me email) access deta hu ka (will give you access to dekh lena (take a look) khud (yourself) aur kya olu (and what can I say) bolu (tell me) I use (I use ((1182)) not [other call routing system) (not (other call routing system? jada difference 11 bhia (there is a lot of difference brother) around 10-15 calls ka (for around 10-15 calls) 08/05/2017 baba ihave 58 calsl only (friend I have 58 calls only) 1315 check again (pls check again) 08/05/2017 Informant Bat and (that end) 08/05/2017 ok baba (ok friend) 17 Case Document 3-3 Filed 01/23/20 Page 24 of 62 PageID 84 45. lo the following Skype exchange between the Informant and requested that fifteen to twenty calls be sent to his call center and provided a toll free number for the call center. The Informant then directed - to continue the conversation in a group chat. Date From Body 09/16/2017 Baba can send calls to me at 2cc (Friend can you send calls to me at 20:) 15-20 calls Need for my center Hanji malik? (Yes boss?) 09/ 16/2017 Informant After 10 Karwa duga (Will get it done) Baba (friend) 09/ 16/ 2017 0k baba (ok friend) Agents are waiting just need 15-20 calls at 2 cc 16/ 2017 Informant Ii baba (yes friend) 09/16/ 2017 - Baba (friend) Kara do start ab (get it started now) Agents are idle Yaar baba kya hua? (Friend what happened?) Kaha Gaye (Where are you?) Baba jee (friend) Baba (Friend?) Dhokha de diya baba turnne (you cheated me friend) Center 1-: lie bhi (for the center also) Baba 7?50 Mei de do yaar 2 cc only needed (friend give it to me for 750, 2 cc only needed) 09 16 2017 informant Baba calls nai aarahi hai (Friend calls not coming through) 09/18/ 2017 - baba (friend) aaj (today) doge calls (will you give calls?) baba (friend) 18 Case Document 3-3 Filed 01/23/20 Page 25 of 62 PageID 85 09/ 18/ 2017 Informant bolo (tell me) 09/18/201? - calls kuch? (do yOu have some calls?) gareeb I: lie (for a poor person like me) 09/18/ 2017 lnformant centres ke liye only (for only centers) 09/ 18/ 2017 kya rate doge malik (what rate will you charge boss) 09/ 18/ 2017 Informant 7?00 per call 09/18/2017 - de do 10 cc 200 mei (give 10 cc for 700) if possible 09/ 18/ 2017 Informant 5 cc 09/18/ 2017 ok de do (ok give it) - 09/18/2017 Informant group chat 46. FBI agents reviewed FTC complaints by searching for the number From the time period of May 24, 2017? until lune 2, 2017, four complaints were identi?ed in which the subject phone number was referenced. The complainants stated that callers from that number claimed to be Microsoft technical support representatives. Three of the four complaints were submitted by Microsoft?s Cyber Crime Center, indicating that the purported representatives on the calls were not, in fact, associated with Microsoft. Conversation between the Infonnant and-?an: May 2019 - June 2019 and the Use of Remote Access to Extract Funds from Accounts 47. The Informant, at direction, communicated with- and offered to allow- to funnel funds into a bank account, an FBI covert account. 48. The Informant between May 2019 and June 2019, after he had been arrested and began assisting the FBI, had monitored communications with- via WhatsApp text messages and voice calls. In those conununications,- discussed defrauding victims. The Informant was in Rhode Island during all of those communications, and the calls and messages to-and received from- were recorded in Rhode Island. 19 Case Document 3-3 Filed 01/23/20 Page 26 of 62 PageID 86 49. On May 22, 2019,-attempted to call the Informant from telephone number_ via WhatsA pp. Shortly thereafter,- and the Informant exchanged text messages and spoke by telephone on three occasions. The calls were recorded. 50. In the calls, which I listened to, the Informant can be heard speaking in Hindi to a male, who the Informant identi?ed as-The calls were translated by a linguist ?uent in Hindi and English. The Informant advised that, as is common in the telemarketing fraud industry, the scam targets were referred to as ?customers." The linguist provided the following summary of the calls: 51. -advised that open ended trip. - told the Informant that he continued to get customers and asked if the Informant had any bank accounts that- could transfer money into. - advised that he would use the account for himself and that he would be able to have funds wired into the account in one to two days. The funds would come from a Chase bank account with a total amount of $180,000. The account could do wire transfers of $25,000 per day. The Informant asked- to send a copy of the wire slip once the transaction was done. The Informant asked- what the customer was told, and - stated that he had not told the customer anything. - explained that the wire would be done without the customer's knowledge. When the Informant asked about a one- time password that would be sent to the customer,- replied with a laugh and said that they would obtain the password and the Informant shouldn't worry about it. - advised that he talked to the customer every day and had activated the account for wire transfers with a limit of $25,000. - asked about pricing, and the Informant told-that he would be given 75 percent of the amount within 2448 hours after doing the wire. - stated he would send the Informant a screen shot of the wire when completed. I know from my training and experience as well as from my investigation of electronic account intrusions that financial accounts can be electronically accessed in at least two ways. First, one can obtain remote access to an account holder?s computer and use that 20 w. Case 1:20-cr-00067-JJM-LDA Document 3-3 Filed 01/23/20 Page 27 of 62 PageID #: 87 %Kc$+_c c c&6+PH+c+RS1HOR10cRNc/+DBcR61c#L3NPH+MRc2PNHcR1B1O6NK1 c&6+PH+ P &6+PH+ KXH.1Pc c\9+c)6+RQ OO cac&6NPRB_cR61P1+2R1P c&6+PH+c+K0cR61c"L2NPH+KRc1^/6+M510c R1^RcH1QQ+51Qc+K0cQONA1c._cR1B1O6NK1cNKcS6P11cN//+Q9NKQ c '61c/+BBQc]1P1cP1/NP010 c #KcR61c/+BCQ c]69/6c"cC;QR1K10cRN cR71c#L2NPH+MRc/+Mc.1c61+P0cQO1+A:K5c9Kc!09cRN Q &6+PH+ '61c/+DBQc]1P1cRP+MQB+R10c._c+cF5X9QRc2BX1KRc9Kc +cH+B1 c]6NcR61c"K2NPH,MRc901KR:3910c+Qc&6+PH+ c :K09c+K0c K5B9Q6 c '61c#L2NPH+KRc+0\9Q10cR6+R c+Qc9Qc/NHHNKc;KcR61cR1B1H+PA1R?5c2P+X0c 9K0XQRP_ cR61cQ/+HcR+P51RQc]1P1cP121PP10cRNc+Qc /XQRNH1PQ c '71cD=K5X9QRcOPN\9010cT1c2NCBN];K5c QXJH+P_cN2cR61c/+CBQ c b c&6+PH+c+0\9Q10cS7+Rc61c]+Qc;KcS61c(&cNKc+KcNO1Kc1K010cSP9O &6+PH+ b &6+PH+cRNB0cT1c#K2NPH+KRcR6+Rc61c/NKR;KX10cRNc51Rc/XQRNH1PQc+K0 &6+PH+ +QA10c:3cS71c#K2NPH+KRc6+0c+K_c.+LAc+//NXKRQcR6+Rc&6+PH+c/NXB0 A 0 :3 &6+PH+c RP+KQ21PcHNK1_c:KRN b &6+PH+c &6+PH+c+0\9Q10cS6+Rc61c]NXB0cXQ1cR61c+//NYKRc2NPc6;HQ1C2c+K0 R7+Rc61c]NXB0c.1c+.B1cRNc6+\1c2XK0Qc]9P10c;KRNcS71c+//N[Rc:KcNK1 RNcR]Nc0+_Q b '61c40Qc]NYB0c/NH1c2PNHc+c 6+Q1c.+LAc+//NZKRc]9S6c+cRNR+B +HNXKRcN2c c '61c+//NYKRc/NXB0c0Nc];P1cW+KQ21PQcN2 cO1Pc0+_ b &6+PH+c '71c#L2NPH+KRc+QA10c&6+PH+cRNcQ1K0c+c/NO_cN2cR71c]/c+//N[Rc;KRPXQ9NLQcR6+Rc2:K-/9+Bc+//NYKRQc/+Kc.1c1B1/RPNL>/+G_c+//1QQ10c?c+RcB1+QRc R]Nc]+_Q c 9PQR cNK1c/+KcN.R+;KcP1HNR1c+//1QQcRNc,Mc+//NXKRc6NB01P Qc/NHOXR1Pc+K0cXQ1cS6+Rc Case Document 3-3 Filed 01/23/20 Page 28 of 62 PageID 88 computer to access the accounts. Second, one through remote access to an account holder?s computer can acquire password, username, and other information necessary for electronic access to accounts and can use that information to gain access to the accounts. Based on -statements above, I believe there is sufficient cause to believe that- was deploying or was planning to deploy one of these two methods to access victims? accounts. 52. Following the call, the Informant provided to- information for a covert, FBI-controlled bank account, including bank name, accOunt holder name, account number, routing number, and bank address. For convenience the account is referred to as ?Acc0unt The information provided was the information necessary to make wire transfers to Account 1, because it was anticipated that- would be transferring money via wire. As described below,- opted, at least initially, to use a different money transfer technique. 53. On May 30, 2019,- and the Informant exchanged the following WhatsApp messages. - asked the informant whether Zelle5 transfers could be made into Account 1. - said that he could transfer to the Informant money from a victim?s Chase bank account but was unable to because the informant was unavailable. Date From Body . 05 30f 2019 Can we do Zelle 05 30/ 2019 Informant Amount 05/30/ 2019 Zelle can be done for 2500 You didn?t reply I had that customer 05f 30/2019 Informant Depends upon the limit of bank You texted in the middle of the night 05/30/ 2019 - Chase bank 54. Again on May 30, 2019,- and the Informant exchanged the following WhatsApp messages. - stated that he configured a victim?s personal Chase bank account to be able to make Zelle transfers. - stated that because the Informant was unavailable, 5 Zelle is a mobile payment platform that allows account holders at Zelle?member banks to send money to other account holders at Zelle-member banks. 21 Case Document 3-3 Filed 01/23/20 Page 29 of 62 PageID 89 no transfer was made to the lnformant?s account. - requested the email address associated with the Account 1, and the Informant provides- with that email address. Date From 05/ 30/ 2019 Informant If I meet you can we do then? I am keeping that account only for you .. I want things to work 05/ 30/ 2019 Yea I understand. Zelle would have surer worked yesterday if I have had the info . Anyways I 11 try with the same cm and see if its works today. Will try Zelle. Got it activated yesterday, it? a chase personal accnt Not sure abt the limit . What?s the email phone for Zelle? 05/ 30/ 2019 Informant Sending details Now For zelle 05/30; 2019 i Ok thanks 05/ 30/ 2019 Informant Can I call 05 /30/2019 i Give me 10 min 05/ 30/ 2019 Informant Ok 05 /30 x2019 i Or speak in Hindi 05/ 30/ 2019 Informant Wain'n 05/ 30/ 2019 Thanks 05/ 30/ 2019 Informant 05/ 30/ 2019 - Now 05/ 30/ 2019 Informant [Email associated with Account 1] 55. Following those text exchanges, the Infermant communicated with-by telephone, and those calls were recorded. I listened to the calls, during which the Informant spoke in Hindi to a male individual, who the Informant identified as -The recorded calls were also listened to by a Hindi linguist and the following summary of the calls contents was provided to me: In -aslan 2,73: 2.2 E26 :25. 55:00 Contact Info Prince Us Guy - -s Uv-c. w: Case Document 3-3 Filed 01/23/20 Page 61 of 62 PageID 121 EXHIBIT 7 Case Document 3-3 Filed 01/23/20 Page 62 of 62 PageID 122