He went by the moniker of “Non 202” and he made a name for himself from Moscow to Sacramento in the hacking industry.
By the middle of 2014, he had broken into the American Express accounts of 119,000 customers all over the U.S., authorities said, and he and his partners had made off with between $300,000 and $400,000 in an alleged fraud scheme that used phony online businesses created with identities stolen from Sacramento-area high school students.
Altogether, federal prosecutors say, the identity thieves put a $1 million hit on their American Express victims, working with a trio of suspects who set up shop in Sacramento and Los Angeles and collected $600,000 to $700,000 for themselves before they transferred the rest of the money back to Moscow.
The fees, authorities said, went to the hacker and to other cohorts who included three Russian women who entered the United States on student visas and set up phony bank accounts that took in the cash from the fake businesses.
Digital Access for only $0.99
For the most comprehensive local coverage, subscribe today.
A U.S. District Court jury in Sacramento on Tuesday took just one day to convict one of those involved in the operation, 37-year-old Mihran Melkonyan on 26 counts of wire and mail fraud.
Melkonyan’s lawyer claimed his client wasn’t a major player. The real bad guys, federal defender Matthew Bockmon said, were two other Russians: Ruslan Kirilyuk and Aleksandr Maslov. Kirilyuk, who was free on a $25,000 unsecured bond, had been scheduled to stand trial with Melkonyan but disappeared Feb. 7 as the trial was scheduled to start.
Prosecutors said they could not comment on where Kirilyuk might be.
Maslov, meanwhile, is being examined for his mental competency and had his case severed from the rest, according to court documents.
The case had included a fourth defendant, Rouslan Akhmerov, but he took a plea deal in exchange for his testimony at trial. Akhmerov is scheduled to be sentenced March 4.
In their Feb. 7 trial brief, federal prosecutors said Kirilyuk “obtained over 200 stolen report cards from the San Juan Unified School District” that contained “information on them such as names and Social Security numbers.” The suspects then used the names to create 71 phony businesses.
Prosecutors said there is nothing in public records that indicates how Kirilyuk obtained the students’ identities.
Then, “working with co-conspirators in Russia, the defendants obtained stolen and misappropriated credit card information for over 119,000 cards,” the prosecutors’ trial brief said. “Using the stolen credit card information, the conspirators billed the credit cards for purported sales made by the fraudulent businesses.”
The scheme took place from 2011 through 2014 before the government served search warrants on Akhmerov at his apartment in Studio City and on Melkonyan at his residence in the 5500 block of Shaver Court in the Foothill Farms area of Sacramento County in March 2014. An affidavit filed in the case said investigators found more than $196,000 in cash at Akhmerov’s apartment.
Assistant U.S. Attorney Matthew M. Yelovich said in his closing argument Tuesday that Melkonyan and his partners “had to stay one step ahead of American Express and the FBI.” They would shut down one fake business after making a few transactions and open another one just as fast.
Although the government brief reported that the operation netted $1 million, Yelovich said that the operation actually submitted $3.5 million in false charges.
Some of the best evidence in the case, Yelovich said, included bank machine photographs of Melkonyan withdrawing money from accounts set up by the three female Russian students with the J-1 student visas.
One of the women, identified as Daria Puchkova, may have been a girlfriend of Melkonyan’s. Prosecutors said she and other two women, Evgenia Romanova, and Angelina Kikot, lived in Sacramento-area apartments. According to the government, the three entered the United States in May of 2012 and left in October of the same year.
Akhmerov’s testimony on Feb. 8 introduced the jury to the existence of “Non 202.” He said it was Kiriluyuk who brought the hacker into the operation, and that “the Russian partners” regularly communicated through the online chat room Jabber.
The hacker was paid 30 percent to 40 percent of the money that they made, with the payments transferred by wire and through Green Dot prepaid credit cards, Akhmerov said. Some of it was stuffed into magazines sent out in the mail, prosecutors said.
A paid confidential informant testified she made pickups for Melkonyan at a mail drop where proceeds from the operation were delivered. Yelovich said the testimony showed that the defendant was trying to “disguise the fact that he’s tied to the fraud money.”
In his argument, Bockmon, the defense attorney, sought to minimize Melkonyan’s involvement in the scheme. His client, Bockmon said, is only a truck driver and not the mastermind of a sophisticated conspiracy run out of Russia.
“What a stretch,” Bockmon said.
Bockmon argued that the government’s case rested precariously on the testimony of Akhermov and the informant.
“One is trying to stay out of prison, and the other is being paid,” the defense lawyer said. The real culprits, he said, are Maslov and Kirilyuk.
“They’re not here,” Bockmon said, “and that’s not fair.”