Three Romanian citizens have pleaded guilty to carrying out a scheme that used recorded messages and cellphone texts to trick thousands of people into revealing their social security numbers and bank account information, federal authorities said.
Vishing and smishing scams are variations of phishing that use voicemails and SMS messages instead of email, federal prosecutors in Atlanta, Georgia, said on Friday. From 2011 to 2014, the three Romanians compromised computers located in the US and installed interactive voice response and bulk emailing software on them. The hacked computers initiated thousands of phone calls and text messages that tricked recipients into disclosing personal information, including account numbers, PINs, and social security numbers.
"When a victim received a telephone call, the recipient would be greeted by a recorded message falsely claiming to be a bank," federal prosecutors said. "The interactive voice-response software would then prompt the victim to enter their PII. When a victim received a text message, the message purported to be from a bank and directed the recipient to call a telephone number hosted by a compromised Voice Over Internet Protocol server. When the victim called the telephone number, they were prompted by the interactive voice response software to enter their PII."
The men stored the stolen PII on the compromised computers. The pilfered data was accessed by two of the suspects who then sold or used the information with the help of the third participant.
Robert Codrut Dumitrescu, 41, recently pleaded guilty to wire fraud conspiracy, computer fraud and abuse, and aggravated identity theft. His conspirators, Teodor Laurentiu Costea, 42, and Cosmin Draghici, 29, pleaded guilty earlier this year. All three men were from Ploiesti, Romania, and were extradited to Atlanta last year.
At the time of their arrests, Dumitrescu possessed 3,278 financial account numbers, Costea possessed 36,050 numbers, and Draghici possessed 3,465 numbers. All of the numbers were fraudulently obtained through the vishing and smishing schemes. Based on those numbers, prosecutors estimated the loss will exceed $21 million. ARSTechnica has the story, and also a link to the DOJ release.
