OCTOBER 2005 :: COVER STORY : SCIENCE & TECHNOLOGY

Crime of the Century

Identity-Theft Rings Become Organized Like Businesses

BY CASSELL BRYAN-LOW
Staff Reporter of The Wall Street Journal

At 19 years old, Douglas Cade Havard was honing counterfeiting skills he learned in online chat rooms, making fake IDs in Texas for underage college students who wanted to drink alcohol.

By the age of 21, Mr. Havard had moved to England and parlayed those skills to a lucrative position at Carderplanet.com, one of the biggest multinational online networks trafficking in stolen personal data.

Now 22, Mr. Havard is in a British prison cell, having pleaded guilty to charges of fraud and money laundering. The Carderplanet network has been shut down.

Mr. Havard's case provides a rare insight into the underground marketplace for stolen information, a surging white-collar crime of the 21st century. It affects as many as 10 million Americans at a price tag of $55 billion to American business and individuals, according to industry and government studies.

Wreaking Havoc

While banks typically compensate customers for fraudulent losses, ID-theft victims can spend hundreds of hours repairing the havoc wreaked on their personal records and finances. Sometimes, victims are forced to pay off the debt racked up by fraudsters. In some cases, they are arrested for crimes committed by the ID thief.

Most identity theft still occurs offline, through stolen cards or rings of shop clerks in cahoots with credit-card forgers. But as Carderplanet shows, the Web offers criminals more efficient tools to harvest personal data and to communicate easily with large groups on multiple continents.

Police are finding well-run, hierarchical groups that are structured like businesses. With names such as Carderplanet, Darkprofits and Shadowcrew, these sites act as online bazaars for stolen personal information. The sites are often password-protected and ask new members to prove their criminal credentials by offering samples of stolen data.

The organizations often are dominated by Eastern Europeans and Russians. With their abundant technical skills and lack of jobs, police say, those countries provide a rich breeding ground for identity thieves. As with many of its peers, the Carderplanet site was mainly in Russian but had a forum for English speakers.

One English speaker was Mr. Havard. He was arrested in June 2004 after allegedly stealing millions of dollars from bank accounts in Britain and the U.S. The charges against him have been detailed in hearings in Leeds Crown Court, where he recently pleaded guilty. This summer, he was sentenced by a British judge to six years in prison. His U.K. lawyer, Graham Parkin, says Mr. Havard "accepts his role."

Mr. Havard, who grew up in Dallas, began honing his criminal skills as a teen. He started using computers at a young age and learned about making fake IDs in online forums.

In February 2002, Dallas police caught him selling an ecstasy-like party drug to an undercover cop, according to a police report. By that summer, aged 19, he faced five felony charges, including drug-dealing, robbery and counterfeiting, court documents show. He soon broke bail and fled the U.S.

During his travels, he maintained his contact with the online counterfeiting world and began interacting with Russian thieves, his lawyers say. With no steady income, he made money as a middleman in a scam buying and selling goods with stolen credit-card numbers, his lawyers say. In early 2003, he arrived in Britain. He met up with people he had met online and settled in the city of Leeds. Using the nickname Fargo, which is a brand of machines used to encode magnetic strips, he communicated regularly with other members of Carderplanet.

Carderplanet boasted roughly 7,000 members and served as a marketplace for millions of stolen accounts, according to Larry Johnson, special agent for the U.S. Secret Service. Many of the stolen accounts came from hackers who targeted banks, e-commerce sites and government agencies in the U.S., U.K. and Australia, he says.

Mr. Havard became a "reviewer" on the site, testing illicit merchandise before it was sold, according to the U.K.'s National Hi-Tech Crime Unit, or NHTCU, which led the investigation of Carderplanet. Mr. Havard worked his way up the organization and earned a leadership role.

Mr. Havard teamed up with Lee Elwood, a 23-year-old Scotsman he met via contacts he made online. (Mr. Elwood didn't respond to a letter mailed to him in prison. His lawyer declined to comment.) The Russians relayed to them pairs of ATM accounts and PINs via instant message, according to the NHTCU. Messrs. Havard and Elwood loaded the information onto the magnetic strips of blank cards and prepaid cellphone cards using hand-held encoders, the NHTCU says.

The two men then withdrew money from ATMs with the fake cards, wiring 60% of the proceeds back to Russia, the NHTCU says. Messrs. Havard and Elwood split their 40% cut between themselves, prosecutors say.

In another scam, Mr. Havard and Mr. Elwood obtained stolen credit-card details and used them to buy laptop computers and other electronic goods online, prosecutors say. They then resold the goods online.

$3,500 a Week

From August 2003 to mid-2004, Messrs. Havard and Elwood stole about $1.3 million from British and American bank accounts using the stolen ATM-card information forwarded by the Russians, U.K. prosecutors allege. Altogether, including the proceeds from their credit-card swindles, the NHTCU suspects the two men stole about $11.4 million over the course of about 18 months starting in early 2003.

Mr. Elwood told British authorities he earned up to $3,500 a week from his activities, but police suspect it was significantly more than that.

Business came to an abrupt end in June 2004 after U.K. law enforcement received a tip from the FBI, which was looking for Mr. Havard in connection with his Texas crimes. Mr. Havard awoke one morning to find a dozen policemen at his apartment in Leeds, the NHTCU says.

Officers discovered $28,000 of forged traveler's checks and a portfolio of IDs bearing his photo, including phony drivers' licenses and passports from Spain, Ireland and the U.S. They also found high-resolution images of bank and credit-card logos stored on a computer along with fake holograms, blank plastic cards and a heat press for embossing numbers. Mr. Havard also had about $17,600 in cash stashed at various addresses, the NHTCU says.

Mr. Elwood was arrested two weeks later in Glasgow. Soon after, senior members of Carderplanet closed the site down, citing law-enforcement scrutiny, says Mr. Johnson. Shadowcrew and Darkprofits also have shut down amid a crackdown by U.S. law enforcement.