Police in Florida have arrested a 25-year-old man accused of being part of a multi-state cyber fraud ring that hijacked mobile phone numbers in online attacks that siphoned hundreds of thousands of dollars worth of bitcoin and other cryptocurrencies from victims.
On July 18, 2018, Pasco County authorities arrested Ricky Joseph Handschumacher, an employee of the city of Port Richey, Fla, charging him with grand theft and money laundering. Investigators allege Handschumacher was part of a group of at least nine individuals scattered across multiple states who for the past two years have drained bank accounts via an increasingly common scheme involving mobile phone “SIM swaps.”
A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their existing SIM card has been damaged, or when they are switching to a different phone that requires a SIM card of another size.
But SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone that the attackers control. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many banks and online services rely on text messages to send users a one-time code that needs to be entered in addition to a password for online authentication.
In some cases, fraudulent SIM swaps succeed thanks to lax authentication procedures at mobile phone stores. In other instances, mobile store employees work directly with cyber criminals to help conduct unauthorized SIM swaps, as appears to be the case with the crime gang that allegedly included Handschumacher.
A WORRIED MOM
According to court documents, investigators first learned of the group’s activities in February 2018, when a Michigan woman called police after she overheard her son talking on the phone and pretending to be an AT&T employee. Officers responding to the report searched the residence and found multiple cell phones and SIM cards, as well as files on the kid’s computer that included “an extensive list of names and phone numbers of people from around the world.”
The following month, Michigan authorities found the same individual accessing personal consumer data via public Wi-Fi at a local library, and seized 45 SIM cards, a laptop and a Trezor wallet — a hardware device designed to store crytpocurrency account data. In April 2018, the mom again called the cops on her son — identified only as confidential source #1 (“CS1”) in the criminal complaint — saying he’d obtained yet another mobile phone.
Once again, law enforcement officers were invited to search the kid’s residence, and this time found two bags of SIM cards and numerous driver’s licenses and passports. Investigators said they used those phony documents to locate and contact several victims; two of the victims each reported losing approximately $150,000 in cryptocurrencies after their phones were cloned; the third told investigators her account was drained of $50,000.
CS1 later told investigators he routinely conducted the phone cloning and cashouts in conjunction with eight other individuals, including Handschumacher, who allegedly used the handle “coinmission” in the group’s daily chats via Discord and Telegram. Search warrants revealed that in mid-May 2018 the group worked in tandem to steal 57 bitcoins from one victim — then valued at almost $470,000 — and agreed to divide the spoils among members.
GRAND PLANS
Investigators soon obtained search warrants to monitor the group’s Discord server chat conversations, and observed Handschumacher allegedly bragging in these chats about using the proceeds of his alleged crimes to purchase land, a house, a vehicle and a “quad vehicle.” Interestingly, Handschumacher’s public Facebook page remains public, and is replete with pictures that he posted of recent new vehicle aquisitions, including a pickup truck and multiple all-terrain vehicles and jet skis.
The Pasco County Sheriff’s office says their surveillance of the Discord server revealed that the group routinely paid employees at cellular phone companies to assist in their attacks, and that they even discussed a plan to hack accounts belonging to the CEO of cryptocurrency exchange Gemini Trust Company. The complaint doesn’t mention the CEO by name, but the current CEO is bitcoin billionaire Tyler Winklevoss, who co-founded the exchange along with his twin brother Cameron.
“Handschumacher and another co-conspirator talk about compromising the CEO of Gemini and posted his name, date of birth, Skype username and email address into the conversation,” the complaint reads. “Handschumacher and the co-conspirators discuss compromising the CEO’s Skype account and T-Mobile account. The co-conspirator states he will call his ‘guy’ at T-Mobile to ask about the CEO’s account.”
Court documents state that the group used Coinbase.com and multiple other cryptocurrency exchanges to launder the proceeds of their thefts in a bid to obfuscate the source of the stolen funds. Subpoenas to Coinbase revealed Handschumacher had a total of 82 bitcoins sold from or sent to his account, and that virtually all of the funds were received via outside sources (as opposed to being purchased through Coinbase).
Neither Handschumacher nor his attorney responded to requests for comment. The complaint against Handschumacher says that following his arrest he confessed to his involvement in the group, and that he admitted to using his cell phone to launder cryptocurrency in amounts greater than $100,000.
But on July 23, Handschumacher’s attorney entered a plea of “not guilty” on behalf of his client, who is now facing charges of grand larceny, money laundering, and accessing a computer or electronic device without authorization.
Handschumacher’s arrest comes on the heels of an apparent law enforcement crackdown on individuals involved in SIM swap schemes. As first reported by Motherboard.com earlier this month, on July 12, police in California arrested Joel Ortiz — a 20-year-old college student accused of being part of a group of criminals who hacked dozens of cellphone numbers to steal more than $5 million in cryptocurrency.
The Motherboard story notes that Ortiz allegedly was an active member of OGusers[dot]com, a marketplace for Twitter and Instagram usernames that SIM swapping hackers use to sell stolen accounts — usually one- to six-letter usernames. Short usernames are something of a prestige or status symbol for many youngsters, and some are willing to pay surprising sums of money for them.
Sources familiar with the investigation tell KrebsOnSecurity that Handschumacher also was a member of OGUsers, although it remains unclear how active he may have been there.
WHAT YOU CAN DO
All four major U.S. mobile phone companies allow customers to set personal identification numbers (PINs) on their accounts to help combat SIM swaps, as well as another type of phone hijacking known as a number port-out scam. But these precautions may serve as little protection against crooked insiders working at mobile phone retail locations. On May 18, KrebsOnSecurity published a story about a Boston man who had his three-letter Instagram username hijacked after attackers executed a SIM swap against his T-Mobile account. According to T-Mobile, that attack was carried out with the help of a rogue company employee.
SIM swap scams illustrate a crucial weak point of multi-factor authentication methods that rely on a one-time code sent either via text message or an automated phone call. If an online account that you value offers more robust forms of multi-factor authentication — such as one-time codes generated by an app, or better yet hardware-based security keys — please consider taking full advantage of those options.
If, however, SMS-based authentication is the only option available, this is still far better than simply relying on a username and password to protect the account. If you haven’t done so lately, head on over to 2fa.directory, which maintains probably the most comprehensive list of which sites support multi-factor authentication, indexing each by type of site (email, gaming, finance, etc) and the type of added authentication offered (SMS, phone call, software/hardware token, etc.).
Life in prison for Ricky Bobby and other SIM thieves like this would be a good start. Given that most call centers are staffed by low level employees, we need to “nip this in the bud”.
Got to admit this is a brilliant scheme if kept low-key. The amount of research to only require a phone SIM card of the target is quite impressive. Can’t be cheap or easy even in the black market. I am curious who and which organization came up this. The kid was definitely a follower and not the ring leader. It was only a matter of time before authorities caught onto him.
The ring leaders are all scattered everywhere in the world, from US to Russia from North Korea to China.
Amazing that the kid is still bragging about his stuff on his facebook and his “woman” thinks the world of him.. Yep.. Your man is a thief and future felon… but yet that’s ok.. Whoa .. some women are just clueless.. i do hope they nab him.. oh well moving to next article.
It takes all kinds Mr.Chuck.
another millennial pos
Based on your name I’m gonna guess your a Boomer. Maybe his alternative was to buy a house for twice his yearly income right out of highschool? Right?
Or alternatively, use his skills to get a legitimate job and rent an apt with roommate(s) until such time he is able to buy a house that allows him to live within his means.
Then again, I’m gonna guess its so much easier to do as he did and reserve himself a future room with free room and board where he gets to wear a pin stripe suite every day.
Yes .. right Like everyone is automatically entitled to own a home … BTW how many homes have you built? Typical “hand full of gimmie and mouth full of I wanna”
I’ve worked in construction if you are attempting to imply one needs to do that to own a home. I am also currently working full time and in school full time. Something I’m certain you never did. Instead you became an expert in mouthful’s of I wanna and the stupid sayings to backup generational arguments that are largely incorrect. The reality is the middle class is disappearing and the average income to starter home cost has separated by leaps and bounds.
There are very many investment scams nowadays I advise all people to deal with tall cautiousness and those who deal with them to ask to withdraw large amounts and see the reaction. Conditions of dealing with them are all bad and against the customer.
My sister lost a lot of money to these brokers and they made a flimsy excuse about it, we were able to recover some of the money with the help of a professional before it was too late. Be sure it isn’t a scam. Are you sure other ones are real? do not lose your money before you start looking for how to get it back thats not smart, talk to a professional today to help you with your background checks, monitoring people, cooperate espionage and so on, mail rootgatehacks at tutanota dot com for more on this
It matter the things you do you will never get away it seem good. while you are Boosting God watching you .but you will paid consequences for it .then we say people are doing stuff .you ever stop think the things we do in life haunt us may God save you change your life before it too late. Amen
Never figured any thief had any sort of remorse for what they did. But thieves used to be people with little or no skills other then theft and stealing in order to survive. Now we have kids who just want stuff they cannot afford but intelligent enough to create elaborate schemes to get it. Frankly its as if they consider it a game not a crime and even after they are caught its as if they still are on a high. Sort of scary if you ask me how brazen these kids are.
This Florida Man is well known to anonymous, in fact, some say, he’s synonymous with anonymous, there’s articles about him everywhere, but nobody knows who he is!