A partial selfie posted by Punchmade Dev to his Twitter account. Yes, that is a functioning handheld card skimming device, encrusted in diamonds. Underneath that are more medallions, including a diamond-studded bitcoin and payment card.
In January, KrebsOnSecurity wrote about rapper Punchmade Dev, whose music videos sing the praises of a cybercrime lifestyle. That story showed how Punchmade’s social media profiles promoted Punchmade-themed online stores selling bank account and payment card data. The subject of that piece, a 22-year-old Kentucky man, is now brazenly suing his financial institution after it blocked a $75,000 wire transfer and froze his account, citing an active law enforcement investigation.
With memorable hits such as “Internet Swiping” and “Million Dollar Criminal” earning millions of views, Punchmade Dev has leveraged his considerable following to peddle tutorials on how to commit financial crimes online. But until recently, there wasn’t much to support a conclusion that Punchmade was actually doing the cybercrime things he promotes in his songs.
That changed earlier this year when KrebsOnSecurity showed how Punchmade’s social media handles were promoting Punchmade e-commerce shops online that sold access to Cashapp and PayPal accounts with balances, software for printing checks, as well as personal and financial data on Americans.
Punchmade Dev’s previous online shop (now defunct). His Telegram channel has more than 75,000 followers.
The January story traced Punchmade’s various online properties to a 22-year-old Devon Turner from Lexington, Ky. Reached via his profile on X/Twitter, Punchmade Dev said they were not affiliated with the lawsuit filed by Turner [Punchmade’s X account provided this denial even though it has still not responded to requests for comment from the first story about him in January]. Meanwhile, Mr. Turner has declined multiple requests to comment for this story.
On June 26, Turner filed a pro se lawsuit against PNC Bank, alleging “unlawful discriminatory and tortuous action” after he was denied a wire transfer in the amount of $75,000. PNC Bank did not respond to a request for comment.
Turner’s complaint states that a follow-up call to his bank revealed the account had been closed due to “suspicious activity,” and that he was no longer welcome to patronize PNC Bank.
“The Plaintiff is a very successful African-American business owner, who has generated millions of dollars with his businesses, has hired 30 plus people to work for his businesses,” Turner wrote.
As reported in January, among Turner’s businesses is a Lexington entity called OBN Group LLC (assumed name Punchmade LLC). Business incorporation documents from the Kentucky Secretary of State show he also ran a record label called DevTakeFlightBeats Inc.
Turner’s lawsuit alleges that bank staff made disparaging remarks about him, suggesting the account was canceled because it would be unusual for a person like him to have that kind of money.
A snippet from Turner’s lawsuit vs. PNC.
Incredibly, Turner acknowledges that PNC told him his account was flagged for attention from law enforcement officials.
“The PNC Bank customer service representative also explained that there was a note on the account that law enforcement would be contacted at some point in time,” the lawsuit reads.
“The Plaintiff, who was not worried at all about law enforcement being involved because nothing illegal occurred, informed the PNC Bank representative that this was one big mistake and asked him what his options were,” the complaint states.
Devon Turner, a.k.a. “Punchmade Dev,” in an undated photo, wearing a diamond-covered Visa card. Image: tiktok.com/brainjuiceofficial
Turner’s lawsuit said PNC told him they would put a note on his account allowing him to withdraw the funds from any branch, but that when he visited a PNC branch and asked to withdraw the entire amount in his account — $500,000 — PNC refused, saying the money had been seized.
“Ultimately, PNC bank not only refused his request to release his funds but informed him that his funds would be seized indefinitely as [sic] PNC Bank,” Turner lawsuit recounts.
The Punchmade shops selling financial data that were profiled in the January story are long gone, but Punchmade’s Instagram account now promotes punchmade[.]cc, which behaves and looks the same as his older shop.
Punchmade’s current shop, which DomainTools says was registered to a Lexington, Ky. phone number used by accounts under the name of Devon Turner at multiple online retailers.
The breach tracking service Constella Intelligence finds the email address associated with Turner’s enterprise OBN Group LLC — obndevpayments@gmail.com — was used by a Devon Turner from Lexington to purchase software online. That record includes the Lexington, Ky. mobile phone number 859-963-6243, which Constella also finds was used to register accounts for Devon Turner at the retailer Neiman Marcus, and at the home decor and fashion site poshmark.com.
A search on this phone number at DomainTools shows it is associated with two domain names since 2021. The first is the aforementioned punchmade[.]cc. The other is foreverpunchmade[.]com, which is registered to a Devon Turner in Lexington, Ky. A copy of this site at archive.org indicates it once sold Punchmade Dev-branded t-shirts and other merchandise.
Mr. Turner included his contact information at the bottom of his lawsuit. What phone number did he leave? Would you believe 859-963-6243?
The closing section of Mr. Turner’s complaint includes a phone number that was used to register a popular online fraud shop named after Punchmade.
Is Punchmade Dev a big-time cybercriminal enabler, as his public personna would have us believe? Or is he some two-bit nitwit who has spent so much on custom medallions that he can’t afford a lawyer? It’s hard to tell.
But he definitively has a broad reach: His Instagram account has ~860k followers, and his Telegram channel has more than 75,000 subscribers, all no doubt seeking that sweet “C@sh App sauce,” which apparently has something to do with moving cryptocurrencies through Cash App in a way that financially rewards people able and willing to open up new accounts.
It’s incredibly ironic that Punchmade sells tutorials on how to have great “opsec,” a reference to “operational security,” which in the cybercriminal context means the ability to successfully separate one’s cybercriminal identity from one’s real-life identity: This guy can’t even register a domain name anonymously.
A copy of Turner’s complaint is available here (PDF).
For more on Punchmade, check out the TikTok video How Punchmade Dev Got Started Scamming.
Update, Aug. 8, 8:49 a.m. ET: A reader pointed out that Turner also recently sued a Mercedes Benz dealership in Illinois, allegedly for selling him a lemon. In that pro se complaint, Turner included the contact email address punchmadedev@gmail.com.
The punchmade.cc graphic has Turner’s last name as “Taylor” in the caption.
Pro se, so he’s probably using AI to write all that? Wait until he finds out what depositions are all about.
That won’t work. Been there an done that. Most of that is blocked out of Gemini, GPT3.5, GPT 4, and I’d also bet 4o. They don’t want the bloody thing giving primo legal advice for the price of a $20 subscription, LOL. You might be able to squeeze by if you phrase things as academic questions in moot court…
Who are the five greatest rappers of all time?
Punchmade,Punchmade,Punchmade, and Punchmade and dylon.
LOL Now I have to go watch that!
Everyone knows that ytcracker is the original DG rapper. This noob only came onto the scene in 2021.
Surely some halfwit lawyer / accomplice helped write this? If this “punchmade dev” AND whatever counsel he brings with him isn’t immediately arrested the moment they enter a court then I’ve completely lost faith in the American legal system.
The caption in the first photo has a typo: “Puchmade”
That’s one hell of a filing. Kudos to his acumen in law, music, and carding. That filing is something quite professionally done. Is Mr. Turner a polymath?
I’m curious if the address he provided is his actual home address too, certainly doesn’t look like a lawyers office or something… Or could have just pulled it out of a hat.
It’s funny you mention, and I’m sure others have looked. Well let’s just say the cars look better across the street, LOL! I’m always astounded by the imagery that happens when you flip the Hubble Space Telescope around… I’m a fan of Kali Linux as I’m sure many here are. They have a great motto: “The quieter you are, the more you can hear.”
I was raised in Hell’s Kitchen. Flashing your bling around needlessly in public was always a good way to see the wrong end of an endpoint, back in the day. Just a word to the wise…
UPS Store front
I’ve seen a lot of cringe. That picture takes the cake for King of Cringe. Congratulations sir, you’ve played yourself.
I do think it’s hilarious, that despite being a white guy, he’s identifying as black.
He’s half black and half white… Are you joking…
Also hilarious, that this “black” dude who is whiter than me (and I’m lily white), makes it patently obvious that he’s black in this lawsuit. Then expects to take this before a jury in Kentucky. SOLID GOLD. I hope he wears all the chains at the hearing, then subsequently at the sentencing. It would only make sense because WUD HE DO?
Do we really need to go down to racial stereotypes to make our point? I’m surprised BK tolerated that.
You too could represent the wisdom of your ancestors more carefully if you were so concerned.
then you’ve obviously never seen family photos before, y’all he’s HALF WHITE HALF BLACK. You’ve made three comments. Go take your meds phil
then you’ve obviously never seen family photos before You’ve made three comments. Go take your meds phil
You’ve made three comments. Go take your meds phil
he’s half white and half black, go take your meds phil
“It’s incredibly ironic that Punchmade sells tutorials on how to have great “opsec,” a reference to “operational security,” which in the cybercriminal context means the ability to successfully separate one’s cybercriminal identity from one’s real-life identity: This guy can’t even register a domain name anonymously.”
‘The shoemakers children are running around barefoot’ may be an apt analogy here.
As Rick James would say… “cocaine is a hell of a drug.”
“UNITY!!!”… what did the five fangers say to the face..
“SaaaaaLAP!”
https://securityaffairs.com/166765/hacking/0-0-0-0-day-browsers-attack.html
Not sure if this will help anyone in business but seems MSoft is the only os not affected by this…
so maybe score one for MSoft is turning over a new leaf toward security or not.. 😐
my neanderthal instincts tell me the entire interweb is a TRAP!!!
Punchmadedev is smart because he’s not actually carding. He’s just scamming people who want to become carders. If he was actually carding he wouldn’t be so blatant about it.
If you actually believe that, I’d strongly advise that you never, ever look up the meaning of the “abetting” part in “aiding and abetting”. Even in Kentucky, as stated in “KRS Chapter 502.020 Liability for conduct of another — Complicity.”
(1) A person is guilty of an offense committed by another person when, with the
intention of promoting or facilitating the commission of the offense, he: …
(b) Aids, counsels, or attempts to aid such person in planning or committing the
offense; or …
https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39366
People convicted of Class C felonies in Kentucky face 5 to 10 years’ imprisonment. Good times ahead for Mr. Turner here.
Like the dude is running a card shop.
https://krebsonsecurity.com/2024/01/e-crime-rapper-punchmade-dev-debuts-card-shop/
It’s one of those myths that stupid criminals believe. Like, “if you’re a cop, you have to say you’re a cop”. Or, “it’s not illegal if what I’m selling is fake drugs”.
Dear BK, this seems to be an uncharacteristically (and unnecessarily) low blow since the bank seized his account. Although maybe he should have had a lawyer on retainer already? Ridicule can safely be left to the commenters.
“…two-bit nitwit who has spent so much on custom medallions that he can’t afford a lawyer? It’s hard to tell.”
Phill, please tell me you’re joking. The guy needs more attention and more shame, not less. Ridiculous. What are you his lawyer, the man himself? Sorry, let’s all be kinder to the guy quite literally selling access to my money.
Which is why the police are interested in him either way.
Obviously an FBI informant
I’d like to hear more about the “C@sh App sauce.” In July, Cash App sent me a card that I hadn’t applied for. I called their customer support to have it canceled. Three weeks later, they sent me another unauthorized card with a different “$cashtag.” They have yet to deactivate the second card – they say it can take up to ten days.
I found a 2020 article that says, “Cash App this week confirmed this account was set up as a pass-through [money laundering] account. Most importantly, it says it has closed a loophole that allowed an account to be set up fraudulently.” From https://www.cleveland.com/moneymatters/2020/02/man-gets-unexpected-cash-app-debit-card-it-could-be-a-sophisticated-scam-money-matters.html