Account Takeover Fraud

The most dangerous weapon in the prosecutor's toolkit is 18 U.S.C. § 1028A, Aggravated Identity Theft. This statute imposes a mandatory two-year prison sentence that must run consecutively to any other sentence.

In account takeover fraud cases, the government argues that using a username and password constitutes the theft of an identity. We fight this application of the law. We argue that using a credential is not the same as stealing a person's identity to create new accounts. We scrutinize the Supreme Court's Dubin ruling to argue that the use of the name was incidental to the fraud, not the core of it. We work tirelessly to dismiss this charge to remove the threat of mandatory prison time and open the door for probation or diversion.

Since ATO almost always involves the internet, federal wire fraud charges are automatic. Conspiracy charges allow the government to hold a defendant liable for the actions of an entire hacking group.

We defend against the conspiracy allegation by isolating our client. If our client purchased credentials on the dark web but did not participate in the original hack, we argue they are not part of the intrusion conspiracy. We challenge the loss amount calculations. Prosecutors often try to hold a defendant responsible for the potential value of all compromised accounts. We use forensic accounting to limit liability to the actual loss, significantly reducing the sentencing guidelines exposure.

If a client is accused of running a credential stuffing botnet, the evidence is often massive server logs.

We attack the attribution. We argue that the IP addresses linked to the attack were zombie computers infected by malware and controlled by a third party, not our client. We show that our client's computer was a proxy, not the source. We also challenge the jurisdictional venue. If the server was overseas and the victims were scattered globally, we argue that the local federal court lacks the proper venue to hear the case.

SIM swapping is a high-priority target for the FBI because it often targets cryptocurrency holdings. The government relies on the testimony of telecom employees who were bribed or tricked.

We cross-examine these insiders. We look for evidence that the telecom employee was the ringleader, not our client. We also defend clients who are accused of being the beneficiary of the swap. If funds were moved to a wallet our client controls, we argue they were an unwitting money mule who believed they were processing legitimate payments. We prove that they did not know the source of the funds was an account takeover fraud.

Under Regulation E, consumers are generally not liable for unauthorized electronic funds transfers if they report them promptly. Banks often try to deny these claims by asserting the customer was negligent.

We litigate the definition of unauthorized. We argue that even if the customer was tricked into giving up a code (phishing), the resulting transfer was still unauthorized because the customer did not initiate it. We compel the bank to produce their fraud detection algorithms. We show that the bank flagged the transaction as high-risk but approved it anyway to save operational costs. We hold the bank responsible for its failure to protect the depositor.

Cryptocurrency exchanges are frequent targets of account takeover fraud. Many lack the customer support and security infrastructure of traditional banks.

We sue these platforms for negligence and breach of contract. We argue that their security protocols were commercially unreasonable. If an exchange allowed a password reset and a withdrawal of life savings within minutes without a cooling-off period, that is negligence. We trace the stolen crypto across the blockchain. We petition courts for emergency freezing orders to seize the assets before they are laundered through mixers. We fight to make the victim whole.