The Phisher King Goes To Jail

Another phisher jailed, and another example, if any were needed, of the Russian gravitional pull to such tricks. But there’s a backstory to this that all accounts have ignored. Here’s the meat, first, from The Register:

An American who masterminded the UK part of a multi-million pound ID theft scam was yesterday jailed for six years. Douglas Havard, 24, was sentenced on Monday at Leeds Crown Court after pleading guilty to conspiracy to defraud and conspiracy to launder money. His accomplice, Lee Elwood, 25, of Glasgow, was jailed for four years after pleading guilty to the same offences in June 2004.

The court heard the duo were integral to a phishing scam that netted an estimated £6.5m. The duo operated the UK end of an international operation that tricked consumers into handing over their banking credentials to bogus websites. The pair used credit cards obtained under false names, money raided from compromised bank accounts and the illicit purchase and sale of goods online to finance a lavish lifestyle.

According to a report on kvue last year, Havard was allegedly just one of

15 global middlemen linked to the hackers, who systematically stole from hundreds of bank accounts daily, one of Mr. Havard’s former associate says.

But it’s the Douglas Havard guy who is most interesting, and an example of the kind of people getting drawn into the phishing world: Check out this long and fascinating account from the Dallas Observer three years ago, when Havard was still on the run. One particular episode caught my eye:

Take the bar code scam, which allegedly began during Havard’s sophomore year at Winston. Havard bought a special printer and high-gloss paper precut in the shape of price stickers, with adhesive on one side. The equipment and materials were specialized, but not exotic; he could buy all he needed at an office supply store.

Havard went to Target and purchased, say, a box of Legos for $17. He duplicated the bar code on the Legos and then went back to the store. As he browsed through the toy department, he’d slap a bar code sticker reading $17 onto a box of MindStorm Legos that sell for $200 a box.

At the checkout, Havard paid $17 for the Legos. He later returned the Legos to the store, getting a cash refund or store credit for $200. Profit: $183. He’d then go back and buy two more expensive boxes for $17 each. Profit: $366. Investment: $17, plus the printer and sticky paper.

Havard’s research revealed that Target wouldn’t investigate until the sixth return, so he would do the con a total of five times in his own name, then use a fake drivers license and do it five times in another name. He then pulled in other people to repeat his performance five times each in various names, also using fake identities. After calculating how many Target stores were in the Dallas-Fort Worth region, he sent out his minions with handfuls of forged bar code stickers.

Havard was making up to $15,000 a day from the scam, according to the Observer. From there he graduated into credit card scams. And others:

He and a buddy started cruising the parking lots at NorthPark, looking for expensive SUVs loaded with fancy accessories like front grilles. They’d write down the license plate numbers, drive home and look up the addresses of the owners on the Internet. Late at night, they’d drive by the houses, steal the grilles and sell them on eBay.

It’s all quite a tale. Phishing in Leeds was perhaps the easiest scam Havard ever did.