Application for a Warrant by Telephone or Other Reliable Electronic Means
- Date
- 2023-04-11
Summary
An AO 106A Application for a Warrant by Telephone or Other Reliable Electronic Means, Case 3:23-mj-01302-MSB, Document 1, filed April 11, 2023 in the United States District Court for the Southern District of California. An FBI Special Agent seeks information associated with a cellular telephone account held by T-Mobile, citing 18 USC §§ 1343 and 1349 (Conspiracy to Commit Wire Fraud) and 18 USC § 1956(h) (Conspiracy to Commit Money Laundering). The affidavit seeks subscriber, toll and cell-site location records from AT&T and T-Mobile under 18 U.S.C. § 2703(a). It states that investigators identified more than 100 California EDD accounts that collectively obtained more than 8 million dollars in benefits beginning in July of 2020. The 20-page filing ends with a blank T-Mobile records certification under Federal Rules of Evidence 902(11) and 902(13).
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.1 Page 1 of 20
AO 106A (08/18) Application for a Warrant by Telephone or Other Reliable Electronic Means
UNITED STATES DISTRICT COURT
for the
Southern District
__________ DistrictofofCalifornia
__________
In the Matter of the Search of )
(Briefly describe the property to be searched
or identify the person by name and address)
)
) Case No. '23 MJ01302
Information associated with cellular telephone number: )
(574)-327-1997 ("Subject Account 2"), )
)
that is stored at premises controlled by T-Mobile
APPLICATION FOR A WARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):
See Attachment A-2, incorporated herein by reference.
located in the federal District of New Jersey , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B-2, incorporated herein by reference.
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
✔ evidence of a crime;
u
✔ contraband, fruits of crime, or other items illegally possessed;
u
✔ property designed for use, intended for use, or used in committing a crime;
u
u a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 USC §§ 1343 and 1349 Conspiracy to Commit Wire Fraud
18 USC § 1956(h) Conspiracy to Commit Money Laundering
The application is based on these facts:
See Attached Affidavit of FBI Special Agent Courtney M. McGuire, incorporated herein by reference.
u Continued on the attached sheet.
u Delayed notice of days (give exact ending date if more than 30 days: ) is requested under
18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
Courtney M. McGuire
Applicant’s signature
Courtney M. McGuire, FBI Special Agent
Printed name and title
Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by
telephone (specify reliable electronic means).
Date: 04/11/2023
Judge’s signature
City and state: San Diego, California Hon. Michael S. Berg, U.S. Magistrate Judge
Printed name and title
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.2 Page 2 of 20
1 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT
2 I, Courtney M. McGuire, Special Agent with the Federal Bureau of Investigation
3 (FBI), being duly sworn, hereby state as follows:
4 INTRODUCTION
5 1. I submit this affidavit in support of an application for a search warrant for
6 AT&T, a wireless telephone service provider headquartered at 11760 US Highway 1, 4th
7 floor, North Palm Beach, Florida 33408, as described in Attachment A-1, to search the
8 account associated with the cellular telephone number (562)-542-7153 (Subject Account
9 #1), and T-Mobile, a wireless telephone service provider headquartered at 4 Sylvan Way,
10 Parsippany, New Jersey, as described in Attachment A-2, to search the account associated
11 with the cellular telephone number (574)-327-1997 (Subject Account #2), altogether the
12 “Subject Accounts” for subscriber information, telephone toll data, and cell-site geo-
13 location information, for the period of July 1, 2020 up to and including and August 31,
14 2022. There is probable cause that these records and information constitute evidence, fruits,
15 and instrumentalities of violations of federal criminal law, namely, Title 18, United States
16 Code, Sections 1349 and 1956(h), as more fully described in Attachment B. This affidavit
17 and application are sought pursuant to Rule 41 of the Federal Rules of Criminal Procedure
18 and 18 U.S.C. § 2703(a), which applies to providers of electronic communication services.
19 In this case, as will be shown below, AT&T and T-Mobile provide electronic
20 communication services in the form of cellular and wireless telephone service for the
21 Subject Accounts.
22 AGENT EXPERIENCE AND BACKGROUND
23 2. I am an investigative or law enforcement officer within the meaning of Title
24 18, United States Code, Section 2510(7); that is, an officer of the United States, who is
25 empowered by law to conduct investigations of and to make arrests for offenses
26 enumerated in Title 18, United States Code, Section 2516. I have been employed as a
27 Special Agent with the Federal Bureau of Investigation (FBI) since December of 2021. I
28 am presently assigned to the FBI San Diego’s Transnational Organized Crime – Eastern
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.3 Page 3 of 20
1 Hemisphere (TOC-E) squad. This squad investigates wire fraud, money laundering and
2 other derivative financial crimes committed by criminal organizations. Prior to my
3 assignment with the TOC-E squad, I completed the 17-week FBI Academy in Quantico,
4 Virginia and was trained in investigative techniques, procedures, and strategies. Prior to
5 my appointment as a Special Agent, I worked for the FBI as a Tactical Specialist and
6 administrative support employee for four years. As a Tactical Specialist, I conducted
7 research and analyzed data in support of federal criminal and national security
8 investigations. Prior to my appointment to the FBI, I served as a Jailer for the Laguna Beach
9 Police Department in Laguna Beach, California. I have a Bachelor of Science degree in
10 Biology from Boise State University.
11 3. As both a Tactical Specialist and a Special Agent with the FBI, I have
12 participated in numerous investigations involving individuals of criminal organizations
13 engaged in money laundering, drug trafficking, human trafficking and robbery. Through
14 my investigations, my training and experience, and discussions with other law enforcement
15 personnel, I have become familiar with the tactics and methods used by criminal enterprises
16 to collect and launder the proceeds from specified unlawful activity to include drug
17 trafficking, interstate transportation of stolen goods, wire fraud, and mail fraud.
18 FACTS SUPPORTING PROBABLE CAUSE
Background on Romanian Organized Crime Group
19
20 4. In November 2021, The San Diego Police Department (SDPD) became aware
21 of a series of theft related crimes targeting the elderly population in San Diego. Suspects,
22 believed to have been of Romanian descent, used force to remove money and jewelry from
23 elderly victims or used sleight of hand techniques to remove their jewelry. Often, the
24 suspects placed inexpensive gold colored jewelry on the victims, removing their more
25 expensive jewelry at the same time. The suspects were consistently described as middle
26 eastern or white subjects driving newer SUV type vehicles. Approximately 20 cases were
27 reported to the San Diego Police Department and many more were reported throughout the
28 county beginning in February 2020.
2
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.4 Page 4 of 20
5. In May of 2022, SDPD and the FBI opened a joint investigation into the
1
2 criminal organization responsible for the aforementioned thefts in San Diego County. The
3 criminal organization, hereinafter the Valcea Crime Ring, was made up of Roma travelers
4 known to conduct various frauds and thefts throughout the United States. Many of the
5 members of the Valcea Crime Ring travel from the Valcea region of Romania to Mexico
6 and/or Canada with the intent of entering the United States. Upon entrance into the United
7 States, members of the organization were responsible for generating as much income as
8 possible through theft, begging and other financial crimes.
9 6. On June 17, 2022, SDPD located and arrested two members of the Valcea
10 Crime Ring, F.T. and M.C., for suspicion of money laundering and obtaining money on
11 false pretenses. At the time of their arrest, law enforcement found a 2019 W-2 for F.T.
12 listing Kraftsman Construction Co. as his employer. F.T. was advised of his rights, waived
13 his rights and agreed to speak with law enforcement. F.T. stated he traveled from Romania
14 to Toronto, Canada. On September 28, 2018, F.T. walked across the United States Canada
15 border into New York and turned himself into United States immigration authorities. F.T.
16 told law enforcement he bought fake jewelry and sold it as if it were real. Ultimately, F.T.
17 and M.C. were released from SDPD custody and no charges were filed.
18 Identification of Constantin SANDU and Discovery of EDD Fraud Scheme
19 7. Following F.T.’s arrest, F.T.1 expressed interest in providing information to
20 law enforcement. On July 7, 2022, F.T. contacted SDPD telephonically. Investigators
21 asked F.T. about the W-2 from Kraftsman Construction Co. found within his property at
22 the time of his arrest. F.T. told law enforcement he did not know anything about the
23 document and never worked for a construction company. F.T. disclosed to law enforcement
24 he had paid a man known as “Bobi” $1,000.00 and Bobi applied for California
25 Unemployment Insurance benefits through the Employment Development Department
26
27 1
F.T. was not promised anything in return for his cooperation. F.T. has prior arrests for alien
inadmissibility and driving without a license. Additionally, as of March 28, 2023 F.T. had an active arrest
28
warrant out of Georgia for a failure to appear in May of 2022.
3
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.5 Page 5 of 20
(EDD) on behalf of F.T. After the phone call with law enforcement, F.T. sent Investigators
1
2 a picture of Bobi’s Facebook account with the display name of Bobi Constantin and
3 username fabritio.constantin. Investigators reviewed Bobi’s Facebook profile and observed
4 numerous pictures of the individual F.T. identified as Bobi.
5 8. On July 26, 2022, Investigators obtained authorization from the Superior
6 Court of the State of California (SW#2207261250-SDPD-MDK-SW) for Meta Platforms,
7 Inc. to provide information associated with the “Bobi Constantin” Facebook profile.
8 Investigators compared photographs posted to the profile with photographs of an individual
9 already under investigation for COVID-19 fraud named Constantin SANDU. They
10 determined that SANDU was the same person as the Facebook profile “Bobi Constantin.”
11 9. Investigators reviewed data obtained from Facebook associated to SANDU’s
12 Facebook profile “Bobi Constantin”. A review of Facebook posts and messages revealed
13 SANDU had spoken to more than 75 different individuals about obtaining EDD benefits.
14 In those conversations, the individuals provided SANDU with personal identifiable
15 information (PII) including names, dates of birth, identifications, and social security
16 numbers2 (SSNs) for themselves and their family members. SANDU replied with e-mail
17 addresses, passwords, and tax documents, including W-2s, bearing the shared PII.
18 10. On or around June 2022, Detectives contacted EDD investigators and
19 obtained account information for accounts associated with the PII identified in SANDU’s
20 Facebook messages. EDD identified more than 100 accounts relating to those persons, who
21 collectively obtained more than 8 million dollars in EDD benefits beginning in July of
22 2020. In the majority of the applications submitted, individuals claimed to be United States
23 citizens, assumed an SSN not assigned to them, and uploaded fraudulent supporting
24 documents to include fake identifications, utility bills, and health insurance cards.
25 According to Department of Homeland Security, the majority of the applicants were not
26
2
In my training and experience, I know that a Social Security Number (SSN) is a nine-digit, unique
27 identifier issued by the Social Security Administration to U.S. citizens, permanent residents, and
28 temporary (working) residents. It is needed to work and is used to determine an individual’s eligibility for
Social Security benefits and certain government services. Most individuals have only one SSN.
4
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.6 Page 6 of 20
United States Citizens. According to the Social Security Administration, the majority of
1
2 applicants used SSNs that were non-existent or assigned to other individuals. Additionally,
3 based on records from Departments of Motor Vehicles (DMVs), Anthem Blue Cross, and
4 Southern California Edison, the majority of the supporting documents provided by these
5 applicants were not valid. Applicants submitted the documents they had received from
6 SANDU as proof of their eligibility for benefits.
7 Background on California EDD
8 11. The Unemployment Insurance (“UI”) Program is a joint federal-state
9 partnership administered on behalf of the U.S. Department of Labor by agencies in each
10 state. In the State of California, the UI Program is administered by California’s
11 Employment Development Department (“California EDD”).
12 12. On March 13, 2020, President Trump declared a nationwide emergency due
13 to COVID-19, and in March 2020, the Families First Coronavirus Response Act (FFCRA)
14 and the Coronavirus Aid, Relief, and Economic Security (CARES) Act provided additional
15 funding for state UI agencies to respond to the COVID-19 pandemic. The CARES Act
16 allowed states to expand the scope of workers who were eligible to receive state UI
17 benefits, to extend the period of time for which workers could be eligible for UI benefits,
18 and to allow workers who may have exhausted UI benefits under traditional programs to
19 receive benefits.
20 13. The CARES Act further expanded the ability of states to provide benefits to
21 unemployed workers by creating three new unemployment programs, namely, the
22 Pandemic Unemployment Assistance (PUA) program, which permitted states to provide
23 benefits to individuals who were self-employed, seeking part-time employment, or
24 otherwise would not qualify for regular unemployment benefits, the Federal Pandemic
25 Unemployment Compensation (FPUC) Program, which provided an additional amount in
26 federal benefits to individuals collecting traditional UI program benefits, and the Pandemic
27 Emergency Unemployment Compensation (PEUC) program, which provided additional
28 weeks of benefits for individuals who had otherwise exhausted their entitlement to regular
5
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.7 Page 7 of 20
UI benefits (collectively referred to herein as “expanded pandemic UI benefits”) PUA and
1
2 FPUC benefits were 100% federally funded benefits paid through state UI agencies. To
3 receive UI, PUA, PEUC, and FPUC benefits from a state UI agency, an applicant could
4 file a claim, via the internet, with the state UI agency from which he was eligible to seek
5 benefits.
6 14. California EDD provided unemployment insurance benefits for regular UI and
7 expanded UI pandemic benefits to individuals whom California EDD determined were
8 entitled to receive such benefits through debit cards, which were funded by California EDD
9 and issued by Bank of America N.A.
10 15. California EDD’s determination of whether the individuals were entitled to
11 receive unemployment insurance benefits relied, in part, on confirmations from the
12 employer (from which the individual has been recently unemployed) that the employee had
13 worked with the employer.
14 16. Once a debit card for unemployment insurance benefits was issued, California
15 EDD funded those debit cards by having funds drawn from the United States federal
16 treasury in Washington, D.C., and wired those funds to Bank of America N.A.
17 17. Bank of America N.A. utilized debit processing services located in Colorado
18 and Virginia to create accounts, load funds, and post payments for unemployment
19 insurance debit cards. When a withdrawal was made from an account using a debit card,
20 information was sent electronically to servers in Colorado and Virginia to post a debit to
21 the account.
22 18. Between March and October 2020, over 8 million Californians filed for
23 unemployment benefits. In light of the high volume of applications, on October 5, 2020,
24 California implemented a new verification process for EDD through ID.me, which
25 provided an automated process with a virtual in-person session with an ID.me
26 representative, known as a “trusted referee,” to quickly verify the identity of the applicant
27 through a multi-step process using Artificial Intelligence and Human Intelligence together.
28
6
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.8 Page 8 of 20
19. With the addition of ID.me, each applicant needed to complete a verification
1
2 process before applying for benefits. Once the verification process was completed, they
3 could re-enter the EDD portal and apply for benefits. The applicant would be given a
4 “Confirmation Number” associated to their application for future reference.
5 20. Once approved for pandemic benefits, the recipient of the benefits would be
6 required to periodically recertify under the penalties of perjury that, among other things,
7 the recipient was unemployed due to the COVID-19 pandemic and therefore remained
8 eligible to receive pandemic benefits.
9 Identification of David CONSTANTIN as Major Participant in the Fraud
10 21. Within the Facebook returns for SANDU, SDPD investigators located a
11 conversation with an account bearing the name “David Dzl”, user account
12 100004263034314. Using the photographs contained on the profile, investigators were able
13 to identify the user of Facebook account “David Dzl” as David CONSTANTIN by
14 comparing them to the photograph of CONSTANTIN on a Washington driver’s license.
15 22. On February 27, 2023, SANDU, along with his wife and four children, was
16 encountered by Border Patrol entering the United States illegally, approximately one mile
17 west of the San Ysidro, California Port of Entry and approximately 100 yards north of the
18 United States/Mexico International Boundary. Sandu was detained by Border Patrol and
19 then arrested by the FBI on March 1, 2023. On March 1, 2023, SANDU agreed to waive
20 his rights and speak to investigators. Among other things, he admitted to applying for EDD
21 benefits, assisting family in applying for EDD benefits, and sending approximately
22 $24,000.00 to a contractor in Romania to renovate his house. SANDU further admitted that
23 he used a friend to obtain fraudulent W-2s, false identifications, fraudulent utility bills and
24 fraudulent insurance cards for the purposes of applying for EDD benefits. SANDU told
25 law enforcement David CONSTANTIN was his brother and identified CONSTANTIN as
26 the user of the Facebook account “David Dzl”. SANDU is currently pending prosecution
27 in the Southern District of California, Case No. 23-CR-0386-LAB. He has expressed a
28 desire to cooperate with law enforcement.
7
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.9 Page 9 of 20
23. In the Facebook conversation between SANDU and CONSTANTIN,
1
2 Investigators observed SANDU frequently forward the PII he received from other
3 individuals to CONSTANTIN. CONSTANTIN frequently replied to SANDU a short time
4 later with tax documents bearing the PII. Investigators identified over 100 people for whom
5 CONSTANTIN provided SANDU tax documents, frequently W-2s. Investigators
6 identified many similarities between the documents, including common businesses,
7 common formatting, and common amount of reported yearly earnings. Based on records
8 from the California Franchise Tax Board, Southern California Edison, and Anthem Blue
9 Cross, the W-2s, utility bills and insurance cards submitted in support of these EDD
10 applications were falsified. The following are examples of Facebook message
11 conversations between SANDU and CONSTANTIN about EDD:
12 a. On July 29, 2021, co-conspirator F.M. sent SANDU an EDD email via
13 Facebook message showing the confirmation of a new online account for
14 F.M. Additionally, on July 29, 2021, SANDU sent CONSTANTIN via
15 Facebook message the email address that was later used for A.V. and
16 F.M.’s EDD applications.
17 b. On July 17, 2021, SANDU sent co-conspirator N.M. email address
18 namoln67@gmail.com via Facebook message. This email address was
19 originally sent to SANDU via Facebook message by CONSTANTIN.
20 c. On July 14, 2021, co-conspirator I.C.A. and SANDU coordinated via
21 Facebook message about EDD. SANDU sent two photographs of the EDD
22 portal security question screen for an account associated to email address
23 combic757@gmail.com. This email was associated to I.C.A.’s EDD
24 application and separately shared between SANDU and CONSTANTIN
25 via Facebook message.
26 d. On August 14, 2021, co-conspirator S.G. and SANDU coordinated via
27 Facebook message about EDD. The same day, CONSTANTIN sent
28
8
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.10 Page 10 of 20
SANDU via Facebook message two falsified documents for S.G. including
1
2 a W-2 and Southern California Edison utility bill.
3 24. On April 6, 2023, SANDU and his attorney met with Investigators and federal
4 prosecutors. SANDU was not promised anything in exchange for his cooperation. During
5 his proffer, SANDU explained that he and CONSTANTIN learned from a friend how to
6 create fraudulent documents and submit EDD applications. After a short time, SANDU
7 and CONSTANTIN went into business on their own. SANDU told law enforcement
8 CONSTANTIN assisted with creating the fraudulent documents required to submit EDD
9 applications. According to SANDU’s statements, CONSTANTIN and SANDU maintained
10 versions of W-2s, Southern California Edison utility bills and health insurance cards.
11 SANDU told law enforcement he and CONSTANTIN would just change the name, address
12 and SSN on the documents. These statements corroborated investigators understanding of
13 the scheme based on their own review and investigation.
14 25. Based on a review of SANDU’s Facebook messages and ID.me3 verification
15 videos, investigators determined SANDU and CONSTANTIN frequently met with co-
16 conspirators at parks to submit EDD applications and conduct ID.me verification videos.
17 Investigators believe SANDU and CONSTANTIN assisted co-conspirators through ID.me
18 verification videos. On the following occasions, CONSTANTIN was present for a co-
19 conspirator’s verification session:
20 a. On or about July 9, 2021, CONSTANTIN and SANDU were identified by
21 law enforcement in the background of co-conspirator, R.D.’s, ID.me
22 verification session.
23 b. On or about August 4, 2021, CONSTANTIN was identified by law
24 enforcement assisting co-conspirator, M.A., throughout their ID.me
25 verification session.
26
3
On October 5, 2020, California implemented a new identity verification process for EDD by contracting
27 with a third party company, ID.me. EDD applicants were required to submit their supporting
28 documentation to ID.me. Once the documents were reviewed, the applicant would conduct an ID.me
verification video session with an ID.me representative, known as a “trusted referee”.
9
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.11 Page 11 of 20
Money Obtained Through Wire Fraud and Conspiracy to Commit Wire Fraud
1
2 26. Investigators reviewed the records obtained from EDD, ID.me and Facebook,
3 including records associated with CONSTANTIN and Maria ALEXANDRU (identified as
4 CONSTANTIN’s wife). CONSTANTIN and ALEXANDRU applied for EDD benefits on
5 multiple occasions. On July 6, 2021, CONSTANTIN applied for EDD benefits using a
6 fraudulent W-2 listing Bless Tires & Auto Repair as his employer. CONSTANTIN listed
7 his telephone number as (562)-542-7153 (Subject Account #1) on his July 6, 2021 EDD
8 application.
9 27. On July 11, 2021, ALEXANDRU applied for EDD benefits using a fraudulent
10 W-2 listing TLC Cleaning as her employer. According to the California Franchise Tax
11 Board, Bless Tires & Auto Repair and TLC Cleaning were not legitimate companies
12 registered in the state of California. Despite this, both fraudulent W-2s documented the
13 payment of California state tax under a non-existent state tax identification number.
14 Investigators determined CONSTANTIN applied for EDD benefits on another occasion
15 under the alias Vlad Alexandru using another W-2 identifying Bless Tire & Auto Repair
16 as his employer. Additionally, investigators determined ALEXANDRU applied for EDD
17 benefits on another occasion under the alias Cristina Constantin using another W-2
18 identifying TLC Cleaning as her employer. From these fraudulent applications,
19 CONSTANTIN and ALEXANDRU obtained over $110,000.00 in EDD benefits.
20 28. CONSTANTIN listed telephone number (574)-327-1997 (Subject Account
21 #2) on his July 29, 2021 EDD application submitted under the alias Vlad Alexandru.
22 Investigators reviewed the ID.me verification video and selfie photographs submitted in
23 support of Vlad Alexandru’s EDD application. Based on the comparison of
24 CONSTANTIN’s Washington driver’s license, investigators identified CONSTANTIN to
25 be the true identity of Vlad Alexandru. Additionally, a review of SANDU’s historical call
26 detail records (received pursuant to a warrant authorized by U.S. Magistrate Judge Barbara
27 L. Major, No. 23MJ1164-BLM) revealed contact with Subject Account #1 and Subject
28 Account #2 during the course of the fraud scheme.
10
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.12 Page 12 of 20
29. Based on SANDU’s statements during the proffer interview, SANDU and
1
2 DAVID charged approximately $2,500.00 to assist others in filing applications. SANDU
3 told investigators they charged $1,000.00 up front and $1,500.00 once the individuals
4 received their money, but not everyone would pay.
5 30. On July 17, 2021 in a publicly viewable Facebook post by CONSTANTIN,
6 CONSTANTIN marketed their EDD application business. Based on a google translation,
7 the post read “you want EDD account $1000.00 now”. During SANDU’s proffer interview,
8 SANDU reviewed this post and told law enforcement it described their marketed payment
9 plan of $1,000.00 now and $1,500.00 after the EDD payout.
10 31. SANDU’s statements to Investigators on April 6, 2023 are corroborated by a
11 review of Facebook messages between SANDU and co-conspirators. SANDU charged a
12 fee assisting individuals with submitting fraudulent EDD applications online. Based on
4
13 Facebook messages, SANDU received payment for his services via counter deposit and
14 Zelle transfers. On multiple occasions via Facebook message, SANDU sent his Bank of
15 America account and routing numbers to co-conspirators to conduct counter deposits into
16 SANDU’s bank account following an EDD payout. The following are examples of
17 SANDU’s means and methods for receiving funds obtained via EDD fraud from his co-
18 conspirators.
19 a. I.C. communicated directly with SANDU via Facebook message regarding
20 EDD applications for himself and his wife, L.D. On July 10, 2021, L.D.
21 fraudulently applied for EDD, and ultimately received $27,000.00. On
22 September 2, 2020, SANDU sent his account and routing information to
23 I.C. via Facebook message. I.C. responded to SANDU via Facebook
24 message with a receipt for a $300.00 deposit. According to SANDU’s bank
25 account records, a $300.00 counter deposit was conducted on September
26 2, 2020.
27
4
A counter deposit is referred to as a financial transaction at a bank branch in which an individual
28
deposits money in person into a bank account.
11
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.13 Page 13 of 20
b. On September 2, 2020, F.R. applied online for EDD benefits. F.R. received
1
2 his/her first EDD payment on October 23, 2020 and received a large
3 payment on November 4, 2020. A few days after the large payment, on
4 November 11, 2020, SANDU sent F.R. his account and routing
5 information. The following day, a $250 transfer was made into SANDU’s
6 account.
7 c. C.S. communicated directly with SANDU via Facebook message about
8 EDD for himself and his wife, R.M. On July 31, 2020, C.S. applied online
9 for EDD benefits. On December 26, 2020, R.M. applied online for EDD
10 benefits. C.S. received an EDD payout on August 7, 2020 and R.M.
11 received an EDD payout on December 30, 2020. On December 10, 2020,
12 SANDU sent C.S his account and routing information via Facebook
13 message. C.S. responded the same day with a photo of a Bank of America
14 receipt confirming a $900.00 deposit. According to records for SANDU’s
15 bank account, a $900.00 counter deposit was conducted on December 10,
16 2020.
17 d. R.D. communicated directly with SANDU via Facebook message
18 regarding EDD fraud on behalf of himself and four other individuals:
19 M.D., A.M., A.D., and M.C.. In July 2021, three of the individuals
20 fraudulently applied for and received EDD benefits. On September 29,
21 2021, M.C. received the group’s final EDD payout. On the same day, R.D.
22 sent SANDU five $500.00 Zelle transfers.
23 32. Investigators believe CONSTANTIN received a portion of the criminally
24 derived funds based on the flow of funds from SANDU to CONSTANTIN during the
25 period of the fraud scheme. Between December 2020 and August 2022, SANDU sent
26 $16,747.00 via 37 different Zelle transfers to a Zelle account in the name of
27 CONSTANTIN. Additionally, during SANDU’s proffer interview, SANDU told law
28
12
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.14 Page 14 of 20
enforcement he gave CONSTANTIN between $400.00 and $1,000.00 per EDD
1
2 application.
3 33. A review of SANDU’s bank account showed SANDU had used the online
5
4 money transfer service Remitly to transfer large amounts of money to an individual in
5 Romania during the period of the fraud scheme. According to records received from
6 Remitly, between May 19, 2021 and August 14, 2022, SANDU sent 20 transactions
7 totaling more than $16,000.00 for the purposes of SANDU’s home renovations in
8 Romania. SANDU’s post-arrest interview on March 1, 2023, confirmed his intentions of
9 sending money to Romania for the purposes of renovating his house.
10 34. During the April 6, 2023 proffer, SANDU told law enforcement
11 CONSTANTIN also sent money to Romania throughout the course of the fraud scheme
12 for the purposes of renovating CONSTANTIN’s house in Pitesti, Romania.
13 SANDU and CONSTANTIN’s Use of Cellular Telephones Throughout Their Conspiracy
14 35. A review of ID.me records identified four devices with specific device
15 fingerprints6 that were used to create and/or modify ID.me profiles that facilitated the
16 verification of at least 137 fraudulent EDD applications for 137 different individuals.
17 Investigators traced each of the four devices to SANDU and/or CONSTANTIN through
18 conversations and EDD applications they created.
19 36. This is consistent with SANDU’s statements during the proffer interview.
20 SANDU told law enforcement he and CONSTANTIN met with co-conspirators at parks to
21 submit EDD applications and conduct ID.me verification sessions on their cellular
22 telephones. SANDU disclosed that he and CONSTANTIN used many cellular telephone
23
5
Open source research identified Remitly as a financial institution known for sending money abroad. As
24 of March 28, 2023, Remitly marketed their business as “Remit Money Abroad – Remit Quickly”. Based
25 on my training and experience, individuals who have obtained money fraudulently, through illicit means
and/or otherwise specified unlawful activity will often attempt to repatriate those funds to another country
26 for the purposes of concealing the source and nature of the funds or to further promote specified unlawful
activity.
27 6 A device fingerprint is a unique identifier (aggregated hash value) associated with a user’s device, from
28 the hardware, operating system, audio stack, and its configuration. Browser fingerprinting refers to the
process of collecting information through java script to create a fingerprint of a device.
13
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.15 Page 15 of 20
1 numbers throughout their conspiracy as they would purchase a cellular device from a
2 private retailer and obtain SIM cards from a wireless cellular telephone service company,
3 like AT&T. SANDU told law enforcement he and CONSTANTIN telephonically
4 contacted EDD on numerous occasions. A review of SANDU’s call detail records revealed
5 hundreds of contacts with telephone numbers associated to EDD during the period of July
6 1, 2020 to August 31, 2022.
7 METHODOLOGY
8 37. Based on the facts above, there is reason to believe that CONSTANTIN
9 committed illegal activities, and that CONSTANTIN used the Subject Accounts to
10 communicate with SANDU and others for the purpose of conspiracy to commit wire fraud
11 and money laundering. I believe that the Subject Accounts will produce evidence that
12 provides further corroboration of these.
13 38. Based on my training and experience, and my consultation with other law
14 enforcement officers, I am aware that AT&T and T-Mobile routinely collect and store data
15 for the electronic communication accounts to which it and other providers issue telephone
16 numbers. The data includes: (i) subscribers’ contact and billing information; (ii) detailed
17 information concerning subscribers’ incoming and outgoing telephone calls; (iii) detailed
18 information concerning subscribers’ outgoing direct calls, text message, and SMS
19 messages; and (iv) detailed information concerning cell-site geo-location data.
20 39. In particular, I know that cell phones connect to a provider’s network through
21 cell towers or cell sites. The particular tower or site may change as a phone moves from
22 one location to another. Providers automatically record and retain this connection data as
23 part of the account. Records and data identifying the towers or sites to which a phone
24 connected therefore tend to identify the phone’s and phone user’s location at particular
25 times.
26 40. Given these facts, I seek a warrant to search the Subject Accounts for the
27 records and information in Attachments B-1 and B-2.
28 PRIOR ATTEMPTS TO OBTAIN THIS EVIDENCE
14
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.16 Page 16 of 20
1 41. The United States is unaware at this time of other attempts by the U.S.
2 government to obtain this data by other means.
3 I swear the foregoing is true and correct to the best of my knowledge and belief.
4
5 Courtney M. McGuire
6 Courtney M. McGuire
Special Agent, FBI
7
8
Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1
9 by telephone on this 11th day of April 2023.
10
_________________________________
11 HONORABLE MICHAEL S. BERG
12 United States Magistrate Judge
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
15
30
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.17 Page 17 of 20
ATTACHMENT A-2
1
PROPERTY TO BE SEARCHED
2
3 T-Mobile hosts the electronic communication account associated with the telephone
number (574)-327-1997 (Subject Account #2) that is the subject of this search warrant
4 and search warrant application. T-Mobile is an electronic communication service provider
5 whose primary computer information systems and other electronic communications and
storage systems, records, and data are located at 4 Sylvan Way, Parsippany, New Jersey.
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
17
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.18 Page 18 of 20
ATTACHMENT B-2
1
ITEMS TO BE SEIZED
2 I. Service of Warrant
3
The officer executing the warrant shall permit the Provider in Attachment A-2, as
4 custodian of the electronic files described in Section II below, to locate the files and copy
5 them onto removable electronic storage media and deliver the same to the officer.
II. Items to Be Seized
6
Agents shall seize the following records, data, and information covering July 1, 2020
7
up to and including and August 31, 2022 and maintained by the Provider for Subject
8
Account #2 identified in Attachment A-2:
9
10 a. Subscriber information, including:
11 i. Names;
ii. Addresses (including mailing addresses, residential addresses, business
12 addresses, and e-mail addresses);
13 iii. Local and long distance telephone connection records;
iv. Records of session times and durations, and the temporarily assigned
14 network addresses (such as Internet Protocol (“IP”) addresses)
15 associated with those sessions;
v. Length of service (including start date) and types of service utilized;
16 vi. Telephone or instrument numbers, including MAC addresses,
17 Electronic Serial Numbers (“ESN”), Mobile Electronic Identity
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”); Mobile
18 Identification Number (“MIN”), Subscriber Identity Modules (“SIM”),
19 Mobile Subscriber Integrated Services Digital Network Number
(“MSISDN”); International Mobile Subscriber Identity Identifiers
20 (“IMSI”), or International Mobile Equipment Identities (“IMEI”);
21 vii. Other subscriber numbers or identities; and
viii. Means and source of payment (including any credit card or bank
22 account number) and billing records.
23
b. Records and other information about past wire or electronic communications
24 sent or received by the subject account, including:
25 i. the date and time of the communication;
ii. the method of the communication;
26 iii. the source and destination of the communication, such as the source and
27 destination telephone numbers (call detail records), email addresses, or
IP addresses; [and]
28
21
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.19 Page 19 of 20
iv. Cell site locations and sectors for all outgoing and incoming voice,
1
SMS, MMS, and Data communications;
2
3
Which are evidence of violations of Title 18, United States Code, Sections 1349 and
4
1956(h).
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
22
Case 3:23-mj-01302-MSB Document 1 Filed 04/11/23 PageID.20 Page 20 of 20
CERTIFICATE OF AUTHENTICITY OF DOMESTIC RECORDS
1 PURSUANT TO FEDERAL RULES OF EVIDENCE 902(11) AND 902(13)
2
3 I, _________________________________, attest, under penalties of perjury by the laws of the
4 United States of America pursuant to 28 U.S.C. § 1746, that the information contained in this certification
5 is true and correct. I am employed by T-Mobile, and my title is _____________________________. I
6 am qualified to authenticate the records attached hereto because I am familiar with how the records were
7
created, managed, stored, and retrieved. I state that the records attached hereto are true duplicates of the
8
original records in the custody of T-Mobile. The attached records consist of ______________
9
[GENERALLY DESCRIBE RECORDS (pages/CDs/megabytes)]. I further state that:
10
11 a. all records attached to this certificate were made at or near the time of the occurrence of
the matter set forth by, or from information transmitted by, a person with knowledge of those matters,
12
they were kept in the ordinary course of the regularly conducted business activity of T-Mobile, and they
13
were made by T-Mobile as a regular practice; and
14 b. such records were generated by T-Mobile’s electronic process or system that produces an
15 accurate result, to wit:
16 1. the records were copied from electronic device(s), storage medium(s), or file(s) in
17 the custody of T-Mobile in a manner to ensure that they are true duplicates of the original records; and
2. the process or system is regularly verified by T-Mobile, and at all times pertinent
18
to the records certified here the process and system functioned properly and normally.
19
I further state that this certification is intended to satisfy Rules 902(11) and 902(13) of the Federal
20
Rules of Evidence.
21
22
23 Date Signature
24
25
26
27
28
26
File and source
- File
- gov.uscourts.casd.756626.1.0.pdf
- Size
- 655,749 bytes
- SHA-256
- 8dbd2368a91cbdfb2816a7e6014626195f7bfb5b22b5a6261421ca8927b9f2e5
- Our copy
- gov.uscourts.casd.756626.1.0.pdf
- Original
- www.courtlistener.com