Court Filing — DCD Case 267377, Doc. 1
- Date
- 2024-04-17
Source document: Court Filing — DCD Case 267377, Doc. 1; document type: Search warrant material.
Full text
AO 106A (08/18) Application for a Warrant by Telephone or Other Reliable Electronic Means UNITED STATES DISTRICT COURT for the District of&ROXPELD In the Matter of the Search of ) ) ) ) ) ) (Briefly describe the property to be searched or identify the person by name and address) Case No. The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): u evidence of a crime; u contraband, fruits of crime, or other items illegally possessed; u property designed for use, intended for use, or used in committing a crime; u a person to be arrested or a person who is unlawfully restrained. ) is requested under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. Applicant’s signature Printed name and title Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by (specify reliable electronic means). Date: Judge’s signature City and state: APPLICATION FOR A WARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location): 6HH$WWDFKPHQW$LQFRUSRUDWHGE\UHIHUHQFH /RFDWHGZLWKLQWKHMXULVGLFWLRQRIWKH'LVWULFWRI&ROXPELD, there is now concealed (identify the SHUVRQRUGHVFULEHWKH SURSHUW\WREHVHL]HG 6HH$WWDFKPHQW%LQFRUSRUDWHGE\UHIHUHQFH u Continued on the attached sheet. u Delayed notice of days (give exact ending date if more than 30 days: 7HOHSKRQH :DVKLQJWRQ'& 8QLWHG6WDWHV0DJLVWUDWH-XGJH INFORMATION ASSOCIATED WITH ONE ACCOUNT THAT IS STORED AT PREMISES CONTROLLED BY ONE PROVIDER PURSUANT TO 18 U.S.C. 2703 FOR INVESTIGATION OF VIOLATION OF 18 U.S.C. § 641 24-SC-834 ✔ ✔ The search is related to a violation of: Code Section Offense Description 18 U.S.C. § 641(Theft of Government Funds) ; 18 U.S.C. § 1014 (False Statements); 18 U.S.C. § 1343 (Wire Fraud); 18 U.S.C. § 1344 (Bank Fraud); 18 U.S.C. § 1956(h) (Money Laundering Conspiracy); 18 U.S.C. § 1957 (Financial Transaction with Proceeds of Unlawful Activity). The application is based on these facts: See Affidavit in Support of Application for Search Warrant. William Rose, Special Agent 4/17/2024 G. Michael Harvey Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 1 of 81 AO 93C () :DUUDQWE\7HOHSKRQHRU2WKHU5HOLDEOH(OHFWURQLF0HDQV u Original u Duplicate Original UNITED STATES DISTRICT COURT for the 'LVWULFWRI&ROXPELD In the Matter of the Search of ) ) ) ) ) ) (Briefly describe the property to be searched or identify the person by name and address) Case No. :$55$17%<7(/(3+21(2527+(55(/,$%/((/(&7521,&0($16 To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the searchDQGVHL]XUH of the following person or property located ZLWKin theMXULVGLFWLRQRIWKH'LVWULFWRI&ROXPELD (identify the person or describe the property to be searched and give its location): I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (identify the person or describe the property to be seized): YOU ARE COMMANDED to execute this warrant on or before (not to exceed 14 days) u in the daytime 6:00 a.m. to 10:00 p.m. u at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and promptly return this warrant and inventory to . (United States 0DJLVWUDWH Judge) u Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) u for days (not to exceed 30) u until, the facts justifying, the later specific date of . Date and time issued: Judge’s signature City and state: 8QLWHG6WDWHV0DJLVWUDWH-XGJH ✔ INFORMATION ASSOCIATED WITH ONE ACCOUNT THAT IS STORED AT PREMISES CONTROLLED BY ONE PROVIDER PURSUANT TO 18 U.S.C. 2703 FOR INVESTIGATION OF VIOLATION OF 18 U.S.C. § 641 24-SC-834 See Attachment A (incorporated by reference). See Attachment B (incorporated by reference). April 30, 2024 ✔ G. Michael Harvey 4/17/2024 Washington, D.C. G. Michael Harvey Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 2 of 81 AO 93& () :DUUDQWE\7HOHSKRQHRU2WKHU5HOLDEOH(OHFWURQLF0HDQV(Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of : Inventory of the property taken and nameV of any person(s) seized: Certification I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. Date: Executing officer’s signature Printed name and title 24-SC-834 Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 3 of 81 1 ATTACHMENT A Property to Be Searched This warrant applies to information associated with the Yahoo account identified by Wendynvillatoro@yahoo.com (“the TARGET YAHOO ACCOUNT”) that is stored at premises owned, maintained, controlled, or operated by Yahoo Inc., a company headquartered at 1199 Coleman Avenue, San Jose, California. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 4 of 81 1 ATTACHMENT B Particular Things to be Seized I. Information to be disclosed by Yahoo Inc. (“Yahoo”) To the extent that the information described in Attachment A is within the possession, custody, or control of Yahoo (hereinafter “PROVIDER”), regardless of whether such information is located within or outside of the United States, and including any emails, records, files, logs, or information that has been deleted but is still available to Yahoo, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f) on March 2, 2024 (Yahoo Reference # 571120), Yahoo is required to disclose the following information to the government for the account listed in Attachment A for the time period of January 1, 2020 to the present: a. The contents of all communications and related transactional records for all PROVIDER services used by an Account subscriber/user (such as email services, calendar services, file sharing or storage services, photo sharing or storage services, remote computing services, instant messaging or chat services, voice call services, or remote computing services, including but not limited to incoming, outgoing, and draft emails, messages, calls, chats, and other electronic communications; attachments to communications (including native files); source and destination addresses and header or routing information for each communication (including originating IP addresses of emails); the date, size, and length of each communication; and any user or device identifiers linked to each communication (including cookies);21 21 For PROVIDER, the services may include e-mail, contact list, notes, chat, and other services as noted generically above, the branded services Yahoo groups (a listserv and bulletin board service, which users can opt into), and Yahoo Messenger (an instant messaging service, which users can opt into), and any designated “documents” functions that operate through Yahoo’s e-mail storage. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 5 of 81 2 b. The contents of all other data and related transactional records for all PROVIDER services used by an Account user (such as email services, calendar services, file sharing or storage services, photo sharing or storage services, remote computing services, instant messaging or chat services, voice call services, or remote computing services, including any information generated, modified, or stored by user(s) or PROVIDER in connection with the Account (such as contacts, calendar data, images, videos, notes, documents, bookmarks, profiles, device backups, and any other saved information); c. All PROVIDER records concerning the online search and browsing history associated with the Account or its users (such as information collected through tracking cookies); d. All records and other information concerning any document, or other computer file created, stored, revised, or accessed in connection with the Account or by an Account user, including the contents and revision history of each document or other computer file, and all records and other information about each connection made to or from such document or other computer file, including the date, time, length, and method of connection; server log records; data transfer volume; and source and destination IP addresses and port numbers; e. All records regarding identification of the Account, including names, addresses, telephone numbers, alternative email addresses provided during registration, means and source of payment (including any credit card or bank account number), records of session times and durations (including IP addresses, cookies, device information, and other identifiers linked to those sessions), records of account registration (including the IP address, cookies, device information, and other identifiers linked to account registration), length of service and types of services utilized, account status, methods of connecting, and server log files; Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 6 of 81 3 f. All records pertaining to devices associated with the Account and software used to create and access the Account, including device serial numbers, instrument numbers, model types/numbers, International Mobile Equipment Identities (“IMEI”), Mobile Equipment Identifiers (“MEID”), Global Unique Identifiers (“GUID”), Electronic Serial Numbers (“ESN”), Android Device IDs, phone numbers, Media Access Control (“MAC”) addresses, operating system information, browser information, mobile network information, information regarding cookies and similar technologies, and any other unique identifiers that would assist in identifying any such device(s); g. Basic subscriber records and login history (including, as described in 18 U.S.C. § 2703(c)(2), names, addresses, records of session times and durations, length of service and types of service utilized, instrument numbers or other subscriber numbers or identities, and payment information) concerning any PROVIDER account (including both current and historical accounts) ever linked to the Account by a common email address (such as a common recovery email address), or a common telephone number, means of payment (e.g., credit card number), registration or login IP addresses (during one-week period), registration or login cookies or similar technologies, or any other unique device or user identifier; h. All information held by PROVIDER related to the location and location history of the user(s) of the Account, including geographic locations associated with the Account (including those collected for non-PROVIDER based applications), IP addresses, Global Positioning System (“GPS”) information, and information pertaining to nearby devices, Wi-Fi access points, and cell towers; i. All records of communications between PROVIDER and any person regarding the Account, including contacts with support services and records of actions taken; Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 7 of 81 4 j. Information about any complaint, alert, or other indication of malware, fraud, or terms of service violation related to the Account or associated user(s), including any memoranda, correspondence, investigation files, or records of meetings or discussions about the Account or associated user(s) (but not including confidential communications with legal counsel). Within 14 days of the issuance of this warrant, Yahoo shall deliver the information set forth above to the following: William Rose Special-Agent Badge# 333 USDA-Office of Inspector General Office of Investigations| Northeast Region 5601 Sunnyside Avenue Beltsville, MD 20705 Cell: 202-280-9159 William.Rose@oig.usda.gov Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 8 of 81 5 II. Information to be seized by the government All information described above in Section I that constitutes fruits, contraband, evidence, and/or instrumentalities of violations of Title 18, United States Code, Sections 641 (Theft of Government Funds), 1014 (False Statements), 1343 (Wire Fraud), 1344 (Bank Fraud), 1956(h) (Money Laundering Conspiracy), and 1957 (Financial Transaction with Proceeds of Unlawful Activity) (the “TARGET OFFENSES”) by Wendy Nicole Villatoro, Joyce Burch-Richardson and any co-conspirators as described in the affidavit submitted in support for this Warrant, including for the Account or identifier listed on Attachment A, information pertaining to the following matters: a. Information that constitutes evidence of the identification or location of the user(s) of the Account; b. Information that constitutes evidence concerning persons who either (i) collaborated, conspired, or assisted (knowingly or unknowingly) the commission of the criminal activity under investigation; or (ii) communicated with the Account about matters relating to the criminal activity under investigation, including records that help reveal their whereabouts; c. Information that constitutes evidence indicating the Account user’s state of mind, e.g., intent, absence of mistake, or evidence indicating preparation or planning, related to the criminal activity under investigation; d. Information that constitutes evidence concerning how and when the Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crime under investigation and to the Account user; Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 9 of 81 6 e. Information that constitutes evidence concerning the TARGET OFFENSES, to include: i. Documents, communications, or other information relating to the use of identities or personally identifying information (including names, Social Security numbers, birth dates, payment card numbers, or bank accounts) or financial information associated with individuals other than VILLATORO and BURCH-RICHARDSON; ii. Documents, communications, or other information relating to the use of fake or falsified personally identifying information (including names, Social Security numbers, birth dates, payment card numbers, or bank accounts) or financial information; iii. Any and all communications, records and documents, in whatever form, relating to corporate entities (including limited liability companies and partnerships) that are owned, controlled, or used by Wendy Villatoro, including but not limited to the following business entities: 1. Chizzy Consulting and Management LLC 2. Forward Concepts LLC 3. Kouture Kidz Boutique LLC 4. Students Beyond Borders Foundation LLC 5. Late Night N Early Mornings LLC 6. Paratus Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 10 of 81 7 iv. Any and all communications, records and documents, in whatever form, relating to the use of NameCheap Inc. in connection with the entities or persons described in Paragraphs (i) and (iii). v. Any and all communications, records and documents, in whatever form, related to seeking funds from the Small Business Administration (“SBA”), CARES Act, Payment Protection Program (“PPP”), the Economic Injury Disaster Loan (“EIDL”) program, Celtic Bank Corporation, First Home Bank, and Prestamos CDFI, or other federally funded, insured or guaranteed loans. vi. Any and all communications, records and documents, in whatever form, related to the registration, maintenance, termination, or use of websites, or email addresses for entities or persons described in Paragraphs (i) and (iii). vii. Communications, records and documents containing personnel listings, employee files, or other documents of any kind that identify the name, address, telephone number, and social security numbers of any current or former employees and independent contractors who performed work for the entities listed in Paragraphs (i) and (iii); viii. Any and all communications and records related to business records for the entities listed in Paragraphs (i) and (iii); ix. Any and all communications related to tax documents, including W-2, W- 4, W-9, 1040, 1120, and 1099, for the entities or persons described in Paragraphs (i) and (iii); Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 11 of 81 8 x. Any and all communications and documents detailing or summarizing annual, quarterly, monthly, weekly, or daily financial performance pertaining to the entities listed in Paragraphs (i) and (iii); xi. Any and all communications, financial records, and documents, in whatever form—including but not limited to bank statements, checks, loan records, credit card records, ledgers, check registers, credit cards, lines of credit, deposit records, wire transfer detail, money transfer records, faxes, memoranda, correspondence, and applications—for the entities or persons described in Paragraphs (i) and (iii); xii. documents, communications, or other information relating to the structuring or other concealment of financial transfers and/or withdrawals; xiii. lists or ledgers of payment card numbers issued by financial institutions or credit card companies to VILLATORO or BURCH-RICHARDSON; xiv. lists, ledgers, or other information memorializing items purchased fraudulently (including the types of items, amounts paid, and payment information used), as well as the dates and places of transactions; xv. identity documentation, such as visas, passports, driver’s licenses, and birth certificates; xvi. bank records, checks, credit card bills, account information, and other financial records; xvii. documents, communications, and other information regarding VILLATORO’s, BURCH-RICHARDSON’s or their co-conspirators’ schedule or travel; Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 12 of 81 9 xviii. communications with credit companies, financial institutions, e-currency companies or vendors, or merchants or retailers; xix. photographs of VILLATORO, BURCH-RICHARDSON or co-conspirators involved in the criminal conduct identified above, or that would reveal the identity or relationships between co-conspirators; xx. documents, communications, and other information regarding the usernames, phone numbers, emails, or social media or instant messenger names used by VILLATORO, BURCH-RICHARDSON or their co- conspirators to transmit personally identifying information, payment card numbers, and false identification documents in furtherance of the criminal conduct identified above; xxi. documents, communications, and other information indicating the state of mind as it relates to the crime under investigation of VILLATORO, BURCH-RICHARDSON and their co-conspirators; xxii. documents, communications, and other information, including address or telephone books or contact lists, that reflect names of potential criminal associates involved in the crimes under investigation; xxiii. documents, communications, and other information regarding the identity of co-conspirators, accomplices, and aiders and abettors in the commission of the criminal activity under investigation, including information that reveals their whereabouts; xxiv. documents, communications, and other information indicating how and when each account or identifier listed on Attachment A was accessed or Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 13 of 81 10 used, to determine the geographic and chronological context of account access, use, and events relating to the crime under investigation and to the email account owner; xxv. Any and all communications, Records and other information that constitute evidence of the state of mind of VILLATORO or BURCH- RICHARDSON, e.g. intent, absence of mistake, or evidence indicating preparation or planning, or knowledge and experience, related to the criminal activity under investigation; xxvi. Records and information that constitute evidence of the state of mind of VILLATORO or BURCH-RICHARDSON, e.g. intent, absence of mistake, or evidence indicating preparation or planning, or knowledge and experience, related to the criminal activity under investigation; xxvii. the identity of the person(s) who created or used each account or identifier listed on Attachment A, including records that help reveal the whereabouts of such person(s); and xxviii. documents, communications, and other information regarding the identity of the person(s) who communicated with each account or identifier listed on Attachment A about matters relating to the crimes under investigation, including records that help reveal their whereabouts. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 14 of 81 11 III. Government procedures for warrant execution The United States government will conduct a search of the information produced by the PROVIDER and determine which information is within the scope of the information to be seized specified in Section II. The review of this electronic data may be conducted by any government personnel assisting in the investigation, who may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, and technical experts. Pursuant to this warrant, the USDA-OIG may deliver a complete copy of the disclosed electronic data to the custody and control of attorneys for the government and their support staff for their independent review. Law enforcement personnel will then seal any information from the PROVIDER that does not fall within the scope of Section II and will not further review the information absent an order of the Court. Such sealed information may include retaining a digital copy of all information received pursuant to the warrant to be used for authentication at trial, as needed. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 15 of 81 1 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH ONE ACCOUNT THAT IS STORED AT PREMISES CONTROLLED BY ONE PROVIDER PURSUANT TO 18 U.S.C. 2703 FOR INVESTIGATION OF VIOLATION OF 18 U.S.C. § 641 Case No. 24-SC-834 Filed Under Seal AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, William Rose, being first duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for a search warrant for information associated with a certain account, Wendynvillatoro@yahoo.com (hereafter the “TARGET YAHOO ACCOUNT”) that is stored at premises owned, maintained, controlled, or operated by Yahoo, Inc (“Yahoo”), an electronic communications service and/or remote computing service provider headquartered at 391 San Antonio Road. Mountain View 5th Floor, CA 94040. The information to be searched is described in the following paragraphs and in Attachment A. This affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Yahoo to disclose to the government copies of the information (including the content of communications) further described in Section I of Attachment B. Upon receipt of the information described in Section I of Attachment B, government-authorized persons will review that information to locate the items described in Section II of Attachment B. 2. I am a Special Agent with the United States Department of Agriculture, Office of Inspector General (the “USDA-OIG”), where I have served since July 3, 2022. I am currently Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 16 of 81 2 assigned to the USDA-OIG Beltsville, MD Sub-Office. Prior to joining USDA-OIG, I was a special agent with the United States Secret Service where I received training related to financial investigations, money laundering, identity theft, protective intelligence investigations. In the course of my employment as a Special Agent, I have received training regarding the application for and execution of both search and arrest warrants. I have completed the Criminal Investigator Training Program at the Federal Law Enforcement Training Center, as well, as the Special Agent Training Course through the US Secret Service. In my current assignment, I have participated in and conducted numerous investigations involving illegal activity including fraud to USDA and other federal programs, theft of government funds, wire fraud, and money laundering. I have assisted and/or participated in the preparation and/or execution of multiple search and arrest warrants. As a federal law enforcement officer, I am authorized to execute search and seizure warrants issued under Rule 41 of the Federal Rules of Criminal Procedure. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 3. Based on my training and experience and the facts as set forth in this affidavit, there is probable cause to believe that violations of Title 18, United States Code, Sections 641 (Theft of Government Funds), 1014 (False Statements), 1343 (Wire Fraud), 1344 (Bank Fraud), 1956(h) (Money Laundering Conspiracy), and 1957 (Financial Transaction with Proceeds of Unlawful Activity) (hereinafter, the “TARGET OFFENSES”) have been committed by Wendy Nicole Villatoro (VILLATORO) and Joyce Burch-Richardson (BURCH-RICHARDSON). There is also probable cause to search the information described in Attachment A for evidence, instrumentalities, contraband, and/or fruits of these crimes further described in Attachment B. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 17 of 81 3 JURISDICTION 4. This Court has jurisdiction to issue the requested warrant because it is “a court of competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A), & (c)(1)(A). Specifically, the Court is “a district court of the United States…that has jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(i). As discussed more fully below, acts or omissions in furtherance of the offenses under investigation occurred within the District of Columbia. See 18 U.S.C. § 3237. RELEVANT ENTITIES 5. First Home Bank is based in St. Petersburg, Florida and is insured by the Federal Deposit Insurance Corporation (FDIC).1 6. Prestamos Community Development Financial Institution (CDFI) is based in Phoenix, Arizona and is insured by the FDIC. 7. Celtic Bank Corporation is based in Salt Lake City, Utah and is insured by the FDIC. 8. JPMorgan Chase Bank (CHASE) is based in New York, New York and is insured by the FDIC. 9. Navy Federal Credit Union (NFCU) is based in Vienna, Virginia and is insured by the FDIC. 10. Truist Bank is based in Charlotte, North Carolina and is insured by the FDIC. 11. Capital One Bank is based in McLean, Virginia and is insured by the FDIC. 1 In or about May 2022, First Home Bank changed its name to BayFirst Financial. However, at the time funds were disbursed relevant to this investigation, the name of the bank was First Home Bank. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 18 of 81 4 12. PNC Bank is based in Pittsburgh, Pennsylvania and is insured by the FDIC. PAYMENT PROTECTION PROGRAM 13. The Coronavirus Aid, Relief, and Economic Security (CARES) Act is a federal law enacted in or around March 2020 and designed to provide emergency financial assistance to the millions of Americans who were suffering the economic effects caused by the COVID-19 pandemic. One source of relief provided by the CARES Act was the authorization of up to $349 billion in forgivable loans to small businesses for job retention and certain other expenses through a program referred to as the Paycheck Protection Program (PPP). In or around April 2020, Congress authorized over $300 billion in additional PPP funding.2 The PPP is administered by the U.S. Small Business Administration (SBA), which is an executive agency of the United States. 14. To obtain a PPP loan, a qualifying business must submit a PPP loan application (SBA Form 2483), which is signed by an authorized representative of the business. The PPP loan application requires the business (through its authorized representative) to acknowledge the program rules and make certain affirmative certifications in order to be eligible to obtain the PPP loan. In the PPP loan application, the small business (through its authorized representative) must state, among other things, its: (a) average monthly payroll expenses; and (b) number of employees. These figures are used to calculate the amount of money the small business is eligible to receive under the program. In addition, businesses applying for a PPP loan must provide documentation showing their payroll expenses. 15. The small business must use the PPP loan proceeds on certain permissible expenses, such as payroll costs, interest on mortgages, rent, and utilities. The program allows the interest and 2 All dates and amounts are approximations. The words “on or about” and “approximately” are omitted for clarity. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 19 of 81 5 principal on the PPP loan to be entirely forgiven if the business spends the loan proceeds on the allowable expenses within a designated period of time (usually within twenty-four weeks of receiving the proceeds) and uses at least 60% of the PPP loan proceeds for payroll expenses. 16. The PPP loan application requires the authorized representative to certify, in good faith, the Applicant’s operating status by initialing on a line next to the statement: “The Applicant was in operation on February 15, 2020, and had employees for whom it paid salaries and payroll taxes or paid independent contractors, as reported on Form(s) 1099-MISC.” 17. The PPP loan application also requires the authorized representative to certify, in good faith, the accuracy of submitted information and documents by placing their initials next to the following statement: “I further certify that the information provided in this application and the information provided in all supporting documents and forms is true and correct in all material respects. I understand that knowingly making a false statement to obtain a guaranteed loan from SBA is punishable under the law, including under 18 USC 1001 and 3571 by imprisonment of not more than five years and/or a fine of up to $250,000; under 15 USC 645 by imprisonment of not more than two years and/or a fine of not more than $5,000; and, if submitted to a federally insured institution, under 18 USC 1014 by imprisonment of not more than thirty years and/or a fine of not more than $1,000,000.” 18. A PPP loan application must be processed by a participating lending financial institution (the lender). If the participating financial institution approves a loan application, it funds the loan using its monies, which are l00% guaranteed by the SBA. Participating financial institutions require the information provided in PPP loan applications, including information about the business employees and payroll expenses, to be truthful. Data from the application, including information about the borrower, the total amount of the loan, and the listed number of employees, is transmitted by the lending financial institution to the SBA in the course of processing the loan. ECONOMIC INJURY DISASTER LOAN PROGRAM Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 20 of 81 6 19. The SBA, through its Office of Disaster Assistance (ODA), provides financial assistance to businesses of all sizes, most private non-profit organizations, homeowners, and renters following a declared disaster. SBA also provides eligible small businesses necessary working capital to help overcome the economic injury of a declared disaster. Section 7(b)(2) of the Small Business Act, as amended, authorizes the SBA’s Economic Injury Disaster Loan (EIDL) Program. The SBA can make loans to eligible small businesses, eligible non-profit organizations, and eligible small agricultural cooperatives located in a disaster area that suffered substantial economic injury because of a disaster. The EIDL program provides low-interest financing to small businesses, renters, and homeowners in regions affected by declared disasters. 20. On March 13, 2020, the President of the United States determined that the ongoing COVID-19 pandemic was of sufficient severity and magnitude to warrant an emergency determination under Section 501(b) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. 5121-5207 (“Stafford Act”).3 Consequently, SBA declared all states and territories eligible for EIDL assistance. An EIDL loan associated with COVID-19 received automatic payment deferment for one-year, automatic deferment of previous disaster loans for homeowners and businesses through 2020, and a six-month deferment of any current SBA 7(a) loan, 504 loan, or Microloan. 21. To obtain an EIDL and/or EIDL Advance, a qualifying business was required to submit an application to the SBA and provide information about its operations, such as the number of employees, gross revenues for the 12-month period preceding the disaster, and cost of goods 3 Under 18 U.S.C. § 1343, anyone who violates this section and commits wire fraud in relation to “or involving any benefit authorized, transported, transmitted, transferred, disbursed, or paid in connection with, a presidentially declared major disaster or emergency” may be fined up to $1,000,000 and imprisoned up to 30 years. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 21 of 81 7 sold in the 12-month period preceding the disaster. In the case of EIDLs for COVID-19 relief, the 12-month period was that preceding January 31, 2020. 22. The SBA relied upon a self-certification contained in the application to verify that the applicant was eligible to receive the EIDL and/or EIDL Advance. The self-certification section reads: “CERTIFICATION AS TO TRUTHFUL INFORMATION: By signing this application, you [the applicant] certify that all information in your application and submitted with your application is true and correct to the best of your knowledge, and that you will submit truthful information in the future. “WARNING: Whoever wrongfully misapplies the proceeds of an SBA disaster loan shall be civilly liable to the Administrator [of the SBA] in an amount equal to one-and-one half times the original principal amount of the loan under 15 U.S.C. 636(b). In addition, any false statement or misrepresentation to the SBA may result in criminal, civil or administrative sanctions including, but not limited to: 1) fines and imprisonment, or both, under 15 U.S.C. 645, 18 U.S.C. 1001, 18 U.S.C. 1014, 18 U.S.C. 3571, and any other applicable laws; 2) treble damages and civil penalties under the False Claims Act, 31 U.S.C. 3729; 3) double damages and civil penalties under the Program Fraud Civil Remedies Act, 31 U.S.C. 3802; and 4) suspension and/or debarment from all Federal procurement and non-procurement transactions.” 23. EIDL applications were submitted directly to the SBA through the SBA COVID- 19 web portal and processed by the agency with support from a government contractor, Rapid Finance. The amount of the loan, if the application was approved, was determined based, in part, on the information provided by the application about employment, revenue, and cost of goods, as described above. Any funds issued under an EIDL or Advance were issued directly by the SBA. EIDL funds could be used for payroll expenses, sick leave, production costs, and business obligations, such as debts, rent, and mortgage payments. If the applicant also obtained a loan under the Paycheck Protection Program, the EIDL funds could not be used for the same purpose as the Paycheck Protection Program funds. PROBABLE CAUSE 24. On or about October 27, 2022, the USDA-OIG received an anonymous complaint Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 22 of 81 8 alleging that Wendy Villatoro (VILLATORO), a USDA employee, committed fraud involving the SBA PPP and EIDL loan programs. Specifically, the complaint alleged that: (1) VILLATORO received PPP and EIDL funds for four businesses that were not in operation before the start of the pandemic; and (2) that she used the funds for purposes not permitted by the program. 25. The complaint alleged that VILLATORO used the PPP and EIDL funds to: (1) pay off a car loan and a car lease; (2) purchase a home in VILLATORO’s mother’s name in Fort Worth, Texas; (3) fund lavish trips for herself and friends; (4) purchase designer clothing and gifts; and (5) pay for plastic surgery. 26. The complaint also alleged that VILLATORO’s mother, Joyce Burch-Richardson (BURCH-RICHARDSON), assisted VILLATORO in facilitating the alleged fraud through BURCH-RICHARDSON’s employment with the SBA. Specifically, the complaint alleged that BURCH-RICHARDSON uploaded documents associated with the loans for which VILLATORO allegedly applied. 27. USDA-OIG contacted SBA-OIG to request information on whether VILLATORO had applied for and received funds under both the PPP and EIDL programs. After conducting some research of their available databases, SBA-OIG was able to confirm that VILLATORO had applied for and received PPP and EIDL loan funds with a combined total of approximately $844,415.24 related to the following four businesses: a. Chizzy Consulting and Management, INC [received $197,960 (PPP funds) and $37,200 (EIDL funds)] b. Kouture Kidz Boutique LLC [received $20,800 (PPP funds)] c. Students Beyond Borders Foundation INC [received $242,657 (PPP funds) and $133,000 (EIDL funds)] Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 23 of 81 9 d. Forward Concepts LLC [received $212,798.24 (PPP funds)] 28. A review of the District of Columbia Department of Licensing and Consumer Protection (DLCP) website revealed the business incorporation dates for the four businesses as follows: a. Chizzy Consulting and Management LLC – incorporated September 24, 2018 b. Kouture Kidz Boutique LLC – incorporated July 30, 2020 c. Students Beyond Borders LLC – incorporated August 13, 2020 d. Forward Concepts LLC – incorporated August 26, 2020 29. Based on the information reviewed on the DLCP website, the only company that met the legal PPP loan incorporation date requirement of a company operating on or before February 15, 2020, was Chizzy Consulting and Management LLC. That company was incorporated in 2018. The other three companies were not incorporated until July 30, 2020, or thereafter. Therefore, based on their incorporation dates, Kouture Kidz Boutique, Students Beyond Borders, and Forward Concepts were not legally eligible to receive PPP loan funds. 30. USDA-OIG conducted an administrative review of VILLATORO’s official USDA government email account which revealed numerous emails from the TARGET YAHOO ACCOUNT, Wendynvillatoro@yahoo.com. 31. During a further review of VILLATORO’s PPP and EIDL loan documents, the TARGET YAHOO ACCOUNT was listed as a primary contact email on several of the loan applications. As an example, VILLATORO’s PPP loan 74521384-00 listed the TARGET YAHOO ACCOUNT as VILLATORO’s contact email and 202-425-3190 as her contact phone number. T- Mobile records for this phone number identified it as being registered to VILLATORO. 32. USDA-OIG also obtained financial records for a PNC checking account ending in Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 24 of 81 10 -2471 that VILLATORO provided to USDA for her to receive her current USDA bi-weekly salary via direct deposit. A review of the accounts signature card revealed the account was opened on or about August 28, 2018, using the TARGET YAHOO ACCOUNT. VILLATORO is the sole signer on this checking account. 33. These e-mails, identified in VILLATORO’s USDA email account, included items like voided bank account checks and bank statements associated with VILLATORO’s four businesses listed in paragraph 28. Some of the following emails and documents were identified in her USDA email account: a. On June 11, 2020, at 10:37 PM, an email was received from the TARGET YAHOO ACCOUNT that had an attached document named “Forward Concepts_Wendy Villatoro Bank Statement_March 2020.pdf.” A review of that document revealed what appeared to be a copy of a March 2020 statement for VILLATORO’s Chizzy Consulting and Management NFCU business account ending in -7454. b. On January 11, 2021, at 2:14 PM, an email was received from the TARGET YAHOO ACCOUNT that had an attached document named “Voided Check Chizzy.pdf.” A review of the attachment revealed an image of a check which appeared to be from VILLATORO’s Chizzy Consulting and Management NFCU business account ending in -7454. The check number is 1001 and the date on the voided check image is April 17, 2020. A review of PPP loan records revealed this to be the same check image that was submitted to First Home Bank, in support of VILLATORO’s PPP loan 44119571-09 received for her business, Chizzy Consulting and Management LLC. c. On January 11, 2021, at 9:38 AM, an email was received from the TARGET Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 25 of 81 11 YAHOO ACCOUNT that had an attached document named “SBB Gusto PPP Report.pdf.” A review of the attachment revealed a document that read “Kouture Kidz Boutique - Payment Protection Program Report.” The document had a creation date of April 4, 2020. The federal employee identification number (FEIN) listed was 46-5585110. The listed business address is 300 L Street, Northeast, Apt #307 Washington, D.C. 20002.4 The document claimed that between January 1, 2020, and March 1, 2020, Kouture Kidz Boutique had an average monthly payroll cost of $8,333.33 and that it had 25 employees. Under the information for the monthly payroll cost information were the words, “Students Beyond Borders.” d. On January 11, 2021, at 1:53 PM, an email was sent from VILLATORO’s USDA government email address to the TARGET YAHOO ACCOUNT that had a document attached named “SBB Gusto PPP ReportFY20.pdf.” A review of the attachment revealed a document that read “Students Beyond Borders – Payment Protection Program Report.” The document listed a creation date of January 11, 2021. The federal employee identification number (FEIN) listed was 46-5585110. The listed business address is 116 T Street, Northeast, Apt #456, Washington, D.C. 20002. The document claimed that between January 1, 2020, and December 31, 2020, Students Beyond Borders had an average monthly payroll cost of $67,031.73 and that it had 25 employees. e. On January 11, 2021, at 9:54 PM, an email was received from the TARGET 4 Rental records obtained for the address 116 T St. NE #456, Washington, D.C. confirmed that VILLATORO was the tenant from approximately May 2014 until approximately May 2022. The records included a rental verification form from April 2014 that lists the address 300 L St. NE #307 Washington, D.C. 20002 as VILLATORO’S prior address before moving to the 116 T St. #456 address on or about May 2014. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 26 of 81 12 YAHOO ACCOUNT that had a document attached named “Chase Bank Statement.pdf.” A review of the attachment revealed a copy of an October 2020 bank statement from what appeared to be VILLATORO’s Students Beyond Borders Foundation INC Chase account ending in -0254. f. On January 11, 2021, at 2:34 PM, an email was received from the TARGET YAHOO ACCOUNT that had three documents attached: “BillImage-4.pdf,” “PDF_CurrentBill-4.pdf,” and “Xfinity Bill.pdf.” A review of the three attached documents revealed the following for each: i. BillImage-4.pdf is a copy of a December 2020 Pepco electric bill listing VILLATORO’s name and the address 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. The bill issue date is December 15, 2020, for account 55017723267 and the invoice number is 200661378266. ii. PDF_CurrentBill-4.pdf is a copy of a Washington Gas residential heating bill listing VILLATORO’s name and the address 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. The bill date is December 11, 2020, for account 120000817789. The billing period is November 10, 2020, to December 9, 2020. iii. Xfinity Bill.pdf is a copy of a Xfinity cable/internet bill listing VILLATORO’s name and the address 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. The billing date is December 12, 2020, for account 8299700050626405. The billing period is December 23, 2020, to January 22, 2021. g. On January 11, 2021, at 2:52 PM, an email was sent from VILLATORO’s USDA Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 27 of 81 13 government email account to the TARGET YAHOO ACCOUNT that had three documents attached: “SBB PEPCO BILL.pdf,” “SBB Wash Gas.pdf,” and “SBB Xfinity Bill.pdf.” A review of the three attached documents revealed the following for each: i. SBB PEPCO BILL.pdf is a copy of a December 2020 Pepco electric bill listing the business name “Students Beyond Borders,” VILLATORO’s name, and the address 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. The bill issue date is December 15, 2020, for account 55017723267 and the invoice number is 200661378266. ii. SBB Wash Gas.pdf is a copy of a Washington Gas residential heating bill listing the business name “Students Beyond Borders,” VILLATORO’s name, and the address 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. The bill date is December 11, 2020, for account 120000817789. The billing period is November 10, 2020, to December 9, 2020. iii. SBB Xfinity Bill.pdf is a copy of an Xfinity cable/internet bill listing the business name “Students Beyond Borders,” VILLATORO’s name and the address 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. The billing date is December 12, 2020, for account 8299700050626405. The billing period is December 23, 2020, to January 22, 2021. h. A review of PPP loan records revealed the SBB PEPCO Bill.pdf, SBB Xfinity Bill.pdf, and the SBB Wash Gas.pdf attachments appear to be the same documents that were submitted to Prestamos CDFI, in support of VILLATORO’s PPP loan Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 28 of 81 14 74521384-00 received for her business, Students Beyond Borders Foundation. i. They all appear to be the same three personal utility bill documents VILLATORO’s USDA government account received previously from the TARGET YAHOO ACCOUNT but had been manipulated to appear to be bills associated with the business Students Beyond Borders. A comparison of “BillImage-4.pdf” (the original PEPCO bill) and “SBB PEPCO Bill.pdf” is illustrative. Although most of the information on the two documents is identical, the total amount due on “BillImage-4.pdf” (see Figure 1) is $187.81 while the total amount due on “SBB PEPCO Bill.pdf” is $587.81 (see Figure 2). On both documents, the same line runs underneath the total amount due: “After Jan 5, 2021, a Late Payment Charge of $2.15 will be added, increasing the amount due to $189.96.” This language is the same in both documents. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 29 of 81 15 Figure 1: Partial copy from the BillImage-4.pdf document Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 30 of 81 16 Figure 2: Partial copy from the SBB PEPCO Bill.pdf document 34. Based on the review of SBA-OIG records, the administrative review of VILLATORO’s USDA government email account, and the information reviewed on the DLCP website, USDA-OIG and SBA-OIG initiated a joint investigation of VILLATORO. 35. At all times relevant to this investigation, VILLATORO resided and worked in the District of Columbia. Wendy Villatoro and Submission of her PPP Loan Applications 36. SBA-OIG provided records that revealed VILLATORO submitted eight (8) loan applications associated with the four businesses she owned. All four businesses had the same business address of 116 T Street, Northeast, Apt #456, Washington, D.C. 20002. 37. Rental records obtained for the address, 116 T Street, Northeast, Apt #456, Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 31 of 81 17 Washington, D.C. 20002, showed that this was VILLATORO’s residence from 2014 until approximately April 2022. The records described the residence as a two-bedroom apartment. 38. Loan files were obtained from First Home Bank, Celtic Bank Corporation, and Prestamos CDFI related to the PPP loans obtained by VILLATORO, the sole applicant. Your affiant reviewed these loan files and noted the following: First Home Bank 39. With regards to First Home Bank: a. April 4, 2020 PPP Loan Application 44119571-09 i. On or around May 2, 2020, an application was submitted for a loan through the SBA’s Paycheck Protection Program; ii. Loan records indicate that the First Home Bank user account used to apply for the PPP loan associated with VILLATORO was created on April 4, 2020, at 12:47 AM (EST) and the final login was on May 2, 2020 at 5:36 PM (EST); iii. The application listed the Business Legal Name as Chizzy Consulting and Management LLC, and provided an address of 116 T Street, Northeast, Apt #456 Washington, D.C. 20002;5 iv. The application provided a business telephone number of (202) 425-3190 and the TARGET YAHOO ACCOUNT. Government records show that the email address and telephone number are associated with VILLATORO. Specifically, VILLATORO provided this email address 5 Rental records obtained for this address revealed that this was VILLATORO’s address prior to moving to 600 4th St SW, Washington D.C. in the summer of 2022. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 32 of 81 18 and telephone number on her official USDA resume submissions, on her Declaration of Federal Employment, dated May 1, 2020, and on her SF- 1187 form “Request for Payroll Deductions for Labor Organization Dues,” dated May 29, 2020. Further, telephone subscriber records indicate that this phone number is associated with VILLATORO; v. The application claimed to be for an eligible self-employed individual with a monthly payroll of $22,343 and sought a forgivable loan of $55,800 to cover payroll expenses; vi. The application contained bank statements from VILLATORO’s business checking account with BB&T Bank (which is now known as Truist Bank) ending in -2629; vii. The application contained what appeared to be a 2019 Form 1040 Schedule C reporting $960,811 in gross income, $860,811 in expenses, and $100,000 in profits from a business called Chizzy Consulting and Management LLC. The Schedule C form indicated that VILLATORO was the sole proprietor and that the business provided professional services and listed her business address as 116 T Street, Northeast, Apt #456 Washington, D.C. 20002; viii. VILLATORO’s application was approved, and she secured the $55,800 loan from First Home Bank, a FDIC-insured financial institution. The loan amount was electronically deposited into VILLATORO’s NFCU checking account ending in -7454 on May 4, 2020; ix. The application was filed from the Internet Protocol Address (“IP Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 33 of 81 19 Address”) 73.134.157.137. x. Comcast subscriber records for the IP Address 73.134.157.137 were not able to be obtained as they were outside of Comcast’s record retention timeframe. A review of IP network records obtained for VILLATORO’s PNC account ending in -2471 revealed that VILLATORO frequently logged into her account between January 3, 2020, and November 9, 2020, using this IP address. The PNC records also showed VILLATORO later frequently logging into this account using the Comcast IP address 98.204.53.242 which is described later in this affidavit as being registered to VILLATORO and 600 4th Street, Southwest, Apartment 440, Washington, D.C. b. July 17, 2020 PPP Loan Application 59223481-06 i. VILLATORO applied for a second PPP loan on July 17, 2020, at 12:00 AM. ii. The application listed the Business Legal Name as Kouture Kidz Boutique LLC and provided an address of 116 T Street, Northeast, Apt #456 Washington, D.C. 20002;6 iii. The application provided a business telephone number of (202) 425-3190 and the email address info@kouturekidzboutique.com, which business and government records indicate is an email address and telephone number associated with VILLATORO. Specifically, open-source records 6 Rental records obtained for this address revealed that this was the VILLATORO’s address prior to moving to 600 4th St SW, Washington D.C. in the summer of 2022. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 34 of 81 20 identified this email address to be served by the domain provider, NameCheap. Business records obtained revealed this email address was subscribed to VILLATORO, who provided her primary email address as the TARGET YAHOO ACCOUNT and her address as 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. iv. Government records show VILLATORO provided the TARGET YAHOO ACCOUNT and the phone number (202) 425-3190 on her official USDA resume submissions, on her Declaration of Federal Employment dated May 1, 2020, and on her SF-1187 form “Request for Payroll Deductions for Labor Organization Dues,” dated May 29, 2020. Further, telephone subscriber records indicate that this phone number is associated with VILLATORO; v. The application claimed to be for an eligible self-employed individual with a monthly payroll of $22,343 and sought a forgivable loan of $20,800 to cover payroll expenses, utilities, debt interest, group health, and rent; vi. The application contained bank statements from VILLATORO’s business checking account with JPMorgan Chase Bank ending in -1895; vii. The application contained what appeared to be a 2019 Form 1040 Schedule C reporting $960,811 in gross income, $860,811 in expenses, and $960,811 in profits from a business called Kouture Kidz Boutique LLC. The Schedule C form indicated that VILLATORO was the sole proprietor, and that the business was a children’s and infants’ clothing store. The form listed her business address as 116 T Street, Northeast, Apt Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 35 of 81 21 #456 Washington, D.C. 20002; viii. VILLATORO’s application was approved, and she secured the $20,800 loan from First Home Bank, an FDIC-insured financial institution. The loan amount was electronically deposited into VILLATORO’s JPMorgan Chase checking account ending in -1895 on August 24, 2020; ix. The application was filed from the Internet Protocol Address (“IP Address”) 68.33.74.64; open-source research shows the geo-location of that IP address as Laurel, MD. c. February 18, 2021 PPP Loan Application 57627483-04 i. VILLATORO applied for a third PPP loan on February 18, 2021, at 7:03 PM (EDT); ii. Loan records indicate that the First Home Bank user account used to apply for the PPP loan associated with VILLATORO was created on February 18, 2021, and the final login was not listed; iii. The application listed the business legal name as Chizzy Consulting and Management LLC and provided an address of 116 T Street, Northeast, Apt #456 Washington, D.C. 20002;7 iv. The application provided a business telephone number of (202) 888-0680 (which is connected to the phone number (202) 425-3190, one of the primary methods of contact for VILLATORO) and the TARGET YAHOO ACCOUNT. Telephone subscriber records from the phone 7 Rental records obtained for this address revealed that this was VILLATORO’s address prior to moving to 600 4th St SW, Washington D.C. in the summer of 2022. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 36 of 81 22 service provider Phone.com indicate that (202) 888-0680 is also associated with VILLATORO; v. The application claimed to be for an eligible self-employed individual with a monthly payroll of $56,864 and sought a forgivable loan of $142,160 to cover payroll expenses, business rent/mortgage interest, business utilities, covered operations expenditures, and covered worker protection expenditures; vi. The application did not contain a 2019 or 2020 Form 1040 Schedule C. The application also listed the gross receipts for 2020 and 2019 as $0.00; vii. VILLATORO’s application was approved, and she secured the $142,160 loan from First Home Bank, an FDIC-insured financial institution. The loan amount was electronically deposited into VILLATORO’s NFCU checking account ending in -7454 on February 19, 2021. d. May 7, 2021 PPP Loan Application 68941989-00 i. VILLATORO applied for a fourth PPP loan on May 7, 2021, at 11:17:56 AM (EDT). ii. The application listed the business legal name as Forward Concepts LLC and provided an address of 16704 Fairfax Dr. King George, VA 22485; iii. The application provided a business telephone number of (202) 425-3190 and the email address info@forwardconceptsINC.com, which business and government records indicate is an email address and telephone number associated with VILLATORO. Specifically, open-source records identified this email address to be served by the domain provider, Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 37 of 81 23 NameCheap. Business records obtained revealed this email address was subscribed to VILLATORO, who provided her primary email address as the TARGET YAHOO ACCOUNT and her address as 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. iv. The application provided the employee identification number (EIN) XXX-X2-1219, which revealed no record, when checked in law enforcement and open-source databases, as being associated with an actual person or business; v. The application claimed to be for an eligible self-employed individual with a monthly payroll of $56,865 and sought a forgivable loan of $142,162 to cover payroll expenses, business rent/mortgage interest, and business utilities; vi. The application contained what appeared to be a 2020 Form 1040 Schedule C reporting $849,000 in gross income, $810,250 in expenses, and $849,000 in profits from a business called Forward Concepts LLC. The Schedule C form indicated that VILLATORO was the sole proprietor and that the business provided technology consulting and listed the business address as 116 T Street, Northeast, Apt #456, Washington, D.C. 20002; vii. Apart from the application listing the business address as being in King George, VA and the 2020 Form 1040 listing the business address as 116 T Street, Northeast, Apt# 456, Washington, D.C. 20002, the application and the 2020 Form 1040 listed different employee identification numbers Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 38 of 81 24 for VILLATORO’s Forward Concepts LLC business. viii. VILLATORO’s application was approved, and she secured the $142,162 loan from First Home Bank, an FDIC-insured financial institution. The loan amount was electronically deposited into VILLATORO’s JP Morgan Chase checking account ending in -2021 on May 7, 2021. ix. The application was filed from the Internet Protocol Address (“IP Address”) 172.58.220.193; open-source research shows the geo-location of that IP address as Boston, Massachusetts with an internet service provider of T-Mobile.8 e. All four First Home Bank applications provided the social security number XXX- XX-0869, which is the social security number assigned to VILLATORO. f. All four First Home Bank applications contained a front photograph of VILLATORO’s Washington, D.C. driver’s license. g. All four applications certified that each business was in operation on February 15, 2020, and had employees for whom it paid salaries and payroll taxes or paid independent contractors, as reported on Form(s) 1099-MISC. It also certified that all SBA loan proceeds would be “used only for business-related purposes as specified in the loan application.” Celtic Bank Corporation 40. With regards to Celtic Bank Corporation: a. May 26, 2020 PPP Loan Application 75242379-00 8 Phone records for VILLATORO’s phone number 202-425-3190 were obtained and confirmed to be serviced by wireless provider T-Mobile. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 39 of 81 25 i. On or around May 26, 2020, an application was submitted for a loan through the SBA’s Paycheck Protection Program; ii. Loan records indicate that the Celtic Bank user account used to apply for the PPP loan associated with VILLATORO was created on May 25, 2020, at 2:25 AM (UTC) and the final login was on June 5, 2021, at 4:29 AM (UTC); iii. The application listed the Business Legal Name as Forward Concepts and provided an address of the 16704 Fairfax Drive, King George, Virginia 22485. iv. The application provided a business telephone number of (202) 425-3190 and the email address info@chizzyconsulting.com, which business and government records indicate is an email address and telephone number associated with VILLATORO. Specifically, open-source records identified this email address to be served by the domain provider, NameCheap. Business records obtained revealed this email address was subscribed to VILLATORO, who provided her primary email address as the TARGET YAHOO ACCOUNT and her address as 116 T Street, Northeast, Apt #456 Washington, D.C. 20002. v. Government records show VILLATORO provided the email address of the TARGET YAHOO ACCOUNT and the phone number (202) 425-3190 on her official USDA resume submissions, on her Declaration of Federal Employment dated May 1, 2020, and on her SF-1187 form “Request for Payroll Deductions for Labor Organization Dues,” dated May 29, 2020. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 40 of 81 26 Further, telephone subscriber records indicate that this phone number is associated with VILLATORO; vi. The application provided the social security number XXX-XX-0869, which is the social security number assigned to VILLATORO; vii. The application claimed to be for an eligible self-employed individual with a monthly payroll of $28,254.49 and sought a forgivable loan of $70,636.24 to cover payroll expenses; viii. The application certified that the business was in operation on February 15, 2020, and had employees for whom it paid salaries and payroll taxes or paid independent contractors, as reported on Form(s) 1099-MISC. It also certified that all SBA loan proceeds would be “used only for business- related purposes as specified in the loan application;” ix. The application contained bank statements from VILLATORO’s Chizzy Consulting and Management LLC’s NFCU checking account ending in - 7454; x. The application contained a front photograph of VILLATORO’s Washington, D.C. driver’s license; xi. The application did not contain a 2019 Form 1040 Schedule C, which would have reported gross income, expenses, and profits from the business called Forward Concepts. The application showed zero gross income, expenses, and profits reported. The application further indicated that VILLATORO was the sole proprietor; xii. VILLATORO’s application was approved, and she secured the $70,636.24 Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 41 of 81 27 loan from Celtic Bank, an FDIC-insured financial institution. The loan amount was electronically deposited into VILLATORO’s Chizzy Consulting and Management account ending in -7454 located at NFCU on June 18, 2020. b. The application was filed from the Internet Protocol Address (“IP Address”) 73.134.157.137. c. Comcast subscriber records for the IP Address 73.134.157.137 were not able to be obtained as they were outside of Comcast’s record retention timeframe. A review of IP network records obtained for VILLATORO’s PNC account ending in -2471 revealed that VILLATORO frequently logged into her account between January 3, 2020, and November 9, 2020, using this IP address. The PNC records also showed VILLATORO later frequently logging into this account using the Comcast IP address 98.204.53.242 which is described later in this affidavit as being registered to VILLATORO and 600 4th Street, Southwest, Apartment 440, Washington, D.C. d. Both applications provided the social security number XXX-XX-0869, which is the social security number assigned to VILLATORO; Prestamos CDFI 41. With regards to Prestamos CDFI: a. January 11, 2021 PPP Loan Application 74521384-00 i. On or around January 11, 2021, an application was submitted for a loan through the SBA’s Paycheck Protection Program; ii. Loan records indicate that the Prestamos CDFI user account used to apply for the PPP loan associated with VILLATORO was created on January 11, Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 42 of 81 28 2021, at 6:26 AM and the final login was on January 11, 2021, at 6:37 AM; iii. The application claimed to be for an eligible self-employed individual with a monthly payroll of $67,032 and sought a forgivable loan of $121,327 to cover payroll expenses; iv. The application contained what appeared to be a 2019 Form 1040 Schedule C reporting $960,811 in gross income, $953,602 in expenses, and $960,811 in profits from a business called Students Beyond Borders. The Schedule C form indicated that VILLATORO was the sole proprietor and that the business provided educational support services and listed her business address as 116 T Street, Northeast, Apt #456 Washington, D.C. 20002; v. VILLATORO’s application was approved, and she secured the $121,327 loan from Prestamos CDFI Bank, an FDIC-insured financial institution. The loan amount was electronically deposited into VILLATORO’s JPMorgan Chase account ending in -0254 on February 23, 2021. b. April 18, 2021 PPP Loan Application 10883191-03 i. VILLATORO applied for a second PPP loan on April 18, 2021, at 9:48 AM; ii. Loan records indicate that the Prestamos CDFI user account used to apply for the PPP loan associated with VILLATORO was created on April 18, 2021, at 9:48 AM and the final login was on April 18, 2021, at 9:48 AM; iii. The application claimed to be for an eligible self-employed individual with a monthly payroll of $48,532 and sought a forgivable loan of $121,330 to cover payroll expenses; iv. The application contained what appeared to be a 2019 Form 1040 Schedule Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 43 of 81 29 C, reporting $960,811 in gross income, $953,602 in expenses, and $960,811 in profits from a business called Students Beyond Borders. The Schedule C form indicated that VILLATORO was the sole proprietor, that the business provided educational support services, and it listed her business address as 116 T Street, Northeast, Apt #456 Washington, D.C. 20002; v. VILLATORO’s application was approved, and she secured the $121,330 loan from Prestamos CDFI Bank, an FDIC-insured financial institution. The loan amount was electronically deposited into VILLATORO’s JPMorgan Chase account on July 2, 2021. c. Both Prestamos applications listed the Business Legal Name as Students Beyond Borders and provided an address of 116 T Street, Northeast, Apt #456, Washington, D.C. 20002; d. Both applications provided a business telephone number of (202) 425-3190 and the TARGET YAHOO ACCOUNT, which government records indicate is an email address and telephone number associated with VILLATORO. Specifically, VILLATORO provided this email address and telephone number on her official USDA resume submissions, on her Declaration of Federal Employment dated May 1, 2020, and on her SF-1187 form “Request for Payroll Deductions for Labor Organization Dues,” dated May 29, 2020. Further, telephone subscriber records indicate that this phone number is associated with VILLATORO; e. Both applications provided the social security number XXX-XX-0869, which is the social security number assigned to VILLATORO; f. Both applications certified that the business was in operation on February 15, 2020, Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 44 of 81 30 and “had employees for whom it paid salaries and payroll taxes or paid independent contractors, as reported on Form(s) 1099-MISC.” It also certified that all SBA loan proceeds would be “used only for business-related purposes as specified in the loan application;” g. Both applications contained bank statements from VILLATORO’s checking account with JPMorgan Chase Bank ending in -0254;9 h. Both applications contained a front photograph of VILLATORO’s Washington, D.C. driver’s license; i. Both applications were filed from the Internet Protocol Address (“IP Address”) 73.134.156.183; open-source research shows the geo-location of that IP address as Washington, D.C. i. Comcast subscriber records for the IP Address 73.134.156.183 were not able to be obtained as they were outside of Comcast’s record retention timeframe. A review of IP network records obtained for VILLATORO’s PNC account ending in -2471 revealed that VILLATORO frequently logged into her account between November 16, 2020, and March 13, 2022, using this IP address. The PNC records also showed VILLATORO later frequently logging into this account using the Comcast IP address 98.204.53.242 which is described later in this affidavit as being registered to VILLATORO and 600 4th Street, Southwest, Apartment 440, 9 Records obtained for Villatoro’s Students Beyond Borders business account, when compared to the statements submitted to Prestamos CDFI, revealed the documents submitted in support of the PPP loan appear to have been altered to claim that they were bank account statements from February 2020 when the records obtained show the particular statement is actually a September 2020 statement. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 45 of 81 31 Washington, D.C. 42. In all, according to the SBA records, VILLATORO received money for seven (7) of the eight (8) PPP loans from First Home Bank, Celtic Bank Corporation, and Prestamos CDFI, for which she applied, totaling $674,215.24. One loan that she applied for was denied. Fraud in the SBA EIDL Program 43. The SBA-OIG also provided SBA EIDL loan records which revealed VILLATORO submitted fifteen (15) loan applications associated with six (6) businesses owned by VILLATORO; all have the same business address of 116 T Street, Northeast, Apt #456, Washington, D.C. 20002. The six businesses consisted of the four previously mentioned businesses plus two additional businesses: Late Nights N Early Mornings INC and Paratus.10 44. According to the SBA EIDL loan records, two (2) of the fifteen (15) loans that VILLATORO applied for were disbursed while the other applications were denied. 45. The following two EIDL loans were disbursed: a. March 31, 2020 SBA EIDL Loan 3300912465 i. On or around March 31, 2020, an application was submitted for a loan through the SBA’s Economic Injury Disaster Loan (EIDL) Program; ii. Loan records indicated that the application used to apply for the EIDL loan associated with VILLATORO was created on March 31, 2020, at 8:11 PM; iii. The application listed the Business Legal Name as Chizzy Consulting and Management and provided an address of 116 T Street, Northeast, Apt #456 10 VILLATORO submitted applications for Late Nights N Early Mornings INC and Paratus but the applications were denied. She did not receive any loans for these two businesses. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 46 of 81 32 Washington, D.C. 20002;11 iv. The application claimed to be for an eligible self-employed individual with a self-disclosed monthly revenue of $133,791.25 and sought an EIDL loan of $22,200; v. The application certified that the business had gross revenues of $279,800 and spent $233,584 on the cost of goods prior to the date of the disaster (January 31, 2020); vi. The application contained what appeared to be a 2019 Form 1040 Schedule C, reporting $1,112,009 in gross income, $1,106,468 in expenses, and $1,112,009 in profits from a business called Chizzy Consulting and Management. The Schedule C form indicated that VILLATORO was the sole proprietor and that the business provided educational support services; it listed her business address as 116 T Street, Northeast, Apt #456, Washington, D.C. 20002; vii. VILLATORO’s application was approved, and she secured the $22,200 loan from SBA. The loan amount was electronically deposited into VILLATORO’s Chizzy Consulting and Management NFCU business checking account ending in -7454 on August 5, 2020; viii. The application was filed from the Internet Protocol Address (“IP Address”) 2601:14d:8301:8d50:c888:2a9d:cd34:b7d3; open-source research shows the geo-location of that IP address as Washington, D.C.; 11 Rental records were obtained for this address which revealed that this was VILLATORO’s address prior to moving to the 600 4th St SW, Washington D.C. address in the summer of 2022. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 47 of 81 33 ix. During a review of VILLATORO’s Chizzy Consulting and Management NFCU business checking account ending in -7454 and her Students Beyond Borders Foundation JPMorgan Chase business checking account ending in -0254, numerous payments were made to the company, Afterpay;12 x. Afterpay records were obtained which revealed an Afterpay Consumer account registered to VILLATORO with a registered address of 600 4th Street, Southwest, Apartment 440, Washington, D.C. The records also included IP login history which showed IP address 2601:14d:8301:8d50:c888:2a9d:cd34:b7d3 was used to access VILLATORO’s Afterpay account on April 1, 2020 at 8:41:01 UTC; xi. The IP login records also list a “device ID” for digital devices used to access the account. The “device ID” used at the time IP address 2601:14d:8301:8d50:c888:2a9d:cd34:b7d3 accessed VILLATORO’s Afterpay account was 7f36ca0cbfb941709b2dbe9c45b682a0. The digital device represented by this “device ID” was the most frequently used digital device used to access this Afterpay account. xii. The IP login records also revealed that this same “device ID” was used to access VILLATORO’s Afterpay account, on June 6, 2020, using IP address 73.134.157.137. This is the same IP address, referenced previously, VILLATORO used to submit PPP loan applications 75242379-00 and 68941989-00. 12 Afterpay is a digital payment platform offered to online shoppers that allows them to delay payments on purchases. The customers can make weekly payments on items purchased until the items are paid in full. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 48 of 81 34 xiii. VILLATORO also included a request for an EIDL loan advance payment of $15,000 in the application. The advance payments were deposited into VILLATORO’s Chizzy Consulting and Management NFCU business account as follows: 1. $1,000 on June 16, 2020 2. $5,000 on May 24, 2021 3. $9,000 on May 25, 2021 b. August 24, 2020 SBA EIDL Loan 3313940329 i. On or around August 24, 2020, an application was submitted for a loan through the SBA’s Economic Injury Disaster Loan (EIDL) Program; ii. Loan records indicated that the application used to apply for the EIDL loan associated with VILLATORO was created on August 24, 2020, at 4:02 PM; iii. The application listed the Business Legal Name as Students Beyond Borders Foundation and provided an address of 116 T Street, Northeast, Apt #456, Washington, D.C. 20002;13 iv. The application claimed to be for an eligible self-employed individual with a self-disclosed monthly revenue of $39,983.33 and sought an EIDL loan of $133,000. v. The application certified that the business had gross revenues of $479,800 and spent $213,984 on the cost of goods prior to the date of the disaster (January 31, 2020); 13 Rental records were obtained for this address which revealed that this was VILLATORO’s address prior to moving to the 600 4th St SW Washington, D.C. address in the summer of 2022. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 49 of 81 35 vi. The SBA records for this loan included information VILLATORO submitted purporting to reflect a 2019 Form 1040 tax return documenting $79,288 in total income and $77,288 in adjusted gross income. The information VILLATORO submitted did not show any business expenses or any profits associated with a business called Students Beyond Borders Foundation. vii. VILLATORO’s application was approved, and she secured the $133,000 loan from SBA. $132,900 of the loan amount was electronically deposited into VILLATORO’s Students Beyond Borders JPMorgan Chase business checking account ending in -0254 on September 1, 2020. The remaining $100 was deposited into a Wells Fargo account ending in -3912. The ownership of the Wells Fargo account has not yet been determined; viii. The application was filed from the Internet Protocol Address (“IP Address”) 68.33.74.64; open-source research shows the geo-location of that IP address as Laurel, MD. b. Both applications provided a business telephone number of (202) 425-3190 and the email address Wendynvillatoro@yahoo.com, which government records indicate is an email address and telephone number associated with VILLATORO. Specifically, VILLATORO provided this email address and telephone number on her official USDA resume submissions, on her Declaration of Federal Employment dated May 1, 2020, and on her SF-1187 form “Request for Payroll Deductions for Labor Organization Dues,” dated May 29, 2020. Further, telephone subscriber records indicate that this phone number is associated with VILLATORO. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 50 of 81 36 c. Both applications provided the social security number XXX-XX-0869, which is the social security number assigned to VILLATORO. d. Both applications contained a front photograph of VILLATORO’s Washington, D.C. driver’s license. e. Both applications indicated that VILLATORO was the sole proprietor and that the business provided educational services and listed the business address as 116 T Street, Northeast, Apt #456, Washington, D.C. 20002; 46. In all, VILLATORO received money for two EIDL loans for which she applied, totaling $170,200. Use of SBA PPP and EIDL Funds 47. Based on the review of PPP and EIDL records to date as well as records for VILLATORO’s bank accounts that received the PPP and EIDL funds, VILLATORO received $674,215.24 in PPP funds and $170, 200 in EIDL funds for a total of approximately $844,415.24 in combined PPP and EIDL funds. Combined PPP and EIDL Funds VILLATORO Received Application Date Loan # Lender Receiving Company Amount Received March 31, 2020 3300912465 EIDL Loan SBA Chizzy Consulting $22,200 + $15,000 Advance April 4, 2020 44119571-09 PPP Loan First Home Bank Chizzy Consulting $55,800 on May 4, 2020 May 26, 2020 75242379-00 PPP loan Celtic Bank Corp Forward Concepts $70,636.24 on June 18, 2020 July 17, 2020 59223481-06 PPP Loan First Home Bank Kouture Kidz Boutique $20,800 on August 24, 2020 August 24, 2020 3313940329 EIDL loan SBA Students Beyond Borders $133,000 January 11, 2021 74521384-00 PPP Loan Prestamos CDFI Students Beyond Borders $121,327 on February 23, 2021 February 18, 2021 57627483-04 PPP Loan First Home Bank Chizzy Consulting $142,160 on February 19, 2021 Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 51 of 81 37 April 18, 2021 10883191-03 PPP Loan Prestamos CDFI Students Beyond Borders $121,330 on July 2, 2021 May 7, 2021 68941989-00 PPP Loan First Home Bank Forward Concepts $142,162 on May 7, 2021 Total: $844,415.24 48. Based on records received from JPMorgan Chase Bank (CHASE) and Navy Federal Credit Union (NFCU), VILLATORO received funds in three JPMorgan Chase accounts and one NFCU account, in which she was listed as the sole owner and could draw money from. The accounts that received the funds are as follows: a. CHASE account ending in -0254 in the name of Students Beyond Borders Foundation INC b. CHASE account ending in -1895 in the name of Kouture Kidz Boutique c. CHASE account ending in -2021 in the name of Forward Concepts d. NFCU account ending in -7454 in the name of Chizzy Consulting and Management 49. SBA Form 2483 explicitly states that by signing the form, the applicant represents that “the funds will be used to retain workers and maintain payroll or make mortgage interest payments, lease payments, and utility payments, as specified under the Paycheck Protection Rule: I understand that if the funds are knowingly used for unauthorized purposes, the federal government may hold me liable, such as for charges of fraud.” 50. The USDA-OIG has reviewed financial records to identify accounts associated with VILLATORO. This review has included records for NFCU bank accounts, JPMorgan Chase bank accounts, related credit card statements, records related to a home mortgage, and other records. The USDA-OIG has not identified any activity in those accounts consistent with VILLATORO’s running of a professional service business, educational services business, or consulting business. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 52 of 81 38 For example, the total deposits into VILLATORO’s Chizzy Consulting and Management account with NFCU from February 2020 to May 2023 totaled $328,637.98, and more than $307,000 of that amount was comprised of PPP and EIDL loan deposits. 51. Additionally, the total deposits into VILLATORO’s Students Beyond Borders Foundation account with JPMorgan Chase, from August 2020 to May 2023 totaled $384,027.75, with more than $375,557 of that amount comprised of PPP and EIDL loan deposits. The financial records do not show regular income from business or regular payroll transactions. Agents have been unable to find any other indication—such as a website, advertisement, or online review— that VILLATORO runs any of the businesses from her home. 52. Your affiant is aware of a number of instances where VILLATORO used PPP and EIDL funds that did not meet the certified use of fund requirements specified under the PPP rule. Specifically, VILLATORO used PPP and EIDL funds to make car lease payments, to make student loan payments, to purchase a Cartier gold bracelet, and to facilitate a purchase of a residence. Evidence of PPP & EIDL Funds Used to Pay Off 2016 BMW X5 SUV 53. USDA-OIG obtained District of Columbia Department of Motor Vehicle records associated with a 2016 White BMW X5 SUV (D.C. registration GH-2861). A review of the records revealed that on or about November 14, 2019, VILLATORO purchased the vehicle from BMW of Charlottesville, located in Charlottesville, VA. 54. The records identified the vehicle identification number (VIN) as 5UXKR0C56G0S92798 and the vehicle is currently registered to VILLATORO at her current address residence, 600 4th St SW, Apt #440, in Washington, D.C. 55. The records also identified that VILLATORO borrowed $36,878 in order to purchase the car and was required to pay $667.90 per month for 75 months. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 53 of 81 39 56. During the course of the investigation, records from a Capitol One Bank account ending in -5430 and a Capitol One Car loan account ending in -581001, accounts controlled by VILLATORO, were obtained and reviewed. 57. A review of the Capital One Car loan account records revealed that VILLATORO paid a total of $39,478.63, which includes the financed amount plus $2,600.63 in interest payments to pay off the vehicle. 58. A majority of the payments, totaling approximately $37,441.54, were made between June 2020 and September 2020. 59. A review of VILLATORO’s bank account records revealed that of the total $39,478.63 used to pay off the BMW SUV, at least $34,941.54 was paid using proceeds from the PPP and EIDL loan funds received by VILLATORO’s business accounts. 60. The records show the payments were made from the following accounts, all of which are solely controlled by Villatoro: a. Capitol One Bank checking account ending in -5430 b. Student Beyond Borders Foundation INC - Chase checking account ending in - 02354 c. Bank of America checking account ending in -1284 d. Truist Bank checking account ending in -2629 e. PNC bank checking account ending in -2471 61. The following chart depicts the PPP and EIDL loan funds deposited and transferred from VILLATORO’s Navy Federal Credit Union (NFCU) Chizzy Consulting and Management LLC business account ending in -7454 to VILLATORO’s personal Capitol One account ending in -5430: Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 54 of 81 40 VILLATORO’s Capitol One Account Ending in 543014 Date Sending Account Receiving Account Amount April 9, 2020 NFCU x7454 N/A Account balance $100 May 4, 2020 First Home Bank -PPP Loan NFCU x7454 $55,800 June 18, 2020 Celtic Bank - PPP loan NFCU x7454 $70,636.24 June 18, 2020 NFCU x7454 Capital One x5430 $7,000 June 19, 2020 NFCU x7454 Capital One x5430 $5,000 June 22, 2020 NFCU x7454 Capital One x5430 $7,000 June 26, 2020 NFCU x7454 Capital One x5430 $7,000 July 3, 2020 NFCU x7454 Capital One x5430 $7,000 July 7, 2020 NFCU x7454 Capital One x5430 $7,000 August 5, 2020 SBA EIDL Loan 3300912465 NFCU x7454 $22,200 August 5, 2020 NFCU x7454 Capital One x5430 $7,000 August 6, 2020 NFCU x7454 Capital One x5430 $7,000 62. The following chart depicts the Capital One Car Loan payments made: Capital One Car Loan payments Payment Date Payment Account Payment Amount January 15, 2020 Capital One x5430 $667.90 January 29, 2020 Capital One x5430 $701.29 March 11, 2020 Bank of America x1284 $667.90 14 This table does not contain all of VILLATORO’s transactions, but rather only those that are relevant to this investigation. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 55 of 81 41 June 13, 2020 PNC x2471 $1,000 June 19, 2020 Capital One x5430 $5,000 June 23, 2020 Capital One x5430 $667.90 July 14, 2020 Capital One x5430 $10,000 July 16, 2020 Truist Bank x2629 $1,500 August 6, 2020 Capital One x5430 $7,000 August 13, 2020 Payment mailed in $397.69 September 2, 2020 Chase account x0254 $11,909.34 63. During the review of VILLATORO’s Capital One account ending in -5430, the records revealed that the bank account balance on June 18, 2020, prior to a $7,000 transfer deposit of PPP funds, was $624.15. 64. On May 4, 2020, VILLATORO received $55,800 in PPP Funds and an additional $70,636.24 on June 18, 2020. These funds were placed in VILLATORO’s NFCU account. 65. On June 18, 2020, VILLATORO transferred $7,000 from her NFCU account to her Capital One account ending in -5430. On June 19 and 22, VILLATORO transferred $5,000 and $7,000, respectively. Over that four-day period, VILLATORO transferred $19,000. 66. Over roughly the same period, VILLATORO made car payments of $5,000 on June 19 and $667.90 on June 23, 2020. 67. On July 3 and July 7, 2020, VILLATORO transferred $7,000 twice to her Capital One account, for a total of $14,000. 68. On July 14, 2020, VILLATORO made a car payment of $10,000 drawn from her Capital One account. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 56 of 81 42 69. In addition to using money from her Capital One account to make car payments, she also used money from a Chase account ending in -0254. Records obtained for that account revealed that on or about September 2, 2020, the account received a $132,900 EIDL loan payment, for VILLATORO’s business, Students Beyond Borders Foundation INC. Prior to the EIDL loan payment this account had an account balance of $100. 70. One day later, on September 3, 2020, VILLATORO made a $11,909.34 BMW car loan payment from this Chase account, which paid the remaining balance on the Capital One car loan and ultimately satisfied the loan. 71. Based on the aforementioned facts, there is probable cause that VILLATORO used at least $34,941.54 in proceeds from the fraudulently obtained PPP and EIDL loans funds to pay off her 2016 White BMW X5 SUV with D.C. registration GH-2861. Evidence of PPP & EIDL Funds Used to Pay Off a Student Loan 72. NFCU records obtained show that on February 19, 2021, VILLATORO’s Chizzy Consulting and Management NFCU business checking account ending in -7454 received a wire deposit of $142,160 from First Home Bank. The amount of $142,160 is the same amount that was deposited into the NFCU account for PPP loan 57627483-04. 73. The records also show that prior to the $142,160 PPP Loan wire transfer that was deposited on February 19, the account balance for VILLATORO’s NFCU account ending in -7454 was $86.73. After the PPP loan wire deposit was deposited into the account, the new account balance was $142,26.73. 74. On February 22, 2021, three days after VILLATORO received $142,160 in PPP funds, she transferred $109,989.72 from her NFCU account ending in -7454 to Navient, her student loan servicer. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 57 of 81 43 75. The records show that no additional funds were deposited in VILLATORO’s NFCU account between February 19, when she received PPP funds, and February 22, when she transferred $109,989.72 to Navient to make a student loan payment. 76. JPMorgan Chase records show that on February 23, 2021, VILLATORO’s Students Beyond Borders business checking account ending in -0254 received a wire deposit of $121,327 from Prestamos CDFI. The amount of $121,327 is the same amount that was deposited into the Students Beyond Borders for PPP loan 74521384-00. 77. The JPMorgan Chase records show that prior to the $121,327 PPP loan wire deposit, the balance for VILLATORO’s JPMorgan Chase account ending in -0254 was $41,915.26. 78. On February 24, 2021, an online payment from VILLATORO’s JPMorgan Chase account ending in -0254 was sent to Navient in the amount of $105,490.47. 79. The JPMorgan Chase records showed that no additional funds were deposited in VILLATORO’s account between February 21, when she received PPP funds, and February 24, when she transferred $105,490.47 to Navient to make a student loan payment. 80. Based on the aforementioned facts, there is probable cause that VILLATORO used at least $215,480.19 in proceeds from the fraudulently obtained PPP loans to make student loan payments. Forgiveness of VILLATORO’s PPP loans 81. During the course of this investigation, SBA-OIG provided SBA records that showed that VILLATORO applied for PPP loan forgiveness. Those records also showed that all of VILLATORO’s PPP loans were forgiven by the government. 82. The records revealed that VILLATORO submitted the following PPP Loan Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 58 of 81 44 Forgiveness Application 3508S Forms (Form 3508S): a. PPP loan 754237900: Forgiveness application was submitted to Celtic Bank on March 6, 2021 and claimed that $199,992 of the loan was spent on payroll costs. Further, VILLATORO requested the loan amount of $70,636.24 to be forgiven. This application was submitted online and signed via DocuSign; however, the IP address was not shown for this application. Celtic Bank IP address logs for this application were provided which showed that on March 6, 2021, VILLATORO accessed the online loan portal using IP address 172.58.223.112; open-source research shows a geo-location for that IP address of Cambridge, Massachusetts and an internet service provider (ISP) of T-Mobile. b. PPP loan 4411957109: Forgiveness application was submitted to First Home Bank on June 24, 2021. The application claimed that $55,800 of the loan was spent on payroll costs. Further, VILLATORO requested the loan amount of $55,800 to be forgiven. This application was submitted online from IP address 172.58.189.175. Open-source records showed this IP address was serviced by T-Mobile and the geo- location was Washington, D.C. The application was signed using the online service DocuSign. c. PPP loan 5922348106: Forgiveness application was submitted to First Home Bank on June 25, 2021. The application claimed that $20,800 of the loan was spent on payroll costs. Further, VILLATORO requested the loan amount of $20,800 to be forgiven. This application was submitted online from IP address 172.58.221.161. Open-source records showed this IP address was serviced by T-Mobile and the geo- location was Boston, Massachusetts. The application was signed using the online Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 59 of 81 45 service DocuSign. d. PPP loan 5762748304: Forgiveness application was submitted to First Home Bank on October 6, 2021, and claimed that $142,160 of the loan was spent on payroll costs. Further, VILLATORO requested the loan amount of $142,160 to be forgiven. The application was submitted online and signed via DocuSign; however, the IP address was not shown for this application. e. PPP loan 6894198900: Forgiveness application was submitted to First Home Bank on December 22, 2021, and claimed that $142,162 of the loan was spent on payroll costs. Further, VILLATORO requested the loan amount of $142,162 to be forgiven. The application was submitted online and signed via DocuSign; however, the IP address was not shown for this application. 83. In general, if these forms are approved by the government, a borrower’s PPP loans will be forgiven if the borrower used the funds appropriately and in accordance with the PPP Loan Program rules. 84. The Form 3508S requires the applicant to acknowledge and make certifications to the following statements: “The Borrower has complied with all requirements in the Paycheck Protection Program Rules (Sections 7(a)(36), (7)(a)(37), and 7A of the Small Business Act, the PPP interim final rules, and guidance issued by SBA through the date of this application), including the rules related to: 1) Eligible uses of PPP loan proceeds. 2) The amount of PPP loan proceeds that must be used for payroll costs (including proprietor expenses for Borrowers that applied for loans using SBA Forms 2483-C or 2483-SD-C); 3) The calculation and documentation of the Borrowers revenue reduction (if applicable); and 4) The calculation of the Borrower’s Requested Loan Forgiveness Amount Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 60 of 81 46 The information provided in this application is true and correct in all material respects. I understand that knowingly making a false statement to obtain forgiveness of an SBA- guaranteed loan is punishable under the law, including 18 U.S.C. 1001 and 3571 by imprisonment of not more than five years and/or a fine of up to $250,000; under 15 U.S.C. 645 by imprisonment of not more than two years and/or a fine of not more than $5,000; and, if submitted to a Federally insured institution, under 18 U.S.C. 1014 by imprisonment of not more than thirty years and/or a fine of not more than $1,000,000.” 85. The Form 3508S also includes the following statement as it relates to the requirement to retain records related to applicants’ proof of compliance with the PPP Program rules: “Following submission of this forgiveness application, the Borrower must retain all records necessary to prove compliance with Paycheck Protection Program Rules for four years for employment records and for three years for all other records. SBA may request additional information for the purposes of evaluating the Borrower’s eligibility for the PPP loan and for loan forgiveness, and the Borrower’s failure to provide information requested by SBA may result in a determination that the Borrower was ineligible for the PPP loan or in a denial of the Borrower’s loan forgiveness application.” 86. On each of the Form 3508S applications that VILLATORO submitted, she initialed the required certification and signed the application certifying that she used the PPP funds she received for payroll costs associated with her businesses. 87. A review of the applications revealed documents submitted that appear to contain fraudulent statements in support of the submitted applications. Specifically, for Students Beyond Borders PPP Loan 74521384-00 and Forward Concepts PPP loan 68941989-00, VILLATORO submitted documents named “2020 Payroll Summary by Employee” and “Forward Concepts Payroll Register FY20.” A review of the two documents revealed they looked similar. They each included nine employee names that also included VILLATORO’s and BURCH-RICHARDSON’s names and identifying information. 88. The two documents included the names, dates of birth, addresses, and last four digits of the supposed social security numbers of supposed employees. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 61 of 81 47 89. Law enforcement database checks were conducted on all of the names listed and revealed that only VILLATORO’s and BURCH-RICHARDSON’s social security numbers were correct. The social security numbers of the other seven employees listed on both documents were fictitious. 90. A review of BURCH-RICHARDSON’s official federal government electronic official personnel file (eOPF)15 revealed that the listed employee with the initials “KH” (hereinafter “Employee KH”), who VILLATORO claimed was an employee for Forward Concepts and Students Beyond Borders Foundation, was BURCH-RICHARDSON’s daughter. 91. State of Maryland wage records were obtained for Employee KH. Those records showed that Employee KH was a full-time employee for a company in Maryland and had no reported wages from VILLATORO’s companies Forward Concepts or Students Beyond Borders Foundation. 92. Another listed employee with the initials “BB” (hereafter “Employee BB”) was identified as being an associate of VILLATORO through an open-source review of VILLATORO’s profile on the social media platform “X.”16 93. During the review of VILLATORO’s “X” page, Employee BB’s “X” page was identified and showed Employee BB wearing what appeared to be a District of Columbia Fire and EMS Department (FIREEMS) uniform. 94. USDA-OIG contacted the District of Columbia Fire and EMS Department’s Office of Internal Affairs and obtained written confirmation that Employee BB has been employed full- time with FIREEMS for several years and does not have any reported outside employment. They 15 The eOPF is an electronic file that contains a federal employee’s personnel records for the lifespan of their federal career. 16 The social media site “X” is formerly known as Twitter. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 62 of 81 48 further advised that FIREEMS employees are required to get permission to maintain outside employment and are required to report all outside employment. BURCH-RICHARDSON’s Involvement in VILLATORO’s PPP and EIDL Loan Fraud 95. Based on my training, experience and knowledge of this investigation, to include the timing and amount of banking transactions between BURCH-RICHARDSON and VILLATORO, there is probable cause to believe that BURCH-RICHARDSON and VILLATORO conspired to work together in order to obtain illicit bank funds via the Paycheck Protection Program, based on information, to include the following: 96. At all times relevant to this investigation, BURCH-RICHARDSON resided in Upper Marlboro, Maryland or in Fort Worth, Texas. BURCH-RICHARDSON is VILLATORO’s mother.17 97. SBA-OIG provided USDA-OIG with BURCH-RICHARDSON’s SBA eOPF. 98. A review of BURCH-RICHARDSON’s eOPF revealed that she began employment with the SBA Office of Disaster Assistance on June 26, 2020, as a loan specialist. 99. The eOPF also included a Designation of Beneficiary form 1152, signed by BURCH-RICHARDSON on June 16, 2020, listing VILLATORO as her daughter and as the sole beneficiary of BURCH-RICHARDSON’s benefits. On that form, BURCH-RICHARDSON stated that VILLATORO’s residential address at the time was 116 T Street, Northeast, Apt #456, Washington, D.C. 20002. 100. BURCH-RICHARDSON’s resume, used to apply for the loan specialist position, was included in the eOPF. BURCH-RICHARDSON’s resume stated that she was employed by a 17 Records reviewed include employment paperwork for VILLATORO in which she listed BURCH-RICHARDSON as her mother and emergency contact with phone numbers 202-734- 0518 and 301-952-0439. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 63 of 81 49 company called Forward Concepts, from November 2011 until March 2020. The resume stated that the company was located in King George, Virginia. As noted previously, this company was one of VILLATORO’s companies that received PPP funds. This is believed to be a false representation because VILLATORO did not incorporate Forward Concepts until August of 2020. Further, USDA-OIG conducted a search of the State of Virginia’s State Corporation Commission website for a King George, Virginia business named Forward Concepts. The search did not return any records for this business in King George, Virginia or with the business address listed. BURCH-RICHARDSON also claimed that her position with Forward Concepts was as a “loan processor”; however, in the PPP loan supporting documents VILLATORO submitted, VILLATORO provided a payroll registry listing BURCH-RICHARDSON as a “program manager.” 101. Maryland wage records were obtained, related to BURCH-RICHARDSON, which revealed wages from SBA but did not show any employee wages reported prior to that. 102. A review of SBA employee actions and notes, related to loan applications submitted by VILLATORO, was conducted. That review showed that BURCH-RICHARDSON made entries and/or uploaded documents to at least the following four of VILLATORO’s EIDL loans: a. EIDL Loan Application 3000198473 – Chizzy Consulting and Management i. On June 17, 2020, SBA Disaster Assistance Customer Service Center noted that this loan application was declined stating, “does not meet credit score requirement.” On July 28, 2020, at approximately 2:02 pm, BURCH- RICHARDSON made an updated entry stating, “Credit score 685.” b. EIDL Loan Application 3300912465 – Chizzy Consulting and Management i. After SBA issued a declination letter, on May 18, 2020, for “not meeting Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 64 of 81 50 FICO score requirement,” BURCH-RICHARDSON updated the loan record making the following note: “No Fraud alert on credit report. Credit score sufficient ‘685.’ Not a duplicate, several applications separate EIN’s.” This loan was subsequently approved and funded. c. EIDL Loan Application 33125660079 – Late Nights N Early Mornings i. After SBA issued a declination letter, on August 23, 2020, for this loan due to “suspected EIDL fraud,” BURCH-RICHARDSON uploaded Articles of Organization documents, a copy of VILLATORO’s driver’s license, an IRS letter of Business EIN, and a Yahoo Confirmation. This occurred on September 11, 2020. d. EIDL Loan Application 3313940329 – Students Beyond Borders Foundation i. After VILLATORO created the application on August 24, 2020, the SBA record logs show that BURCH-RICHARDSON approved the application on August 26, 2020. 103. The false statements BURCH-RICHARDSON made about her prior employment with VILLATORO’s company along with the four examples of altering VILLATORO’s loan records to cause at least one of them to be funded, establishes probable cause to believe that BURCH-RICHARDSON had knowledge of VILLATORO’s fraudulent activities and conspired with VILLATORO to defraud the SBA. Financial records show that VILLATORO sent BURCH- RICHARDSON $135,600 – money that can be traced back to PPP and EIDL funds – for the downpayment on a house in Texas. Evidence of PPP & EIDL Funds Used to Purchase a Texas Residence 104. Obtained JPMorgan Chase records show that on May 7, 2021, VILLATORO’s Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 65 of 81 51 Forward Concepts JPMorgan Chase business account ending in -2021 received a wire deposit of $142,162 from First Home Bank. The amount of $142,162 is the same amount that was deposited into the JPMorgan Chase account for PPP loan 68941989-00. 105. On August 17, 2021, an online wire transfer was initiated from VILLATORO’s Chase account ending in -2021 in the amount of $4,249 and was sent to Miller Title INC, funding an earnest money and option fee payment for a Fort Worth, Texas house purchased by VILLATORO’s mother, Joyce Burch-Richardson (BURCH-RICHARDSON). 106. Agents also obtained and reviewed records associated with an NFCU account ending in -4199, which is associated with BURCH-RICHARDSON. 107. On August 18, 2021, an online transfer was made from VILLATORO’s Chase account ending in -2021 to VILLATORO’s NFCU account ending in -2644 in the amount of $80,000. Records obtained for VILLATORO’s NFCU account ending in -2644 show the $80,000 wire transfer officially posted to the account on August 19, 2021. That same day, there was a cash withdrawal of $80,000 from VILLATORO’s NFCU account and a deposit into BURCH- RICHARDSON’s NFCU account ending in -4199 of $80,000. 108. On August 30, 2021, an additional wire transfer of $50,000 was made from VILLATORO’s Chase account ending in -0254 to VILLATORO’s NFCU account ending in - 2644; $50,000 was then transferred to an NFCU checking account. That same day, NFCU records for BURCH-RICHARDSON’s account ending in -4199 show a transfer “from checking” into the account of $50,000. 109. Business records were obtained from Cardinal Financial Corporation related to a Fort Worth, Texas residence, purchased by BURCH-RICHARDSON, on or about September 24, 2021. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 66 of 81 52 110. A review of the records revealed three “purchase gift letters” and a letter titled “Home Purchase Gifts for Joyce Richardson” that were signed by VILLATORO stating that she gifted BURCH-RICHARDSON a combined total of $135,600 for the purchase of the residence located at 9053 Quarry Hill Ct. Fort Worth, Texas (hereafter, “the Texas Residence”). At the top of each of the letters is the loan number 1401379026 and the property address 9053 Quarry Hill Ct. Fort Worth, TX 76179, Tarrant County. Specifically, each letter includes the following statements in part: a. “I, Wendy Villatoro hereby certify that I/We give/will give a gift of $50,000 to Joyce Richardson, my mother on 8/17/21 to be applied toward the purchase of the above identified property. Cardinal Financial Company, Limited Partnership, may confirm that the funds came from the account listed below: i. Navy Federal Credit Union PO Box 3000 Merrifield, VA 22119-3000 Account number: XXXXXX2644” b. “I, Wendy Villatoro hereby certify that I/We give/will give a gift of $80,000 to Joyce Richardson, my mother on 8/30/21 to be applied toward the purchase of the above identified property. Cardinal Financial Company, Limited Partnership, may confirm that the funds came from the account listed below: i. Navy Federal Credit Union PO Box 3000 Merrifield, VA 22119-3000 Account number: XXXXXX2644” c. “I, Wendy Villatoro hereby certify that I/We give/will give a gift of $5,600 to Joyce Richardson, my mother on 9/2/21 to be applied toward the purchase of the above identified property. Cardinal Financial Company, Limited Partnership, may confirm that the funds came from the account listed below: Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 67 of 81 53 i. Chase – Students Beyond Borders Foundation Account number: XXXXX0254” 111. VILLATORO further stated that the funds were wired from the business accounts for her businesses Forward Concepts, INC and Students Beyond Borders Foundation, INC – two businesses that VILLATORO incorporated and that accepted PPP or EIDL loans into their business accounts. VILLATORO further stated that she is the “100% owner of both Forward Concepts LLC and Students Beyond Borders Foundation, INC.” 112. As previously stated, a review of VILLATORO’s business bank accounts records showed the referenced wire transfers to BURCH-RICHARDSON. 113. The Cardinal Financial Corporation records also included a typed letter signed by BURCH-RICHARDSON stating that she was a current SBA employee and previously worked for the company, “Chizzy Consulting and Management,” from 2018 to June 2020, as a “W2 employee.” 114. The loan records included several digitally signed certificates of completion to include the following: a. Application Disclosures – signed September 2, 2021from IP address 71.178.240.240 b. Disclosure |Flood Zone Notice – signed September 3, 2021, from IP address 73.134.156.183 c. Disclosure | Appraisal Rework – Updated – signed on September 20, 2021, from IP address 73.134.156.183 d. Closing Disclosures – Updated – signed on September 21, 2021, from IP address 73.134.156.183. 115. An open-source check of the IP address 73.134.156.183 revealed a geo-location of Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 68 of 81 54 Washington, D.C., and Comcast Cable as the internet service provider. Business records were requested from Comcast, but the requested records were outside of the company’s time of retention. As noted previously, a review of IP network records obtained for VILLATORO’s PNC account ending in -2471 revealed that VILLATORO frequently logged into her account between November 16, 2020, and March 13, 2022, using this IP address. 116. An open-source check of the IP address 71.178.240.240 revealed a geo-location of Upper Marlboro, Maryland, and Verizon Fios as the internet service provider. Business records were obtained for this IP address, and they revealed that the IP address was registered to BURCH- RICHARDSON’s residence in Upper Marlboro, Maryland. 117. An open source search for the email domains for the business email addresses info@chizzyconsulting.com, info@kouturekidz.com, and info@forwardconceptsINC.com was conducted. The search revealed the domains were all associated with the Domain provider, NameCheap. 118. Business records were obtained from NameCheap, which revealed that all three email addresses belonged to NameCheap accounts registered to VILLATORO. The records also identified the TARGET YAHOO ACCOUNT as a primary email address used on the accounts. 119. The NameCheap records revealed that on January 22, 2023, VILLATORO paid to renew the account associated with her business, Students Beyond Borders Foundation INC. NameCheap records also revealed that on June 14, 2023, VILLATORO paid to renew the account associated with her company Forward Concepts LLC. 120. The NameCheap records also included IP addresses used to access the account. The following IP addresses were frequently used to access the accounts: a. 73.134.156.183 Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 69 of 81 55 b. 98.204.53.242 121. IP address 73.134.156.183 is the same IP address referenced in paragraph 115 with a geo-location of Washington, D.C. 122. An open-source search was conducted of the IP address 98.204.53.242 which revealed it had a geo-location of Washington, D.C. and the internet service provider was listed as Comcast Cable. 123. The NameCheap records revealed the most recent login, from the IP address 98.204.53.242, was May 2, 2023. 124. Business records were obtained from Comcast which revealed the IP address to be registered to VILLATORO and listed the service location as her DC residence at 600 4th St SW, Washington, D.C. 125. VILLATORO’s PPP and EIDL loan records show that VILLATORO often listed the phone number 202-425-3190 as her mobile phone number or business phone number. Open- source records revealed this number was serviced by T-Mobile. 126. T-Mobile business records were obtained for this phone number which revealed it was registered to VILLATORO and her DC residence at 600 4th St SW, Washington, D.C. 127. The NameCheap records obtained also revealed the IP address 172.4.1.241 as logging into the account on August 3, 2022. 128. A review of VILLATORO’s USDA computer network login history revealed the IP address 172.4.1.241 was used to log in several times to the USDA network. The records revealed multiple logins during the following date ranges: a. June 29, 2022, through June 30, 2022 b. August 2, 2022, through August 27, 2022 Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 70 of 81 56 c. December 21, 2022, through December 24, 2022 d. April 13, 2023, through April 15, 2023 129. An open-source search was conducted of the IP address 172.4.1.241 which revealed it had a geo-location of Fort Worth, TX and the internet service provider was listed as AT&T. 130. Business records were obtained from AT&T which revealed the IP address to be registered to BURCH-RICHARDSON and listed the service location as “the Texas Residence”. 131. USDA-OIG obtained Texas Department of Public Safety Texas driver’s license records for BURCH-RICHARDSON which showed that she has a current Texas driver’s license with a license photo date of July 10, 2023 and an expiration date of December 26, 2031. 132. The listed address on BURCH-RICHARDSON’s Texas driver’s license is the address of “the Texas Residence”. 133. During the course of this investigation, District of Columbia (D.C.), Department of Motor Vehicle (DMV) records were obtained showing that VILLATORO owned and has current DC vehicle registration for the following two vehicles: a. 2022 Grey Land Rover SUV with DC registration GV-4436 b. 2016 White BMW X5 SUV with DC registration GH-2861 134. The D.C. DMV records show both vehicles are registered to 600 4th St SW Washington DC. 135. Texas Department of Public Safety license plate reader (LPR) records were obtained for the 2016 White BMW X5 SUV with DC registration GH-2861. The LPR records revealed LPR reader responses for this vehicle in the Fort Worth, TX area between June 2022 and July 2023. The last LPR reader response showed VILLATORO’s vehicle parked outside of a Target retail store in Lake Worth, TX, on July 7, 2023. This store is approximately 15 minutes Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 71 of 81 57 from “the Texas Residence”. 136. On September 28, 2023, a USDA-OIG agent conducted surveillance of “the Texas Residence”, where they observed a White BMW X5 parked inside the garage of “the Texas Residence”. 137. USDA-OIG obtained recent USDA network login records which revealed, that VILLATORO logged in to the USDA network several times, on the following dates, using the IP address 172.4.1.241 which was referenced in paragraph 129 as an AT&T internet account registered to “the Texas Residence”: a. November 2, 2023, through November 4, 2023 b. December 3, 2023, through December 7, 2023 138. Based on the facts stated above, I have reason to believe that the email address described in Attachment A may contain or represent incriminating evidence, fruits, instrumentalities or contraband related to the Target Offenses. 139. A preservation requests was submitted to Yahoo for the target email account on March 2, 2024. BACKGROUND CONCERNING YAHOO18 140. PROVIDER is the provider of the internet-based account(s) identified by Wendynvillatoro@yahoo.com. 141. PROVIDER provides its subscribers internet-based accounts that allow them to send, receive, and store emails online. PROVIDER accounts are typically identified by a single username, which serves as the subscriber’s default email address, but which can also function as a 18 The information in this section is based on information published by Yahoo on its public websites, including, but not limited to, the following webpages: the “Yahoo Terms of Service” and “Consumer Services” pages available at legal.Yahoo.com. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 72 of 81 58 subscriber’s username for other PROVIDER services, such as instant messages and remote photo or file storage. 142. Based on my training and experience, I know that PROVIDER allows subscribers to obtain accounts by registering on PROVIDER’s website. During the registration process, PROVIDER often asks subscribers to create a username and password, and to provide basic personal information such as a name, an alternate email address for backup purposes, a phone number, and in some cases a means of payment. 143. Typically, once a subscriber has registered an account, PROVIDER provides email services that typically include folders such as an “inbox” and a “sent mail” folder, as well as electronic address books or contact lists, and all of those folders are linked to the subscriber’s username. PROVIDER subscribers can also use that same username or account in connection with other services provided by PROVIDER.19 144. In general, user-generated content (such as email) that is written using, stored on, sent from, or sent to a PROVIDER account can be permanently stored in connection with that account, unless the subscriber deletes the material. For example, if the subscriber does not delete an email, the email can remain on PROVIDER’s servers indefinitely. Even if the subscriber deletes the email, it may continue to exist on PROVIDER’s servers for a certain period of time. 145. Thus, a subscriber’s PROVIDER account can be used not only for email but also for other types of electronic communication, including, but not limited to: instant messaging, photo and video sharing, voice calls, video chats, SMS text messaging; or social networking. Depending 19 PROVIDER provides e-mail, contact list, notes, chat, and other services as noted generically above. It provides the branded services Yahoo! groups (a listserv and bulletin board service, which users can opt into), and Yahoo! Messenger (an instant messaging service, which users can opt into). Yahoo does not currently provide a standalone document storage service, but its smartphone application has designated “documents” functions that operate through Yahoo’s e-mail storage. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 73 of 81 59 on user settings, user-generated content derived from many of these services is normally stored on PROVIDER’s servers until deleted by the subscriber. Similar to emails, such user-generated content can remain on PROVIDER’s servers indefinitely if not deleted by the subscriber, and even after being deleted, it may continue to be available on PROVIDER’s servers for a certain period of time. Furthermore, a PROVIDER subscriber can often store contacts, calendar data, images, videos, notes, documents, bookmarks, web searches, browsing history, and various other types of information on PROVIDER’s servers. Based on my training and experience, I also know that evidence of who controlled, used, and/or created a PROVIDER account may be found within such computer files and other information created or stored by the PROVIDER subscriber. Based on my training and experience, I know that the types of data discussed above can include records and communications that constitute evidence of criminal activity. 146. Based on my training and experience, I know that providers such as PROVIDER also collect and maintain information about their subscribers, including information about their use of PROVIDER services. This information can include the date on which the account was created, the length of service, records of log-in (i.e., session) times and durations, the types of service utilized, the status of the account (including whether the account is inactive or closed), the methods used to connect to the account (such as logging into the account via the provider’s website), and other log files that reflect usage of the account. Providers such as PROVIDER also commonly have records of the Internet Protocol address (“IP address”) used to register the account and the IP addresses associated with other logins to the account. Because every device that connects to the Internet must use an IP address, IP address information can help to identify which devices were used to access the relevant account. Also, providers such as PROVIDER typically Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 74 of 81 60 collect and maintain location data related to subscriber’s use of PROVIDER services, including data derived from IP addresses and/or Global Positioning System (“GPS”) data. 147. Based on my training and experience, I know that providers such as PROVIDER also often collect information relating to the devices used to access a subscriber’s account – such as laptop or desktop computers, cell phones, and tablet computers. Such devices can be identified in various ways. For example, some identifiers are assigned to a device by the manufacturer and relate to the specific machine or “hardware,” some identifiers are assigned by a telephone carrier concerning a particular user account for cellular data or voice services, and some identifiers are actually assigned by PROVIDER in order to track what devices are using PROVIDER’s accounts and services. Examples of these identifiers include unique application number, hardware model, operating system version, Global Unique Identifier (“GUID”), device serial number, mobile network information, telephone number, Media Access Control (“MAC”) address, and International Mobile Equipment Identity (“IMEI”). Based on my training and experience, I know that such identifiers may constitute evidence of the crimes under investigation because they can be used (a) to find other PROVIDER accounts created or accessed by the same device and likely belonging to the same user, (b) to find other types of accounts linked to the same device and user, and (c) to determine whether a particular device recovered during course of the investigation was used to access the PROVIDER account. 148. PROVIDER also often allows its subscribers to access its various services through an application that can be installed on and accessed via cellular telephones and other mobile devices. This application is associated with the subscriber’s PROVIDER account. In my training and experience, I have learned that when the user of a mobile application installs and launches the application on a device (such as a cellular telephone), the application directs the device in question Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 75 of 81 61 to obtain a Push Token, a unique identifier that allows the provider associated with the application (such as PROVIDER) to locate the device on which the application is installed. After the applicable push notification service (e.g., Apple Push Notifications (APN) or Google Cloud Messaging) sends a Push Token to the device, the Token is then sent to the application, which in turn sends the Push Token to the application’s server/provider. Thereafter, whenever the provider needs to send notifications to the user’s device, it sends both the Push Token and the payload associated with the notification (i.e., the substance of what needs to be sent by the application to the device). To ensure this process works, Push Tokens associated with a subscriber’s account are stored on the provider’s server(s). Accordingly, the computers of PROVIDER are likely to contain useful information that may help to identify the specific device(s) used by a particular subscriber to access the subscriber’s PROVIDER account via the mobile application. 149. Based on my training and experience, I know that providers such as PROVIDER use cookies and similar technologies to track users visiting PROVIDER’s webpages and using its products and services. Basically, a “cookie” is a small file containing a string of characters that a website attempts to place onto a user’s computer. When that computer visits again, the website will recognize the cookie and thereby identify the same user who visited before. This sort of technology can be used to track users across multiple websites and online services belonging to PROVIDER. More sophisticated cookie technology can be used to identify users across devices and web browsers. From training and experience, I know that cookies and similar technology used by providers such as PROVIDER may constitute evidence of the criminal activity under investigation. By linking various accounts, devices, and online activity to the same user or users, cookies and linked information can help identify who was using a PROVIDER account and determine the scope of criminal activity. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 76 of 81 62 150. Based on my training and experience, I know that PROVIDER can maintain records that can link different PROVIDER accounts to one another, by virtue of common identifiers, such as common email addresses, common telephone numbers, common device identifiers, common computer cookies, and common names or addresses, that can show a single person, or single group of persons, used multiple PROVIDER accounts. Based on my training and experience, I also know that evidence concerning the identity of such linked accounts can be useful evidence in identifying the person or persons who have used a particular PROVIDER account. 151. Based on my training and experience, I know that subscribers can communicate directly with PROVIDER about issues relating to the account, such as technical problems, billing inquiries, or complaints from other users. Providers such as PROVIDER typically retain records about such communications, including records of contacts between the user and the provider’s support services, as well records of any actions taken by the provider or user as a result of the communications. In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account’s user or users. 152. In summary, based on my training and experience in this context, I believe that the computers of PROVIDER are likely to contain user-generated content such as stored electronic communications (including retrieved and unretrieved email for PROVIDER subscribers), as well as PROVIDER-generated information about its subscribers and their use of PROVIDER services and other online services. In my training and experience, all of that information may constitute evidence of the crimes under investigation because the information can be used to identify the account’s user or users. In fact, even if subscribers provide PROVIDER with false information Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 77 of 81 63 about their identities, that false information often nevertheless provides clues to their identities, locations, or illicit activities. 153. As explained above, information stored in connection with a PROVIDER account may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct under investigation, thus enabling the United States to establish and prove each element of the offense, or, alternatively, to exclude the innocent from further suspicion. From my training and experience, I know that the information stored in connection with a PROVIDER account can indicate who has used or controlled the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” while executing a search warrant at a residence. For example, email communications, contacts lists, and images sent (and the data associated with the foregoing, such as date and time) may indicate who used or controlled the account at a relevant time. Further, information maintained by PROVIDER can show how and when the account was accessed or used. For example, providers such as PROVIDER typically log the IP addresses from which users access the account along with the time and date. By determining the physical location associated with the logged IP addresses, investigators can understand the chronological and geographic context of the PROVIDER account access and use relating to the criminal activity under investigation. This geographic and timeline information may tend to either inculpate or exculpate the person who controlled, used, and/or created the account. Additionally, information stored at the user’s account may further indicate the geographic location of the account user at a particular time (e.g., location information integrated into an image or video sent via email). Finally, stored electronic data may provide relevant insight into the user’s state of mind as it relates to the offense under investigation. For example, information in the PROVIDER account may indicate its user’s motive and intent to Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 78 of 81 64 commit a crime (e.g., communications relating to the crime), or consciousness of guilt (e.g., deleting communications in an effort to conceal them from law enforcement).20 154. Based on my training and experience, I know that evidence of who controlled, used, and/or created a PROVIDER account may be found within the user-generated content created or stored by the PROVIDER subscriber. This type of evidence includes, for example, personal correspondence, personal photographs, purchase receipts, contact information, travel itineraries, and other content that can be uniquely connected to a specific, identifiable person or group. In addition, based on my training and experience, I know that this type of user-generated content can provide crucial identification evidence, whether or not it was generated close in time to the offenses under investigation. This is true for at least two reasons. First, people that commit crimes involving electronic accounts (e.g., email accounts) typically try to hide their identities, and many people are more disciplined in that regard right before (and right after) committing a particular crime. Second, earlier-generated content may be quite valuable, because criminals typically improve their tradecraft over time. That is to say, criminals typically learn how to better separate their personal activity from their criminal activity, and they typically become more disciplined about maintaining that separation, as they become more experienced. Finally, because email accounts and similar PROVIDER accounts do not typically change hands on a frequent basis, identification evidence from one period can still be relevant to establishing the identity of the account user during a different, and even far removed, period of time. 20 At times, internet services providers such as PROVIDER can and do change the details and functionality of the services they offer. While the information in this section is true and accurate to the best of my knowledge and belief, I have not specifically reviewed every detail of PROVIDER’s services in connection with submitting this application for a search warrant. Instead, I rely upon my training and experience, and the training and experience of others, to set forth the foregoing description for the Court. Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 79 of 81 65 155. Therefore, Yahoo’s servers are likely to contain stored electronic communications and information concerning subscribers and their use of Yahoo services. In my training and experience, such information may constitute evidence of the crimes under investigation including information that can be used to identify the account’s user or users. CONCLUSION 156. Based on the forgoing, I request that the Court issue the proposed search warrant. Because the warrant will be served on PROVIDER, who will then compile the requested records at a time convenient to it, there exists reasonable cause to permit the execution of the requested warrant at any time in the day or night. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the service or execution of this warrant. Respectfully submitted, William Rose Special Agent USDA-OIG Subscribed and sworn telephonically pursuant to Fed. R. Crim. P. 4.1 and 41(d)(3) on April 17, 2024. _________________________________________ HONORABLE G. MICHAEL HARVRY UNITED STATES MAGISTRATE JUDGE Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 80 of 81 12 CERTIFICATE OF AUTHENTICITY OF DOMESTIC RECORDS PURSUANT TO FEDERAL RULES OF EVIDENCE 902(11) AND 902(13) I, _________________________________, attest, under penalties of perjury by the laws of the United States of America pursuant to 28 U.S.C. § 1746, that the information contained in this certification is true and correct. I am employed by Yahoo Inc. (“Yahoo”), and my title is _____________________________. I am qualified to authenticate the records attached hereto because I am familiar with how the records were created, managed, stored, and retrieved. I state that the records attached hereto are true duplicates of the original records in the custody of Yahoo. The attached records consist of ______________ [GENERALLY DESCRIBE RECORDS (pages/CDs/megabytes)]. I further state that: a. all records attached to this certificate were made at or near the time of the occurrence of the matter set forth by, or from information transmitted by, a person with knowledge of those matters, they were kept in the ordinary course of the regularly conducted business activity of Yahoo, and they were made by Yahoo as a regular practice; and b. such records were generated by Yahoo’s electronic process or system that produces an accurate result, to wit: 1. the records were copied from electronic device(s), storage medium(s), or file(s) in the custody of Yahoo in a manner to ensure that they are true duplicates of the original records; and 2. the process or system is regularly verified by Yahoo, and at all times pertinent to the records certified here the process and system functioned properly and normally. I further state that this certification is intended to satisfy Rules 902(11) and 902(13) of the Federal Rules of Evidence. Date Signature Case 1:24-sc-00834-GMH Document 1 Filed 04/17/24 Page 81 of 81
File and source
- File
- gov.uscourts.dcd.267377.1.0.pdf
- Size
- 1,144,943 bytes
- SHA-256
- a4eec1aa9a3fb5fe93bded7f2b09a038b3e27c7a5c294ec081e444a04587cac9
- Our copy
- gov.uscourts.dcd.267377.1.0.pdf
- Original
- www.courtlistener.com