Criminal Complaint and Affidavit — United States v. Paris Denise Thomas

Summary

Criminal Complaint against Paris Denise Thomas, filed April 2, 2021 as Document 1 in Case 5:21-cr-00104-JGB (Case No. 5:21-mj-00243), charging Fraud in Connection with Emergency Benefits (Section 1040) and Wire Fraud (Section 1343) between June 2020 and December 2020. In the supporting affidavit, FBI Special Agent Amy R. Pfeifer of the Riverside Resident Agency explains unemployment insurance and Pandemic Unemployment Assistance benefits under the CARES Act. She says Bank of America statements tied to at least 30 unemployment claims filed from Thomas's IP address show repeated $1,000 ATM cash withdrawals at Colton, Loma Linda and Grand Terrace locations.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“Criminal Complaint and Affidavit — United States v. Paris Denise Thomas.” Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/court-filing-c-d-cal-no-5-21-cr-00104-dkt-1-c-d-cal-a0347d49c3/, SHA-256 c9774b87ec552eb57eb6953c1b69eb0064e086e66ce340a023812e356b64ae0f.

Full text

Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 1 of 31 Page ID #:1
AO 91 (Rev. 11/11) Criminal Complaint

LODGED
CLERK, U.S. DISTRICT COURT
UNITED STATES DISTRICT COURT
for the
4/2/2021 Central District
__________ of of
District California
__________
CENTRAL DISTRICT OF CALIFORNIA
-.
BY: ___________________
United States of America
DEPUTY
) April 2, 2021
v. )
Paris Denise Thomas
) Case No. KC
) 5:21-mj-00243
)
)
)
Defendant(s)

CRIMINAL COMPLAINT%<7(/(3+21(2527+(55(/,$%/((/(&7521,&0($16

I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
On or about the date(s) of June 2020 to December 2020 in the county of San Bernardino in the
Central District of California , the defendant(s) violated:

Code Section Offense Description
18, United States Code, Sections Fraud in Connection with Emergency Benefits
1040, and 1343 Wire Fraud

This criminal complaint is based on these facts:

✔ Continued on the attached sheet.
u

/s/
Complainant’s signature

Amy R. Pfeifer, Special Agent
Printed name and title

$WWHVWHGWRE\WKHDSSOLFDQWLQDFFRUGDQFHZLWKWKHUHTXLUHPHQWVRI)HG5&ULP3E\WHOHSKRQH

Date: 04/02/2021
Judge’s signature

City and state: Riverside, California Honorable Magistrate Judge Sheri Pym
Printed name and title

$86$ B. Tuyay, (213) 440-3141
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 2 of 31 Page ID #:2

AFFIDAVIT

I, Amy R. Pfeifer, being duly sworn, declare and state as

follows:

I. INTRODUCTION
1. I am a Special Agent (“SA”) with the Federal Bureau of

Investigation (“FBI”) and have served in this capacity for 16

years, since December 2004. I am presently assigned to the FBI

Riverside Resident Agency white collar squad. My

responsibilities as an FBI Special Agent include investigating

unemployment insurance fraud, mail fraud, identity theft, as

well as other related crimes. I am a graduate of the FBI

Academy in Quantico, Virginia. As part of my training at the

FBI Academy, I have received over 25 weeks of instruction in the

fundamentals of law, ethics, behavioral science, interviewing,

report writing, firearms, surveillance, defensive tactics, and

case management. I have also received instruction in the

identification, collection, and preservation of evidence,

photography, fingerprint collection and crime scene

investigation. I have completed thousands of hours of criminal

investigations, including compiling information, interviewing

victims, witnesses and suspects, and collecting evidence to

support the filing of criminal complaints and search warrants.

2. I have also completed training in the investigation of

white collar investigations including unemployment fraud, money

laundering, health care fraud, and identity theft. Through the

course of my employment with the FBI, I have directed and

participated in white collar investigations involving
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 3 of 31 Page ID #:3

unemployment insurance fraud, identity theft, securities fraud,

health care fraud, public corruption, bank fraud, wire and mail

fraud, and money laundering. Before my employment with the FBI

I was employed as a social worker.

3. Through my training and experience, including my

discussions with other law enforcement officers experienced in

investigating crimes involving unemployment insurance and

benefits fraud, I have become familiar with the methods used by

people who commit benefits fraud offenses.

II. PURPOSE OF AFFIDAVIT
4. I make this affidavit in support of a criminal

complaint against, and arrest warrant for, PARIS DENISE THOMAS

(year of birth: 1987) for violations of Title 18, United States

Code, Sections 1040 (Fraud in Connection with Emergency

Benefits) and 1343 (Wire Fraud).

5. The facts set forth in this affidavit are based upon

my personal observations, my training and experience, and

information obtained from other agents and witnesses. This

affidavit is intended to show merely that there is sufficient

probable cause for the requested warrant and does not purport to

set forth all of my knowledge of or investigation into this

matter. Unless specifically indicated otherwise, all

conversations and statements described in this affidavit are

related in substance and in part only.

2
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 4 of 31 Page ID #:4

III. BACKGROUND INFORMATION ON UNEMPLOYMENT INSURANCE
BENEFITS AND COVID-19-RELATED FRAUD

A. Unemployment Benefits
6. Since 1935, the DOL’s UI program has provided

unemployment benefits to eligible workers who become unemployed

through no fault of their own. This program ensures that at

least a significant portion of the necessities of life -- most

notably food, shelter, and clothing -- are met on a weekly basis

while the worker seeks employment. UI beneficiaries who meet

the requirements of the applicable state law are eligible for

this temporary financial assistance. Each state administers a

separate UI program within the guidelines established by federal

law. In the state of California, the EDD administers the UI

program for residents and others physically performing work

activities in California.

7. Generally speaking, regular UI claimants must be:

(1) unemployed through no fault of their own; (2) able and

available for work; (3) willing to accept suitable work; and

(4) actively seeking work.

B. PUA Under the CARES Act
8. On March 13, 2020, the President of the United States

declared the COVID-19 pandemic an emergency under the Robert T.

Stafford Disaster Relief and Emergency Assistance Act. On March

27, 2020, the CARES Act was enacted to provide emergency
assistance and health care response for individuals, families,

and businesses affected by the COVID-19 pandemic. The CARES Act

included, among others, the establishment of (1) PUA benefits to
3
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 5 of 31 Page ID #:5

provide financial assistance to individuals who are out of work

due to the pandemic, including those who do not usually qualify

for regular state UI such as self-employed, contract, and “gig

workers,” (2) the Pandemic Emergency Unemployment Compensation

(“PEUC”) benefit, a 13-week benefit extension for people who

have used all benefits available in their regular UI claim, and

(3) the Pandemic Additional Compensation (“PAC”) benefit, an

additional $600 federal stimulus payment automatically added to

each week of benefits received between March 29, 2020 and July

25, 2020.

9. On August 8, 2020, after Federal Pandemic Unemployment

Compensation (“FPUC”) expired, the President signed a

Presidential Memorandum authorizing the Federal Emergency

Management Agency (“FEMA”) to use disaster relief funds pursuant

to Section 408 Other Needs Assistance of the Stafford Act to

provide supplemental payments for lost wages to help ease the

financial burden on individuals who were unemployed as a result

of COVID-19. The “Lost Wages Assistance Program” (“LWAP”)
served as a temporary measure to provide an additional $300 per

week via a total of $44 billion in FEMA funds. The period of

assistance for LWAP is August 1, 2020 to December 27, 2020, or

termination of the program, whichever is sooner.

10. On December 27, 2020, the President signed into law

the Consolidated Appropriations Act of 2021. The guidance

provided states with important information about several

provisions of the law, including the extension of programs first

4
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 6 of 31 Page ID #:6

authorized by the CARES Act earlier in the year, as well as the

creation of a new UI benefit for “mixed earners.”

11. The law extended the PUA program created by the CARES

Act, which provides UI benefits to gig workers and others not

traditionally eligible for them. Under the law, the end of the

period of applicability for the PUA program extended to those

weeks of unemployment ending on or before March 14, 2021. In

states where the week of unemployment ends on a Sunday, the last

payable week of PUA was the week ending March 14, 2021 (March 13

if weeks of unemployment end on Saturday). For individuals on

PUA who have not exhausted their benefit eligibility of up to 50

weeks, the program also provided for continuing benefits for

eligible individuals for weeks of unemployment through April 5,

2021. The law also strengthened documentation requirements to

ensure PUA program integrity.

12. Additionally, FPUC, which expired July 31, 2020, was

reauthorized and modified to provide $300 per week to supplement

benefits for weeks of unemployment beginning after December 26,
2020 and ending on March 14, 2021, which was extended to

September 4, 2021 by the COVID-19 Relief Bill. FPUC was not

payable with respect to any week during the gap in

applicability, that is, weeks of unemployment ending after July

31, 2020, through weeks of unemployment ending on or before

December 26, 2020.

13. In addition, the time period for receiving the PEUC

benefit was extended from December 27, 2020 to March 14, 2021,

then through September 4, 2021, and the number of weeks that an
5
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 7 of 31 Page ID #:7

individual could claim PEUC benefits was increased from 13 to 24

weeks.

14. Prior to the enactment of the CARES Act, to be

eligible for UI administered by the EDD, a person must have been

employed and worked in California and received at least a

certain amount of wages from an employer in the 18 months

preceding his/her UI benefits claim. Because of this

requirement, self-employed workers, independent contractors, and

employees with insufficient earnings were not eligible to

receive regular UI benefits.

15. The CARES Act established a new program -- PUA -- to

provide unemployment benefits during the coronavirus pandemic to

people who do not qualify for regular UI benefits including

business owners, self-employed workers, independent contractors,

and those with a limited work history who are out of business or

have significantly reduced their services as a direct result of

the pandemic. UI benefits provided under the PUA program are

sometimes referred to as PUA benefits.
16. Under the PUA program, workers who are not eligible

for regular UI benefits but are unemployed or partially

unemployed for a COVID-19-related reason 1 permissible under

1 COVID-19-related reasons for being out of work include:
being diagnosed with COVID-19 or experiencing symptoms of
COVID19 and seeking a medical diagnosis; being unable to work
because a health care provider advised self-quarantining due to
concerns related to COVID-19; having a household member who has
been diagnosed with COVID-19; providing care for a family or
household member who has been diagnosed with COVID-19; having
primary caregiving responsibility for a child or other household
member who is unable to attend school or another facility that
is closed as a direct result of the COVID-19 and the school or
6
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 8 of 31 Page ID #:8

federal law may receive unemployment benefits for up to 46

weeks. Under the PEUC program, workers who are eligible for the

regular UI benefits for up to 26 weeks may receive an additional

13 weeks of benefits for a total of 39 weeks, which was later

increased to a total of 50 weeks. Under the PAC program, for an

individual receiving a regular UI benefit, a PUA benefit, or a

PEUC benefit between March 29, 2020 and July 25, 2020, the EDD

paid an additional $600 in CARES Act funds for each week of

benefits. Between December 26, 2020 and March 14, 2021, the

FPUC program provided an additional $300 per week for

unemployment. Examples of non-business-owner occupations that

may qualify a person for PUA benefits include realtor, barber,

hairstylist, freelance photographer, construction

handyman/woman, gardener, and ride-share driver. 2
17. The California EDD began accepting applications for

PUA benefits on April 28, 2020. Applications may be made online

from any digital device, including smartphones, that connects to

the Internet and is capable of accessing the EDD website’s UI

benefits page. To make benefits available as quickly as

facility care is required for the claimant to work; becoming the
breadwinner or major support for a household because the head of
household died due to COVID-19; the claimant has quit his/her
job due to COVID-19; the place of employment has closed due to
COVID-19; a job that the claimant was scheduled to start is no
longer available due to the COVID-19 public health emergency; or
the place of employment is inaccessible due to the COVID-19
public health emergency.
2 To be eligible, such person must also not be participating
in the UI Elective Coverage program. Under the provisions of the
California UI Code, employers may elect UI and State Disability
Insurance (SDI) or only Disability Insurance coverage for
themselves. Self-employed individuals, who are not employers,
may only elect SDI coverage for themselves.
7
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 9 of 31 Page ID #:9

possible, payments are issued in phases. If a claimant

qualifies for PUA benefits, the minimum payments are as follows

based on the claim’s start date:

a. Phase 1: For claims with start dates from
February 2 to March 28, 2020, $167 per week for each week the

claimant is unemployed due to COVID-19.

b. Phase 2: For claims with start dates from March

29 to July 25, 2020, $167 plus $600 per week for each week the

claimant is unemployed due to COVID-19.

c. Phase 3: For claims with start dates from July 26

to December 26, 2020, $167 per week for each week the claimant

is unemployed due to COVID-19.

18. PUA applicants may be eligible for more than the

minimum weekly benefit amount of $167 if their annual income for

2019 reported on the PUA application meets a minimum threshold.

19. Persons applying for PUA benefits do not need to

submit any supporting documents to the EDD with their

applications. Claimants enter their total income for the 2019

calendar year on the application. The stated income will be

used to pay the minimum benefits of $167 per week. The EDD may

request documentation to provide proof of the stated income. 3 If

the income information provided by the PUA claimant meets an

annual earnings threshold of $17,368 or more, the EDD will work

as quickly as possible to verify the claimant’s income using

3 In general, the EDD accepts items such as an annual tax
return, 1099 forms, W-2s, and pay stubs as proof of income.
8
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 10 of 31 Page ID #:10

other resources available to the EDD in order to increase the

PUA weekly benefit amount.

20. Like regular UI claims, PUA claims can be filed

online. When an individual files a PUA claim online, the EDD

automatically maintains certain information regarding the filing

of the claim. This information includes the date and time the

claim was submitted, the name of the person for whom the claim

was filed, and the IP address of the computer, or Internet

Service Provider (“ISP”) account, that was used to file the

claim.

21. A PUA claimant must answer various questions to

establish eligibility for PUA benefits. The claimant must

provide name, social security number (“SSN”), and mailing

address. The claimant must also identify a qualifying

occupational status and COVID-19 related reason for being out of

work.

22. After it accepts a UI claim, including a claim

submitted pursuant to the PUA program, the EDD typically
deposits UI funds every two weeks to an Electronic Benefit

Payment (“EBP”) debit card administered by BofA, which the

claimant can use to pay for his/her expenses. The EBP card is

sent via the U.S. Postal Service to the claimant at the address

the claimant provides in their UI claim. Claimants can activate

their debit card over the phone or online.

23. When receiving regular UI benefits, a claimant must

complete a Continued Claim Form (DE 4581) and certify every two

weeks, under penalty of perjury, that he/she remains unemployed
9
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 11 of 31 Page ID #:11

and eligible to receive UI benefits. The EDD authorizes and

deposits payment to the EBP debit card after it receives the

Continued Claim Form. On or about April 23, 2020, California

Secretary of Labor Julie Su directed the EDD to temporarily

suspend the requirement for UI claimants to provide unemployment

certifications (Continued Claim Forms). 4 The Continued Claim

Form was waived to prevent any unnecessary delays in dispensing

benefit payments.

24. At present, weekly PUA benefits typically range from

$40 to $450. In order to receive the maximum weekly benefit of

$450, a claimant must have earned $11,674.01 or more in the

highest quarter of the claimant’s base employment period.

25. The submission of the PUA claims cause mailings to the

addresses provided on the claims, including mailings of EBP

debit cards administered by BofA that are used to access the

fraudulently obtained UI benefits. The co-schemers and their

associates use the EBP debit cards to withdraw the fraudulently

obtained UI benefits by making cash withdrawals at Automated

Teller Machines (“ATM”) and point of sale purchases at merchants

across the United States.

C. UI Benefit Fraud Schemes
26. Based on my conversations with other law enforcement

officers, I know that individuals scheming to fraudulently

obtain UI benefits generally follow recognizable patterns,

including, among other indicia:

4 The temporary suspension of the continued claims forms
covered the weeks ending March 14, 2020 through May 9, 2020.
10
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 12 of 31 Page ID #:12

a. Co-schemers commonly buy or outright steal the

personally identifiable information (“PII”) of other people to

file for fraudulent UI benefits in the ID-theft victims’ names

and then collect the UI funds. Co-schemers often buy PII from

other fraudsters or from the Dark Web 5 (using cryptocurrency such
as Bitcoin) and verify that the PII belongs to real persons by

checking the PII at background check websites such as

Beenverified, Spokeo, Intelius, and Whitepages.

b. Using addresses the schemers control as the

addresses submitted to EDD for the claims so that EBP debit

cards and other EDD correspondence will be mailed to these

addresses and thus be accessible to the schemers. Once the EBP

debit cards arrive, co-schemers commonly withdraw UI benefits

via ATMs or make POS purchases at merchants for goods and

services.

c. Submitting multiple UI claims from the same IP

address for multiple claimants. These claims are sometimes

submitted on the same day close in time.

d. Failing to provide a phone number or provide a

wrong number on multiple UI claims so it may be difficult to

reach the identity holder.

5 Dark Web is the set of web pages on the Internet that
cannot be indexed by search engines, are not viewable in a
standard web browser, require specific means (such as
specialized software or network configuration) in order to
access, and use encryption to provide anonymity and privacy for
users. Dark Web has become the Internet’s black market in
recent years where visitors can make illegal purchases of PII,
guns, and drugs, and trade child pornography.
11
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 13 of 31 Page ID #:13

IV. STATEMENT OF PROBABLE CAUSE

A. SUMMARY OF PROBABLE CAUSE
27. The Department of Labor, Office of Inspector General

(“DOL-OIG”), California EDD, FBI, Homeland Security

Investigations (“HSI”), and United States Postal Inspection

Service (“USPIS”) are investigating a fraudulent scheme in which

the perpetrators fraudulently apply for and obtain UI benefits

under the PUA provision of the CARES Act, a provision that is
designed to help unemployed individuals obtain UI benefits as

part of the nation’s response to the economic harms caused by
COVID-19.

28. The investigation initially obtained evidence that at

least 47 fraudulent UI claims were submitted to EDD from the

same IP address for which the service address was THOMAS’s

address. An additional 2 claims were filed from different IP

addresses for which the service address was THOMAS’s address.

These fraudulent UI claims falsely asserted that the named

claimants were self-employed independent contractors who were

negatively affected by the COVID-19 pandemic, triggering

eligibility for UI benefits under the PUA provision of the CARES

Act. The UI claims submitted in furtherance of the scheme

falsely reported inflated income to EDD for the named claimants

on their applications in order to receive UI benefits.

29. These fraudulent UI claims were submitted

electronically from an IP address registered to M.T. at THOMAS’s

address on Flint Way in San Bernardino, California.

12
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 14 of 31 Page ID #:14

30. The UI claims filed from the THOMAS’s address

misrepresented that the named claimants were entitled to UI

benefits administered by EDD when, in fact, they were not. At

least 15 of the 49 UI claims submitted using the IP addresses

issued to THOMAS’s address used names and PII of individuals in

custody at California Department of Corrections and
Rehabilitation (“CDCR”) facilities, including the Richard J.

Donovan Correctional Facility in San Diego; the Los Angeles

County (“LAC”) Facility in Lancaster; and the Sacramento (“SAC”)

Facility in Represa. Due to their custody status, those inmates

were not eligible to apply for UI benefits as they were not:

(1) unemployed through no fault of their own; (2) able and

available for work; and/or (3) actively seeking work. In sum,

the 49 UI claims contained material false statements leading to

the theft of federal funds designated to provide emergency

unemployment benefits assistance.

31. On February 9, 2021, FBI executed a federal search

warrant at an apartment on Flint Way in San Bernardino,

California. THOMAS resided at that location with her fiancé

I.M., who was not present during the search. THOMAS admitted to

FBI agents in a voluntary interview that she filed multiple UI

claims using other people’s PII. Digital devices seized during

the search of THOMAS’s residence show that THOMAS discussed on

internet-based messaging applications filing and re-certifying

fraudulent UI claims in exchange for cash.

13
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 15 of 31 Page ID #:15

32. The 49 fraudulent UI claims mentioned above caused EDD

to disburse over $440,000 in UI benefits from June 2020 to

December 2020.

B. The Scheme to Fraudulently Obtain UI Benefits
1. DOL-OIG Investigates Public Reports of Fraudulent

UI Claims Filed Under California Inmates’ Names

33. Based on my review of reports, conversations with

other law enforcement officers, and my own involvement in

this investigation, I know the following.

34. On or about November 24, 2020, as reported in the

New York Times, a task force led by district attorneys in San

Diego and Fresno Counties sent a letter to California

Governor Gavin Newsom raising concerns about widespread

fraudulent UI claims being filed by inmates in California

correctional facilities. 6 On December 1, 2020, as reported in

the Los Angeles Times, investigators with the State of

California estimated that approximately $400 million had been

disbursed on approximately 21,000 suspected fraudulent UI

claims filed using the PII of California prison inmates. 7

35. Following these reports of fraudulent UI claims

using inmate information, DOL-OIG investigated potentially

6 “Unemployment Scam Using Inmates’ Names Cost California
Hundreds of Millions,” N.Y. Times, Nov. 24, 2020, available at
https://www.nytimes.com/2020/11/24/us/california-unemployment-
fraud-inmates.html.
7 “California’s Prisoner Unemployment Fraud Now Estimated at
$400 Million, Officials Say,” L.A. Times, Dec. 1, 2020,
available at https://www.latimes.com/california/story/2020-12-
01/california-prisoner-unemployment-fraud-estimated-400-million.
14
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 16 of 31 Page ID #:16

fraudulent claims using California inmates’ PII.

Specifically, DOL-OIG obtained from the CDCR the PII of

inmates housed in CDCR facilities at least since 2018. The

inmates were those who, due to their incarceration, were

ineligible for UI benefits under the EDD’s requirements.

DOL-OIG cross-referenced the inmates’ PII with the data

automatically stored by DOL-OIG and EDD for each UI claim

submitted to EDD. Through this process, DOL-OIG identified

hundreds of UI claims submitted using CDCR inmates’ PII.

After identifying the IP addresses used to submit the UI

claims using inmates’ PII, DOL-OIG identified instances of

multiple UI benefit claims made (both using inmates’ PII and

non-inmates’ PII) from the same IP addresses. In some cases,

DOL-OIG found that a single IP address had been used to file

dozens of UI claims resulting in hundreds of thousands of

dollars of UI benefit disbursements. DOL-OIG then obtained

from ISPs specific subscriber information for the IP

addresses from which multiple UI benefits claims were filed

using CDCR inmates’ PII.

36. In December 2020, I received information from DOL-

OIG Supervisory Special Agent Michael Blas and SA Christina

Wang about suspected fraudulent UI claims submitted from an IP

address originating in the Central District of California:

172.119.204.253 (the “Target IP Address”). M.T. was listed

as the registered subscriber of the Target IP Address for

which the service address, that is, the physical address, was

THOMAS’s address. DOL database records showed that the
15
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 17 of 31 Page ID #:17

Target IP Address was used to submit at least 47 fraudulent

UI claims to EDD between June and September 2020.

37. Approximately 15 of the 47 UI claims used PII of

CDCR inmates at the Richard J. Donovan Correctional Facility in

San Diego; the LAC in Lancaster, California; the SAC

Correctional Facility in Represa, California. Further

investigation into the claims submitted from the Target IP

Address showed that those claims had strong indicia of fraud

as described below. Two additional claims were submitted in

June 2020 from 75.83.173.103, a different IP address than the

Target IP Address. The service address for that IP address

ending in 103 during the time the claims were submitted was

THOMAS’s address. One of the 2 claims was for I.M. who was a

federal inmate (Reg. No. 5966xxxx) from in or about March

2020 through October 30, 2020. Both claims listed THOMAS’s

residence as the address for the claims. The other claim was

for THOMAS and J.T.

2. The UI Claims Were Fraudulent

38. The 15 UI claims submitted using CDCR inmates’

information were fraudulent. The inmates in custody were not

eligible to apply for UI benefits because they did not meet

EDD’s eligibility requirements. Those inmates were not:

(1) unemployed through no fault of their own; (2) able and

available for work; and/or (3) actively seeking work.

39. The remaining 32 claims filed from the Target IP

Address, which did not use CDCR inmate PII, also had indicia of

fraud. Based on my training and experience, I know that
16
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 18 of 31 Page ID #:18

individuals scheming to fraudulently obtain UI benefits

generally follow recognizable patterns, including the following,

among others:

a. Using the identities of other people to file for

fraudulent UI benefits in the other persons’ names and then

collecting the UI funds.

i. Generally, in some instances, the named

claimants are victims of identity theft; in other instances, the

named claimants have provided their personal identifying

information to the schemers and have agreed to pay the schemers

a portion of the fraudulent benefits that are obtained; in yet

other instances, the named claimants believe they may be

entitled to benefits but do not know that the schemers are

reporting false information to EDD to fraudulently increase the

amount of the benefits claimed.

ii. In this case, only 1 of the 47 UI claims

submitted from the Target IP Address listed a claimant address
that matched the registered address for the named claimant in

open source databases. In other words, 46 UI claims used

claimant addresses, which did not match the registered address
for those individuals in the Thomson Reuters Clear databases.

b. Using addresses the schemers control as the

addresses submitted to EDD for the claims so that EBP debit

cards and other EDD correspondence will be mailed to these

addresses and thus be accessible to the schemers. Here, EDD

records show that 2 of the 47 claims submitted from the Target

IP Address used THOMAS’s address as the claimant’s mailing
17
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 19 of 31 Page ID #:19

address, without any apparent connection to the THOMAS’s address

because they were not for THOMAS, I.M., or any individual

observed to reside at THOMAS’s address. Nine of the 47 claims

submitted from the Target IP Address used the claimant’s mailing

addresses from the same apartment complex on Base Line Street in

San Bernardino, California. California DMV records show that

M.T., THOMAS’s mother, the ISP subscriber for the Target IP

Address, lives at an address on East Base Line Street, San

Bernardino, California.

c. Submitting multiple UI claims from the same IP

address for multiple claimants and close in time. Here, DOL-OIG

identified 47 UI claims that were submitted between June and

September 2020 from the Target IP Address, which was leased to

THOMAS’s address in that time period. Specifically, 26 UI

claims had been submitted from the Target IP Address in July

2020, including 12 UI claims filed between July 12, 2020 and

July 15, 2020.
d. Providing similar or identical identifying

information across multiple different claim applications. Here,

the UI claims filed from the Target IP address exhibited the

following commonalities:

i. Generally, a single mailing address was used

for multiple UI claims submitted on the same day or within a few

days of each other.

ii. Two UI claims submitted from the Target IP

Address used M.T.’s DMV-registered address on Base Line Street

18
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 20 of 31 Page ID #:20

in San Bernardino, California. Another 7 UI claims used a

different apartment number at M.T.’s registered address.

iii. Five UI claims used apartments in the same

complex located on N. Rockvale Avenue in Azusa, California.

iv. The following 3 addresses were used for 9

separate UI claims:

x XXXX Polk Street, Riverside, California 92505;

x XXXX N. Riverside Avenue, Apartment XX8, Rialto,

California 92376; and

x XXXX Santa Anita Avenue, Altadena, California 91001.

v. Twenty-five UI claims listed no contact

telephone number.

vi. Four UI claims listed identical phone

numbers. Two listed (323) 691-XXXX, and the other two listed

(909) 233-XXXX.

3. The Fraudulent Claims Were Connected to THOMAS and Her
Flint Way Residence

40. Further investigation revealed that the UI claims

discussed above were connected to THOMAS in the following ways:

a. Law enforcement databases and Public records

showed that THOMAS and M.T. are related and that THOMAS receives

mail and resides at the Flint Way apartment in San Bernardino,

California.

b. Records from Charter Communications, the ISP

for THOMAS’s address, confirmed that when the UI claims were

submitted online from the Target IP Address, the subscriber for

the Target IP Address was M.T. THOMAS admitted in an interview
19
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 21 of 31 Page ID #:21

with the FBI on February 9, 2021, that M.T. was her mother

and that THOMAS had used M.T.’s name but M.T. had never lived

in the apartment on Flint Way. The service address listed

for the Target IP Address was THOMAS’s address. The username

associated with the account to which the Target IP Address

was issued was “PARISTHOMASXXXX@ICLOUD.COM.” The lease for

the Target IP address was from June 16, 2020 to December 10,

2020.

c. Several UI claims submitted from the Target IP

Address used THOMAS’s current or prior mailing addresses, as

ascertained in public and law enforcement records, including:

i. XXXX Flint Way, #16, San Bernardino,

California. THOMAS’s current mailing address and residence.

ii. XXXX East Base Line Street, Apartment

H103, San Bernardino, California. THOMAS used this mailing

address from June 2018 through July 2019 and was listed as

THOMAS’s address as of November 28, 2017.

iii. XXXX North Riverside Avenue, Apt 628,

Rialto, California. THOMAS used this mailing address in

March 2019.

41. From approximately June 2020 to December 2020, EDD

paid out approximately $440,000 in UI benefits on the claims

that used the same IP addresses associated with THOMAS’s

residence.

4. Sample of the Fraudulent Claims

42. I reviewed a sampling 15 of the fraudulent UI claims

discussed above, which were submitted to EDD between June 2020
20
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 22 of 31 Page ID #:22

and August 2020. The UI claims I reviewed used PII of

incarcerated CDCR inmates. The inmates had all been

incarcerated prior to 2019 and were still incarcerated through

2020.

43. The table below sets forth a sample of 6 among the

15 that I reviewed containing fraudulent claims using CDCR

inmates’ PII:

Claimant Claim Date Claimed Claimed Claimed Dates of
Reason for Work Was Amount Incarceration
Unemployment Affected

Clean
06/16/2004-
D.V. 07/09/2020 COVID-19 Barber Processed
PRESENT
($2,672)
Clean
06/23/2016-
D.C. 07/12/2020 COVID-19 Barber Processed
PRESENT
($4,676)
Carpet Processed 11/30/2010-
G.C. 07/12/2020 COVID-19
Cleaner 8 PRESENT
Final
09/07/2018-
C.W. 07/15/2020 COVID-19 touch-up Processed
PRESENT
Painter
Final
4/26/1988-
H.P. 07/24/2020 COVID-19 Touch-up Processed
PRESENT
Painter
Final Clean
07/28/1993-
J.A. 07/26/2020 COVID-19 Touch-up Processed
PRESENT
Painter ($20,020)

44. All 15 claims were electronically filed from the

above-referenced Target IP Address at THOMAS’s address.

Additionally, the UI claims used similar information, as

follows:

“Clean Processed” and “Processed” reflect the statuses of
8
the online UI claim based on EDD records as of December 2020.
21
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 23 of 31 Page ID #:23

a. The claimant reported being unemployed because of

a “disaster,” namely, COVID-19, and listed “Laid off/no work” as

the reason for unemployment.

b. In support of the UI claims, the claimants

selected the following self-attestation: “Your place of

employment is closed as a direct result of the COVID-19 public

health emergency” or “You cannot reach your workplace because of

a quarantine imposed as a direct result of the COVID-19 public

health emergency.” One claim selected “You cannot reach your

workplace because your health care provider advised you to

quarantine due to COVID-19 concerns.”

c. Thirteen UI claims did not list work or home

telephone numbers.

d. Several of the UI claims using inmate PII entered

identical responses into the fields requesting information about

claimants’ “occupation” and “other skills.” For example, 5 UI

claims listed “Hair Stylist/Barber or Barber;” 7 claims listed
“Final Touch-up Painter;” and 2 claims listed “Carpet Cleaner.”

5. Federal Search Warrant Executed at THOMAS’s Residence
45. On February 9, 2021, the FBI executed a search

warrant THOMAS’s residence on Flint Way in San Bernardino,

California. The search warrant (5:21-MJ-26) was issued by

the United States District Court for the Central District of

California and signed by the Honorable Sheri Pym, United

States Magistrate Judge. During the search, the FBI seized

two EDD cards, THOMAS’s digital devices, and a notebook

filled with PII for over 40 people.
22
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 24 of 31 Page ID #:24

46. On February 9, 2021, after the execution of the above-

reference search warrant, FBI SA Stephen Harrison conducted a

voluntary interview of THOMAS under the carport area of her

residence in a vehicle. THOMAS told us the following:

a. M.T. is THOMAS’ mother. M.T. never lived in the

Flint Way apartment.

b. THOMAS is employed as a caregiver through In-Home

Supportive Services (“IHSS”) for her mother and another client

named S.H. THOMAS previously had two additional clients, V.D.

and H.E.

c. THOMAS has been employed throughout the COVID-19

pandemic with the exception of a little over two weeks when

THOMAS stated that she had been infected with COVID-19.

d. THOMAS stated that she went to both of her

clients every day except for Sundays for her mom. M.T. had not

been employed for several years. THOMAS submitted her timecards

on-line to IHSS.

e. THOMAS applied for unemployment because she

needed money and thought she had worked for it. She applied for

it and EDD approved it. She did not claim a COVID-19 or any

pandemic-related reason. I.M. did not live with THOMAS at the

Flint Way address until December 2020 when I.M. was released

from prison.

f. THOMAS admitted that I.M. received an UI benefit

card at her residence on Flint Way, but THOMAS claimed that

someone else had applied for UI benefits using I.M.’s

23
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 25 of 31 Page ID #:25

information. Once I.M. was released for custody, he used his

own card.
g. THOMAS’s ISP is Spectrum and the account is under

M.T. THOMAS confirmed her e-mail address was the same e-mail

address associated with the Target IP Address.

h. THOMAS admitted to helping other people file UI

claims in exchange for payment. Specifically, she stated “I did

it, and it just was to have extra money.” THOMAS created the

few days later the person for whom she filed the UI claim would

receive a letter of approval.

i. THOMAS directed the EBP debit cards to be sent to

the addresses specified by those who paid her to file UI claims

because she knew that all those EBP debit cards could not be

sent to her residence.

j. THOMAS was paid to file the UI claims after the

EBP debit card was delivered to a third party. THOMAS received

payments in cash or through the internet-based “Cash” mobile

application. After THOMAS received payments for filing the UI

claims, she provided the individuals for whom the payments were

issued with the login information for the account.

k. When THOMAS filed multiple UI claims under the

same claimant address, she did not submit all the claims at

once. THOMAS claimed that she established a “rhythm” of placing

gaps in time to filing the claims, which she believed helped

them get approved. THOMAS knew that she could not use same

address or EDD would flag it.
24
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 26 of 31 Page ID #:26

l. Eventually THOMAS stopped filing UI claims

because she “felt bad.” THOMAS kept paper records for the

people who did not get approved in a green folder in her

apartment residence.

m. THOMAS denied that I.M. was involved with the

scheme.

47. Also on February 9, 2021, I reviewed with THOMAS 49

names on the UI claims filed from the Target IP Addresses

corresponding to the THOMAS’s residence. During this review,

THOMAS stated that she recalled filing UI claims for at least

approximately 34 of the individuals that appeared on the list.

THOMAS, however, stated that she did not believe all of the UI

claims she filed that appeared on the list of 49 were approved

to receive UI benefits.

6. Digital Device Analysis

48. During the February 9, 2021 execution of the search

warrant three digital devices were seized. After February 9,

2021, pursuant to the same search warrant, I reviewed two

digital devices that were seized from THOMAS’s residence: one

cellphone (Apple_iPhone) and one laptop computer. I was not

able to review one cellular telephone, which was also seized.

THOMAS’s cellphone showed that she had conversations with

various individuals about EDD claims. THOMAS worked with other

people to file UI claims and had others help her acquire PII,

which she used to file UI claims. On the two devices that I was

able to search, the following evidence was found:

25
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 27 of 31 Page ID #:27

a. In the Notes section of the Apple iPhone, I found

the following text:

“So I would need your full name exactly how it’s

shown on your social security card

D.O.B

DL#

And SS#

Email address

I can get you back 10,000 or more I charge 3,000

once the card comes . . . I will be able to tell if

you’ll get approved right away once I put the

application through . . . Everything once your

approved takes 2 weeks sometimes it comes sooner If

your out of state or in Cali I will activate your

card and pull my 3,000 off mail or bring the card in

person If in Cali . . . If you want to proceed
after Reading this send me all your information I’ll

you receive the link click on it and I’ll take it

from there your claim will be ready to be filed and

once I complete the app you will know instantly.”

The above note appears to outline the procedures THOMAS used to

file fraudulent UI claims for individuals who had requested her

assistance.

26
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 28 of 31 Page ID #:28

b. I also found various screenshots on the Apple

iPhone and the laptop computer that showed images of

conversations on messaging applications. At least 18 screenshot

images of a conversation with a contact identified as “Damion”

contained what appear to be PII for over 34 people.

Approximately 20 of the names and identifiers listed in the

screenshots matched the names listed on the claims for the

Target IP address (47 claims). The dates listed on the message

applications ranged from “Jun 21” to “Aug 4” although not all

images of the text messages showed the date. The PII for 13 of

the 15 inmates was also included in the 34 names I saw on the

screenshot images of text conversations.

c. Another screenshot of text conversations with a

contact identified as “DAMION” dated “July 26” appeared to

contain dates of birth, social security numbers, and various

personal identification numbers and addresses. The texts also

showed blue text which reads “Roger F. was approved. . .,” “Icon
(Pasadena California) finally got it,” and “Recertified TODAY”

followed by a list of names.

d. Based on my participation in this investigation

and my training and experience, I interpret the above text

messages with “DAMION” as showing that THOMAS received PII and

addresses from “DAMION” to file EDD claims. The messages also

show that THOMAS continued to have on-going communications with

“DAMION” regarding the re-certification process required by EDD

every two weeks to continue receiving UI benefits.

27
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 29 of 31 Page ID #:29

e. In the iMessage application (a text messaging

application) on the Apple iPhone, I found more references to

filing and re-certifying UI claims. Several of these messages

were between “Meme” (626) 421-XXXX and “Self”

(ParisthomasXXXX@icloud.com). For instance, one message read,

“11-29-2020 Paris to Meme Hey let Dan dog know the 13 teen ppl

is certified today.” Another message read, “12-01-2020 from

Self (paristhomasXXXX@icloud.com) to MEME “Hey bitch so I was

wonder is it ok to cash app me the $600 for December

certifications it don't have to be today and you keep the $50

for the phone bill.””

f. Based on my participation in this investigation

and my training and experience, I interpret the iMessage text

messages above, along with additional messages found on the

devices, that THOMAS requested a $3,000 fee for filing a UI

claim and an additional $650 to certify a group of claims from

other co-conspirators who benefited from the EDD benefits.
g. Text messages on the Apple iPhone also show

conversations between THOMAS and others about re-certifications

and UI claims through February 2021. Indeed, on February 3,

2021, just six days before the FBI executed the search warrant

at THOMAS’s residence, THOMAS sent a message via iMessage to

“Meme,” which read, “When I get home I’ll have to go through

each one again go see out of 13 I’ve already say and certified

7ppl that say pending I’ll text you the names when I get home.”

h. Additionally, in the Notes application on the

Apple iPhone, one file was titled “Total Amount From Beginning.”
28
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 30 of 31 Page ID #:30

The note listed names and dollar amounts next to several names

which matched the names on the list of 47 UI claims. The note

also stated, “TOTAL FUNDS GIVEN TO MEME $12,000,” “PARIS

$3,500,” and “PARIS MOM FOR ADDRESS $500.” There were

additional amounts for supplies like gas and ink.

i. Several photographs on the Apple iPhone and

laptop computer showed identification cards for people other

than THOMAS.

49. As part of the execution of the search warrant, I

reviewed both the digital and hard copy documents seized from

THOMAS, which appeared to be letters from EDD addressed to

people whose names matched the UI claims associated with

THOMAS’s Target IP Address.

7. REVIEW OF EBP DEBIT CARD STATEMENTS
50. On March 30, 2021, I reviewed a spreadsheet prepared

by FBI Forensic Accountant Stacy Martin that compiled data from

BofA account statements connected to at least 30 UI claims filed

from THOMAS’s IP Address. The BofA statements showed accounts

that were funded by the EDD as a result of the UI claims. The

BofA data showed a pattern of transactions consistent with

identity theft and fraud based on my training and experience.

51. Specifically, the summary of BofA transactions show

that between June 2020 and December 2020, multiple ATM cash

withdrawals were made from the same BofA locations in Colton,

Loma Linda, and Grand Terrace, California, all within 11 minutes

of THOMAS’s residence. Most of the ATM cash withdrawals were

for the amount of $1,000. For instance, on July 11, 2020, two
29
Case 5:21-cr-00104-JGB Document 1 Filed 04/02/21 Page 31 of 31 Page ID #:31

BofA accounts linked to UI claims made from THOMAS’s IP address

each made $1,000 ATM cash withdrawals from a BofA location in

Loma Linda within 2 minutes of each other. Similarly, three

days later, on July 14, 2020, two BofA accounts linked to UI

claims submitted from THOMAS’s IP address each made a $1,000 ATM

cash withdrawal and a $500 ATM cash withdrawal from a BofA

location in Loma Linda within 4 minutes of each other.

V. CONCLUSION
52. For all the reasons described above, there is probable

cause to believe that THOMAS has committed violations of Title

18, United States Code, Sections 1040 (Fraud in Connection with

Emergency Benefits) and 1343 (Wire Fraud).

Attested to by the applicant in
accordance with the requirements
of Fed. R. Crim. P. 4.1 by
telephone on this ____
2nd day of
April 2021.

HONORABLE SHERI PYM
UNITED STATES MAGISTRATE JUDGE

File and source

File: 1.pdf
Size: 2,238,438 bytes
SHA-256: c9774b87ec552eb57eb6953c1b69eb0064e086e66ce340a023812e356b64ae0f
Our copy: 1.pdf
Original: No public link identified.