Two Convicted on Charges Stemming from Phishing Scams

After luring employees at Georgia Tech and the University of Virginia, among others, into giving them personal information back in 2015, two Nigerian nationals have been convicted in federal court in Atlanta on a variety of charges.

Georgia Tech’s cybersecurity team worked closely with investigators to gather evidence that led to the extradition of the two men who were based in Malaysia at the time of their phishing attacks.

“The Institute’s cybersecurity team, including a former member who is now chief information security officer at the University of Virginia, did a great job bringing these people to justice with their testimony in Washington,” said Georgia Tech Police Chief Robert Connolly. “Kudos to the expertise of our cybersecurity team, who protect our network every day.”

Olayinka Olaniyi, a citizen of Nigeria, was convicted by a federal jury on August 9, 2018, after a three-day trial, on charges of conspiracy to commit wire fraud, computer fraud and aggravated identity theft. Co-defendant Damilola Solomon Ibiwoye pleaded guilty to similar charges and was sentenced on January 31, 2018.

“These defendants used trickery to lure and exploit their unsuspecting victims, but they will now face the consequences of their scheme in federal prison,” said U.S. Attorney Byung J. “BJay” Pak. “We are grateful for the collaborative work by our national and international law enforcement partners in this case, and we will continue to vigorously prosecute cybercriminals who hide behind the anonymity of the internet to commit these types of crimes.”

“The FBI is determined to arrest criminals who believe they can hide out on the internet, protected by geographic boundaries, and prey on the American people and our institutions,” said J.C. “Chris” Hacker, special agent in charge of the FBI Atlanta Division. “This case clearly shows the benefits of global cooperation between the United States and international law enforcement.”

“We were proud to support our federal partners in bringing down this criminal enterprise,” said Georgia Attorney General Chris Carr. “We will remain vigilant in investigating and prosecuting all who attempt to defraud honest, hard-working Georgians.”

According to U.S. Attorney Pak, the charges and other information presented in court include: Olaniyi and Ibiwoye were behind several “phishing scams” that targeted colleges and universities in the United States, including Georgia Tech and the University of Virginia. While both are Nigerian citizens, they committed their crimes while living in Kuala Lumpur, Malaysia, and were extradited to the United States to face these charges.

A phishing scam is the act of sending fraudulent emails that appear to come from legitimate enterprises for the purpose of tricking the recipients into providing personal information, including usernames and passwords. Olaniyi and Ibiwoye directed phishing emails to college and university employees. Once they had possession of employee logins and passwords, they were able to steal payroll deposits by changing the bank account into which the payroll was deposited. Also, while logged into the university system through the stolen logins and passwords, these defendants were able to gain access to employee W2 forms, which they used to file fraudulent tax returns. The attempted theft was more than $6 million.

The stolen funds were routed into U.S. bank accounts, and the evidence showed that access to these bank accounts was acquired through the use of romance scams, where fraudsters pose on dating sites and apps as potential partners to gain the trust of their victim. At some point, the fraudster will make a request to deposit money into their victim’s account and claim to need all of the account information, including their account number, routing number, passwords, and answers to security questions. In this case, all of that information was then used to funnel the proceeds of theft through those accounts and out of the country.

Olaniyi, 34, is scheduled to be sentenced on October 22, 2018, at 10:00 a.m., before U.S. District Judge Steve C. Jones. Ibiwoye, 29, was sentenced to three years, three months in prison to be followed by three years of supervised release on January 31, 2018.

Assistant U.S. Attorney Jeffrey A. Brown, deputy chief of the Complex Frauds Section, and Special Assistant U.S. Attorney Laura D. Pfister prosecuted the case, which was investigated by the Federal Bureau of Investigation.