by Bill Singer
From The Land of Borat Comes A Double Dip Hack And Dump Securities Scam
April 23, 2012
If only this were a joke from a fictional movie
In recent months, "Street Sweeper" has disclosed securities frauds involving Russians, Romanians, Estonians, Lithuanians, Belarussians, and, now, I am less than pleased to announce, from Kazakhstan, the land of the fictional Borat.
Let us welcome Alexyi Li, 21, and Daniyar Zhaxalyk, 25, citizens of Kazakhstan, who are in the United States on student visas. It must have been quite the curriculum that students Li and Zhaxalyk pursued because in December 2011, they and two co-conspirators were indicted in the United States District Court for the Southern District of Texas for hacking into brokerage accounts in order to engage in a fraudulent stock scheme.
Bill Singer
Cultural Learnings of America for Make Benefit Glorious Nation of Kazakhstan: I wish that I could tell you that the prosecutors' press release announcing the Indictment set forth the alleged scheme with clarity but, sadly, it's a bit obtuse. Perhaps the full-text version of the Indictment sets forth in more detail the specific elements of the charged crimes, but no link to that source document was provided on the Department of Justice's website. Consequently, while there are references in the release to "borrowed" stock, sales, and repurchases, it's not presented in language that explains whether this was a fraudulent short sale or some other variant. If some of my assumptions subsequently prove to be erroneous, I apologize.
Hack And Dump
Apparently, the conspirators hacked into their victims' securities account and, thereafter, used the compromised accounts to purchase borrowed shares of stocks from accounts set up in the conspiracy's name. Although, the shares sold to the hacked accounts appear to have been part of a short sale, this is not satisfactorily explained in the prosecutor's press release. The press release asserts that the sold shares were purchased by the hacked accounts at prices above the prevailing market. Once these sales were executed, the conspirators repurchased shares from the hacked accounts at prices below prevailing market prices. This "hack and dump" scam resulted in over $400,000 in losses in the victims' accounts.
SIDE BAR: Let me offer an example of what I think may have happened here.
Typical Short Sale: Assume that XYZ is presently selling at $20 per share. You short the shares (which you do not own but have "borrowed" through your brokerage firm) at $20. The shares drop in price to $15, at which time you buy them back to close out your short position, and, in essence, realize a $5 profit on this hypothetical trade. Basically, when you enter a short sale as the shorter, you reverse the normal buy and sell order of a stock transaction by first selling the shares at $20 and subsequently buying back the same shares at $15.
Hack And Dump Short?: In the case of this hack and dump scam, I'm guessing that the conspirators borrowed shares, which they then shorted to the hacked accounts (which the conspirators controlled). However, when XYZ was selling in the market at $20, these hackers entered a bid from the victims' accounts for, say, $25 per share. After the hacked accounts overpaid for the shares of XYZ, the conspirators then closed out the trade by selling the shares from the hacked accounts back to the conspirators' accounts. Apparently unwilling to settle for the profit derived from entering the above-market bids in the hacked accounts, the piggish crooks also had the hacked accounts sell back the shares at prices below the market (let's say that the sale was executed at $18 when the prevailing market was $21) - a double dip if ever there were one!
Guilty Pleas
On March 2, 2012, Li pleaded guilty to aiding and abetting money laundering as a result of his role in laundering the funds generated in this scam. On April 20, 2012, Zhaxalyk pleaded guilty to one count of money laundering as a result of his having received and made wire transfers/withdrawals of the funds generated in the crime/ and for having supervised other Houston-based students involved in the laundering efforts. Li and Zhakalyk each face a maximum penalty of 10 years in prison and a $250,000 fine.
The two other conspirators remain at large.
Bill Singer's Comment
Doesn't the classic poem on the Statue of Liberty ask the rest of the world to send us "the wretched refuse of your teeming shore?" I guess we're sort of getting what we're asking for with this recent onslaught of computer hackers from overseas. Maybe we could try implementing some anti-Malware program as part of our passport and visa approval process? Hey, Symantec, Microsoft, someone - why don't you call up the government and offer your services?
READ these recent "Street Sweeper" columns:
- UPDATE: First Estonian Arraigned In DNSChanger Malware Case(April 20, 2012)
- Feds Nab Russian Hacker In ARNA and BIOD Options Trading Scam(April 17, 2012)
- UPDATE: Online Trojan War Ends With Prison For Eastern European Bank Account Thieves (March 20, 2012)
- Belarussian Identity Thief Sentenced in Financial Institution Fraud Ring (March 24, 2012)
- Vlad the Emailer : Feds Bust Romanian Phishing Ring (December 23, 2011)
- A Side of Romanian Identity Theft With Your Footlong Subway(December 9, 2011)
- Romanian Sentenced in eBay, Craigslist, and AutoTrader.com Scam(June 30, 2011)
- Belarusia Phish Fry? Feds Break Online Tax-Refund Scam (June 23, 2011)