A cybercriminal who ran a mere eBay scam became a more significant collar for the US Department of Justice after he successfully stole the identity of the special agent investigating him.

Rohit Jawa, 25, has pleaded guilty to eight counts of wire fraud, and one count of stealing a special agent's identity which he then used to fraudulently gain access to privileged law enforcement databases – from which he stole the personal identifying information of multiple victims.

According to court documents, Jawa's mischief began in January 2013. He controlled "a set of at least 19 eBay and 18 PayPal accounts ... engaged in a scheme to defraud eBay buyers and eBay's third-party parcel insurance company".

Investigating these fraudulent accounts, agents from the United States Postal Service's Office of the Inspector General (USPS OIG) obtained search warrants to dig into the email addresses. These were hosted by 1&!1 Mail and Media, a provider which lets users register multiple addresses under a single account.

The agents found "numerous conversations where buyers reported to the seller that they had not received a purchased item, despite Postal Service tracking history showing the item had been delivered."

In the case of insured parcels, the seller would file a claim with eBay's third-party insurance company, using the tracking history as evidence the Postal Service had lost the parcel – or it had been stolen. For uninsured parcels, the seller would use the tracking history to prove to eBay he had shipped the purchased item to the buyer, causing eBay to decide disputes in his favour.

Other messages in those accounts contained Postal Service tracking numbers for parcels the seller had sent, supposedly using eBay-generated Postal Service shipping labels, but which the buyer claimed to have never received despite Postal Service tracking history showing the parcel had been delivered.

As customers on eBay/PayPal are only provided with the five-digit ZIP code of where a package was delivered, if a shipping label address is changed to a different address within the same ZIP code, this creates a tracking history that makes it appear as if the Postal Service has delivered the package to the expected destination, rather than an unrelated address within that local area.

Agents found irregularities comparing the destination addresses eBay provided to the Postal Service, with the addresses on the labels as seen by the Postal Service's mail processing equipment.

"A seller can then use this legitimate-looking tracking history to convince eBay, a buyer, or an insurance company that he sent the purchased item to the buyer, when he actually mailed an empty box to a random address in the same ZIP code to generate tracking history," the agents said.

Special Agent John Watson stated in his affidavit in support of the criminal complaint, that in his "training and experience, this kind of manipulation of a shipping label is a strong indication of fraud."

OpSec 101

Identity theft

A victim of this fraud scheme complained to the Postal Service about his missing parcel. His complaint eventually reached a USPS OIG special agent, who began looking into it as an incident of mail theft by a Postal Service employee.

Corresponding with the seller via one of the 1&1 email addresses, the agent requested additional information about the missing parcel – doing so quite explicitly as a special agent, not suspecting any criminality on the part of the seller.

Jawa, the seller, then requested the agent provide him with a copy of his credentials as verification of his identity, which the OIG agent did.

Two days later after receiving this information, the FBI received a request using the special agent's identity with a secondary email address registered to 1&1.

This was for an account with Law Enforcement Online, a web portal which provides access to criminal intelligence and other highly privileged information for law enforcement officials. A day later, someone purporting to be the special agent phoned FBI tech support and successfully obtained a temporary username and password for that account.

Using the @leo.gov email which came with the LEO account, Jawa then corresponded with several police forces requesting accounts be made for him on their internal services. Although he was only successful in one instance, he then exploited this access to obtain sensitive personal information on at least nine people, including the special agent.

These nine subsequently had fraudulent eBay, PayPal, and other financial accounts opened using their identities.

Jawa, who is an Indian national, was indicted by a federal grand jury on 13 August 2015. He faces a mandatory minimum of two years in prison and a maximum penalty of 20 years. He will be sentenced on 12 February 2016. ®