Back in February, Josiah Boatswain, a 26-year-old from Flatbush, Brooklyn, and a few friends were pampering themselves at Fontainbleau: a $600-per-night resort that bills itself as the most luxurious hotel on the strip, promising high-end shopping, celebrities at every table, “24-7 glamour,” and an “expansive poolscape” on the stretch of Miami Beach known as Millionaire’s Row. Mr. Boatswain spent his vacation sipping Champagne, nibbling tiny chocolate cakes, and buying armfuls of couture, which he arranged in tableaux in his hotel room and photographed for his Facebook page.

In one picture, a silver wristwatch served as the understated centerpiece before a wall of Gucci and Salvatore Ferragamo boxes; another is simply a lineup of 11 shopping bags, like a Real Housewife’s walk-in closet. “My bro always want to do it big!” a friend commented approvingly.

According to the Manhattan District Attorney’s office, Mr. Boatswain, “Siah” or “Pepsi” to his friends, was financing his taste for Gucci and Moët with other people’s money, and not just any other people’s money, but that of billionaire investor Ira Rennert, former AIG chief Hank Greenberg’s Starr Foundation, and the Wasserman family trust, among other high-profile philanthropists, financiers and New York personalities. No fewer than 55 people were indicted and arraigned two weeks ago in a case the city and the police have dubbed “INSIDERS,” so named because low-level employees allegedly stole financial account information from patrons of four institutions, including about 150 donors to the United Jewish Appeal-Federation and about 900 customers of an Audi dealership in Coney Island. The case has not been tried and the proceedings will likely take more than a year. But according to the DA, the final victim list included Eric Zinterhofer, son-in-law to cosmetics heir Ron Lauder; Paula Sarnoff Oreck, the niece of former RCA head David Sarnoff and ex-wife of Oreck vacuum-cleaner big David Oreck; and, according to the New York Post, NBA commissioner David Stern.

Billionaires. Cyber crime. Insiders. Did the investigators realize they had a very sexy case right away? “Oh, yeah,” said Assistant District Attorney David Szuchman. “Very early on, when we realized there was an insider at UJA; we realized that the amount of information that was being compromised was large,” he said. “Then we realized that the group had to be working with others and it was a very, very large group to investigate. The fraud was so prolific.”

Basically, the cops were tipped off when the swindlers cashed one too many money orders. When you get access to a stolen debit card, one way to milk more cash out fast is to take it to the post office. With ATMs, you have withdrawal caps; money orders come in denominations of $1,000 and the fee is just $1.55.

Banks are hip to the money order racket, however. When debit cards that had been used to buy money orders were later flagged for fraud, the banks complained to the postal service. Mr. Szuchman couldn’t go into specifics, citing trade secrets of the cyber crime unit. But the gist is this: After the USPS saw about a dozen bogus money orders, mostly in Brooklyn and within a short time, the NYPD made a few arrests, which led to a search warrant for a cell phone or two, which led to the epiphany that the money orders were coming from high-profile philanthropists, which eventually led back to the UJA, where the investigators found their first “insider” in an elaborate plot that was as much a jackpot for the cops as it allegedly had been for the bad guys.

“We’re working a normal case and we’re going to handle it the same way either way,” Mr. Szuchman said. “But we were aware of some of the individuals that were named in the indictment as victims—we’re aware of the size of some of those donors.”

There are no signs, however, that Pepsi and his co-conspirators realized they were pilfering from the über-elite. The big-name victims are listed in the court filings alongside less fabulous surnames of unlucky doctors, lawyers and realtors. The thieves didn’t care if a particular UJA donor had ponied up $18 or a million-dollar check, as long as it was attached to a valid checking account number or credit card.

The alleged conspiracy appears to have been almost leaderless, and it’s still unclear who started the scheme. Most of the defendants are under 30, some have gang affiliations, and all but five are from Brooklyn. “It’s very hard for us to figure out who started it and when they started it,” Mr. Szuchman said. “We don’t really know.”

The list is an ethnic and demographic mix: a Polish bank teller, a 37-year-old Hispanic UPS worker, a 19-year-old from Florida. Five defendants are still unidentified, known just by their pseudonyms: “King Joffy,” “Michelle Brown,” “Paul None Livingston,” “Kevin None Rodriguez” and “Chuck.” The Post made much of the case’s alleged gang roots: “Street gangs target the charitable and rich,” the paper reported, but the defendants are associated variously with the Bloods, Crips and a hyperlocal East Flatbush gang called the Outlaws—suggesting it wasn’t an organized street crime operation, as gangs don’t typically collaborate. Two persons of interest turned up dead during the 18-month investigation, but there is no evidence that the murders were linked to the conspiracy or the investigation.

The main force behind the investigation, which involved multiple cell phone taps and subpoenas for text messages, was the District Attorney’s Cybercrime and Identity Theft Bureau, of which Mr. Szuchman is the chief. The former Eliot Spitzer acolyte took the job after a brief stint as head of the New Jersey State Division of Consumer Affairs under Jon Corzine. He now supervises a crack team of prosecutors, cyber-crime analysts and digital forensic analysts who snoop through confiscated iPads, smartphones and computers for a damning digital trail, things like the Google history of Justin Waller, a man who killed his roommate last year and reportedly searched, “How long does it take for a dead body to smell?”