Texas Man gets 5 years for buying stolen credentials for 38,000 PayPal accounts

A Texas man has been sentenced to five years in prison for buying 38,000 stolen credentials for PayPal accounts and then trying to drain them of their funds.

The man, Marcos Ponce, 37, of Austin, Texas, was also ordered to pay PayPal $1.4 million in restitution, the US Department of Justice said.(Opens in a new window) today.

The FBI discovered Ponce’s scheme while investigating an unnamed illegal online marketplace that trafficked in stolen login credentials from various websites. In 2016, a foreign law enforcement agency managed to copy all the files inside one of the servers hosting the illegal market. The FBI examined the server files and found that one of the most prolific buyers in the market was Ponce, who purchased 38,153 stolen PayPal login credentials, which “include username, password , name, email, address, balance, linked credit card numbers, linked bank account numbers and other information,” according to court documents.

The FBI connected Ponce to the crime by examining the IP address used to make the purchases from the illegal market. The same IP address also repeatedly accessed a PayPal account registered with Ponce. Additionally, he paid for the stolen PayPal credentials using a cryptocurrency account registered in his name on Coinbase.

In November 2018, the FBI raided Ponce’s Austin residence and found a USB drive containing some of the stolen PayPal login information. Investigators also uncovered Skype chat logs, which showed Ponce conspiring with others to drain funds from PayPal accounts and then launder the money.

The Department of Justice said its scheme began as early as November 2015. “Based on information from PayPal, the 38,153 PayPal login credentials purchased by the Moniker R (Ponce) account were used in connection with more than $1,000,000 in planned and completed fraudulent transactions,” the FBI said in court documents.

Ponce pleaded guilty to the crimes last year. “This prosecution and conviction sends a powerful message that the cyberworld is no haven for criminals, and law enforcement will work tirelessly to bring cybercriminals to justice,” said U.S. Attorney Ashley Hoff of the West District of Texas in a statement.