…payroll hacking of over 5,500 companies
By Tobi Adetunji
The Federal Bureau of Investigation (FBI) has arrested a Nigerian, Charles Onus, for his alleged involvement in diverting $800,000 from over 5, 500 companies into prepaid debit cards.
The amount translates to about N320million at the current official rate of N410 per dollar.
This comes less than a month after Abidemi Rufai, an aide to Ogun State Governor, Dapo Abiodun, was arrested for fraud in the United States.
According to a statement on the United State Department of Justice website, Mr Onus was arrested and detained on April 14, in San Francisco.
He was presented before the Manhattan federal court on Wednesday.
The prosecution accused him of hacking over 5,500 company user accounts.
He allegedly participated in a scheme that stole nearly $1 million by hacking into a payroll processing company’s system to access user accounts and divert payroll to prepaid debit cards he controlled.
“As alleged, Onus did this as effectively as someone who commits bank burglary, but with no need for a blowtorch or bolt-cutters. Thanks to the FBI and IRS-CI, Onus is in custody and facing serious federal charges,” the statement read in part.
In the indictments filed against him in court, Mr Onus allegedly participated in the scheme between July 2017 through about 2018, obtaining over 5,500 company user accounts through a cyber-intrusion technique referred to as “credential stuffing.”
“After Onus successfully gained unauthorised access to a company user account, he changed the bank account information designated by the user of the account so that Onus would receive the user’s payroll to a prepaid debit card that was under Onus’ control.
“From at least in or about July 2017 through at least in or about 2018, at least approximately 5,500 company user accounts were compromised and more than approximately $800,000 in payroll funds were fraudulently diverted to prepaid debit cards, including those under the control of Onus,” the statement partly read.
He was charged with “one count of computer fraud for causing damage to a protected computer, which carries a maximum sentence of 10 years in prison.
“One count of computer fraud for unauthorised access to a protected computer to further intended fraud, and one count of receipt of stolen money, each of which carries a maximum sentence of five years in prison; one count of wire fraud, which carries a maximum sentence of 20 years in prison; and one count of aggravated identity theft, which carries a mandatory sentence of two years in prison to be served consecutively to any other sentence imposed.”