Latest / Follow the Lies: Fraud & Deceit Uncovered / Episode 2: Help Desk Worker Stole 33,000 Identities — Largest Identity Theft Ring in America
Transcript
- Kevin Barrows: the early 2000s and the internet is exploding, with online access jumping over 50%. MySpace is letting people connect in ways they never could before, email is quietly killing snail mail, and people are starting to shop, bank, and live more of their lives on screen than ever before. Identity theft is new to the lexicon, born two years earlier when the federal government made it a felony in 1998. Back then, most people saw it as a physical crime. Someone stealing your wallet, rifling through your mailbox, or dumpster diving for credit card statements. Social security numbers were treated like simple passwords, printed right on bank statements, employee records, student IDs, even medical insurance cards. Most companies thought security meant locking the server room door. That gap, explosive digital growth and almost no real protection, created the ideal conditions for a whole new kind of criminal. While everyone was glued to their dial-up connections, Something far darker was quietly taking shape right behind them. A devastating crime that didn't need guns or masks, just access and greed. One man in a single key position would become the lynchpin. He stole or gave others access to steal over 33,000 identities, triggering hundreds of millions in losses and forcing the country to completely rethink how it protects personal data. In 2002, the FBI took it down. U.S. versus Philip Cummings. the largest identity theft scheme in U.S. history at the time, and the first to awaken the nation to a crime that would define how we live for generations. Welcome to Follow the Lies for What a Deceit Uncovered. I'm Kevin Barrows. Before we step back into the early 2000s, a quick word about me and why this case matters so much in my world. I'm a former FBI special agent and was the lead case agent on two of the largest white collar investigations in U.S. history, Operation Uptick, the massive securities fraud that dismantled organized crime on Wall Street, and this one, the Cummings identity theft ring. Today, I'm a partner at Renaissance Associates, where I oversee complex fraud and misconduct investigations for corporations, major institutions, law firms, and individuals. I also serve as a security consultant for Professional Sports League, have appeared on ABC's 20-20, been featured in National Geographic's Inside the American Mob, and guested on podcasts like the Jordan Harbinger Show. I also co-hosted the Smithsonian Channel docuseries Sports Detectives, where we track down missing pieces of sports history and follow the lies we dig deep into high stakes cases across the deception spectrum, from corporate fraud to sports scams and historical mysteries, and show how lies erode trust at every level. Today, we look at how one insider enabled the theft of over 30,000 identities, the ripple effects that changed data security forever, and why the lies still resonate. Now that you know a bit about who's walking you through this, let's step back into the early 2000s and see how this massive identity theft operation quietly started to take root. One of the companies racing to keep up with technology in the early 2000s was Tela Data Communications, known as TCI in Hawthorne, New York. TCI made simple credit prompter boxes, which were easy to use terminals you'd find at more than 25,000 companies across the country. Banks, car dealerships, cell phone shops, and apartment rental offices. If you walked into a Ford dealership to lease a Mustang, with one click, the salesman could pull a routine credit check from the big three credit bureaus, Equifax, Experian, and TransUnion. Philip Cummings was a help desk employee at TCI for a few months. His job was to assist clients, troubleshooting, answering questions, but it gave him access to thousands of customer passcodes and passwords. Those were the keys to unlocking TCI's database of credit reports. When he left the job, he took a spreadsheet of those confidential credentials with him. He saw a massive opportunity. Cummings wasn't the street level mastermind running the scams. He was the insider who enabled it all. He handed the codes to a co-conspirator, who later became a cooperating witness, in exchange for cash. That cooperator dealt with dozens of scammers in the Bronx and Brooklyn. They'd bring him lists filled with names, addresses, and even social security numbers. and asked for full credit reports. The fee was $60 per report, split 50-50 with Cummings. Credit reports are the keys to the kingdom for identity thieves. And once the reports were downloaded, the fraudsters went to work. They opened credit cards, took out loans, bought cars, even took out mortgages in victims' names. They destroyed thousands of financial lives. Losses climbed into the hundreds of millions. Let me tell you what it really looked like for some of the people on the other end of that fraud. Imagine you're 68, retired, living on a fixed income. One morning you open your mail and find a collection notice for a $22,000 car loan you never took out. You call the lender. They say the paperwork has your signature, your social security number, even your old address from 20 years ago. You spend months on the phone, filing police reports and writing letters to credit bureaus. Meanwhile, Your utilities get shut off because the scammers opened accounts in your name and racked up huge bills. Your retirement savings start to go to legal fees and debt collectors. That's not a hypothetical. That happened to people in this case. They didn't just lose money. They lost peace of mind, sometimes for years. A young couple in Ohio, both working saving for their first house, get pre-approved for a mortgage. Then the lender pulls their credit and sees six new credit cards all maxed out. plus two car loans they never applied for. Their score drops 200 points overnight. The mortgage falls through. They end up staying in a cramped apartment for another three years, watching friends buy homes while they fight to prove they're not the ones who spent the money. One victim said, it felt like someone had broken into our future and stolen it. That's what this kind of fraud does. It doesn't just hit your wallet. It destroys your dreams. A single mom in Florida gets a letter from the IRS saying she owes $18,000 in back taxes on income she never earned. Turns out someone filed a fraudulent return in her name and collected a refund. Now she's facing wage garnishment, leans on her tiny savings account, and constant calls from collectors. She can't afford a lawyer, so she spends night after night on hold with the IRS, trying to prove she's not a tax cheat. These weren't rich people being targeted. They were everyday families who could least afford it. And here's a detail that makes it even more chilling. Cummings had no direct connection to the street criminals carrying out the fraud. That link came through his main accomplice, who had access to all the street level players. The scheme was simple and devastating. No violence, no guns, no break-ins. Just one person with legitimate access and a willingness to abuse it. Low tech on the surface, but massively destructive. because the data was so valuable and so poorly protected at the time. That was the scheme. But how do you catch someone who never touches the money and never meets the victims? That's where the hard work began. I had just settled into my new desk in the bank fraud squad at the FBI's New York field office. After years on uptick and testifying for weeks on end in trials, I was burned out and needed a fresh challenge, a new violation to work and hopefully time to decompress a bit. So I requested a transfer and they granted it. My new supervisor stopped by to officially welcome me. He said he had an important case he wanted me to handle, details to follow when the evidence arrived. I didn't think much of it until I walked in the next morning with my coffee and bagel and the entire squad turned to look at me. I had no idea what I'd done, but it all made sense when I got to my desk and saw that it was buried head high in boxes. My supervisor came over, patted me on the back and explained that this was a case transferred from another field office that couldn't crack it. So they sent it to us because it had a connection to New York. All he knew was that it involved stolen identities and the White House had called headquarters asking what the FBI was doing about it. Now feeling enormous pressure, my first order of business was digging through the stack of boxes to get a handle on what we had. And frankly, what was even going on? They were stuffed with complaints from victims across the country. People whose addresses were changed, credit cards and loans opened in their names. Mortgages taken out all without their knowledge. The scale was staggering. Tens of thousands of victims, hundreds of millions in losses. But my main takeaway from the documents was that I could eliminate any of the employees of any of the institutions whose confidential codes and passwords were used to download the credit reports. The credentials of many different institutions all around the country were compromised. Ford Motor Credit in Michigan, Washington Mutual Bank in Florida, Dollar Bank in Cleveland, just to name a few. Other than that, there were absolutely no leads to follow. The previous agents had focused on chasing the P.O. boxes and mail drops where the fraudsters were having documents sent. These were scattered across New York's five boroughs and beyond. Fake names, paid runners who knew nothing about who hired them. It was like playing whack-a-mole. You hit one, three more pop up. I knew surveillance across the country to catch low-level accomplices wasn't a recipe for success. But for the first week or two, until I had a solid game plan, I did just that. At least I felt like I was doing something until I could figure things out. With help from the Postal Inspection Service, an underappreciated federal agency that does great work, I visited mail drops throughout New York, spoke with the owners to try to figure out who owned the boxes where the mail was being delivered, and sat on surveillance for hours on end trying to catch someone going in to retrieve it. I quickly learned that most of the owners didn't require ID to open a box. and the information they had was completely made up. The final straw came after a full day of surveillance in Brooklyn. I finally caught someone retrieving mail from a fraudster's box. It was a 16-year-old kid who said a guy from the neighborhood's friend named Junior asked him to do him a favor and grab the mail. Then hold onto it until someone told him what to do with it. He had no useful information, and I had enough. My head was spinning. It was clear the thieves were structured like a terror cell by design. Low level people known by a street nickname, the person above them known only by another street nickname, and so on. The only way to solve this was to cut off the head. Find the people at the top. The pressure point was that each passing day meant new unsuspecting victims. It was a race against the clock in the true sense. With the help of the credit reporting agencies, I identified the common threat. Every fraudulent request for a credit report used a TCI credit prompter box. I immediately interviewed executives and employees there to find anyone disgruntled with access to subscriber codes and passwords. The help desk stood out. High access, low visibility. So I spoke to current staff and some former employees, but Cummings had left the job years before, so he was out of the picture for quite a while. It could have been any of them. I needed a break. I needed hard evidence. The credit bureau's data was the needle in the haystack. Working closely with Equifax, Experian, and TransUnion, we looked for patterns in unauthorized inquiries. After countless hours learning how the system worked, it was clear that the fraud followed a pattern. Large batches, often outside normal business hours. What complicated things is that the request came through various 800 numbers. We isolated the batched requests and zeroed in on linking even one to a local phone number. After weeks of grinding, we finally tied a specific number in Westchester County, New York to unauthorized credit requests. We subpoenaed the subscriber information and I swore out a search warrant for the address. On a cool, crisp fall morning just before Halloween in 2002, eight of us rolled up on a large house on a nondescript street. It did not feel like this house could be the epicenter of a massive fraud. There were a number of people staying at the house at the time, the owners, their family and some extended family. We corralled all the occupants into the living room and we split up. Four agents went upstairs to search while I stayed downstairs interviewing the occupants and help with the downstairs search. Everyone denied any knowledge in the initial interviews, which was expected. At some point, I went upstairs just to check on the progress. I noticed the master bedroom was a total mess. But what caught my eye was that there was a massive, oversized wooden canopy bed in the middle of the room that took up most of the room and felt oddly out of place. Not thinking anything of it, I returned to the first floor search. After several hours of searching the entire house and the desktop computers, what I hoped to find simply wasn't there. I was crushed. I called the assistant US attorney and broke the bad news. It came up empty. There's nothing here. We started packing up empty boxes ready to head back to the office. But as we reached the front door, for reasons still unknown to me, I turned to another agent and said, hold on, let's go back up to the bedroom one last time just to be sure we didn't miss anything. I hadn't helped in the upstairs search at all, so I felt that I should at least take a quick look. Three or four of us trudged back upstairs. I stood in the main bedroom doorway scanning the room again. That big ornate wooden canopy bed caught my eye again. This time I looked up and it looked like the canopy was sagging just a little. So I stepped up onto the bed frame, reached up as high as I could with my right arm and began blindly feeling around. Suddenly I felt something. I was hitting something and there it was. Folders, papers, credit reports, lists of names and social security numbers all hidden on top of the canopy. My heart raced. We called up the rest of the team and started looking under the beds and behind furniture. We moved a dresser in the next bedroom and found a laptop. I went back to the owner of the house, confronted him with the evidence we found, and spent the rest of the day putting the pieces together. It turns out this was the house of Cummings co-conspirator, the man who connected the stolen credit reports of the street criminals. The key accomplice became a cooperating witness. We seized his computers, records, everything needed to get the full scope of the scheme. Once we got back to the office, CART, our computer analysis and response team, searched the computer and found passcodes, usernames, lists of victims, and documents with Philip Cummings' name. The cooperating witness was also able to provide valuable information, which helped us arrest several members of his street network in the following months. As an aside, I vividly recall him calling me one Friday night completely panicked. He was whispering. and said he was peeking through his window blinds at a huge group of reporters with cameras camped down on his lawn, trying to get pictures of him and his family. Apparently, a high-ranking official in the U.S. Attorney's Office had accidentally mentioned him by name in an interview, kicking off a press-feeding frenzy. I told him to draw the curtains, lay low for a few days, and they'll move on at some point. Needless to say, it was a miserable few days for him. In late 2002, Philip Cummings was arrested and charged with conspiracy to commit wire fraud, bank fraud, and identity theft. He later pleaded guilty and was sentenced to 14 years in federal prison. The case exposed massive vulnerabilities in how personal data was handled at the time. It pushed the country towards stronger data security laws, better encryption standards, and new rules requiring companies to notify people of breaches. It was one of the first major cases of large-scale identity theft. And it showed the world just how dangerous insider access could be when the wrong person decides to abuse it. Three types of identity theft are on full display in one scheme. Traditional methods, names, addresses, and social security numbers obtained by street criminals through mailed theft and dumpster diving. An insider who stole or gave others access to the stolen information. And high-tech methods, the use of a laptop to illegally pull the reports in bulk. All three colliding in the same case made it a serious wake-up call. That's the story of US versus Philip Cummings, from one man's abuse of trust to the most valuable asset, personal identity. Every case has its place on what I call the deception spectrum, and this one sits firmly on the systemic end. Coordinated, large-scale lies enabled by insider access and almost no safeguards. Cases at this level don't unravel by chance. They require a deliberate investigative strategy. And that's exactly what turned the tide here. The single most important part of virtually every investigation is taking great care in building a solid strategy. Where could the evidence live? Phone records, computers, video, time logs, and most importantly, witnesses. Once you know where it might be, the next big decision is order. Do you interview witnesses early to lock them into their stories or wait until late so you have the hard evidence to test their credibility and keep the subject in the dark? Those choices are often rushed because of time pressures or client demands, but they can make or break a case. I almost always prefer to interview the subject last when I have as much information as possible. The strategy paid off here. We had the phone records already linked to the fraudulent credit polls, and when we found the evidence in the search, they left the co-conspirator with no real option but to cooperate. That flipped the case wide open. Coming in future episodes, I've got a full playbook on interviewing strategy that can really move the needle. From quiet access to massive fraud, we followed the lives of identity thieves. Over 33,000 identities stolen, hundreds of millions in losses, and a wake-up call that changed how we protect data forever. The scary part? These same schemes are still very much alive today. They live in data breaches, phishing emails, fraudulent marketplaces. Same tricks, just powered by new technology. Each week, I'll share a lie detector tip, a practical field-tested technique to help you spot deception or protect yourself from it before it's too late. Today's tip is a practical way to protect yourself from identity theft and other personal deceptions before they can do real damage. Treat your own personal data like it's a crime scene. First, check your credit report at least twice a year. It's free at annualcreditreport.com. Look for accounts or inquiries you didn't open or authorize. If something's there, act fast. Second, Set up a fraud alert with the major credit bureaus. It's free and it requires them to contact you directly if anyone tries to open credit in your name. Third, be ruthless about phishing. AI, voice mimicry, and deepfake video calls are getting really good. They can sound and look exactly like your bank, your family, or your boss. My rule is to never give personal information or account information to anyone who contacts you, no matter how real it seems. If it's important, you call them back. on a number you already know is legitimate. And perhaps most importantly, turn on multi-factor authentication everywhere you can. It's estimated to stop over 90 % of identity theft attempts. One extra step provides massive protection. Finally, if you've ever been a victim or just want real peace of mind, consider signing up for 24-hour credit monitoring through one of the credit bureau's products. Yes, there's a cost, but it's a small price to pay for peace of mind. In future episodes, I'll share more of these real-world red flags and moves that have helped me and can help you stay one step ahead of the next lie. Next time, we're jumping into a big one in the sports memorabilia world where the stakes are just as high and the deception just as clever. If fraud has ever hit close to home for you or someone you care about, I'd genuinely like to hear what happened. Drop me a note at Kevin at FollowTheLivesPodcast.com. If this resonated with you, please subscribe. Leave a rating and review. It really helps us reach more people. Thanks for listening. Until next time, follow the lies.