BUFFALO, New York — John Shestowsky, 51, of Greenfield Park, Quebec, Canada, pleaded guilty on Tuesday, October 27, in federal court in Buffalo to conspiracy to commit bank fraud, a scheme in which stolen bank account numbers were sold online and then used to run 89 fraudulent cheques through accounts at three of America's biggest banks, the U.S. Attorney's Office for the Western District of New York announced.

Source: U.S. Department of Justice, Western District of New York

Shestowsky entered his plea before U.S. District Judge John L. Sinatra, Jr. The conspiracy charge carries a maximum penalty of 30 years in prison, U.S. Attorney Michael DiGiacomo said. No sentence has been imposed yet: the Justice Department said sentencing will be scheduled at a later date, and a federal district court judge determines the actual sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

A '10k clients' email started the paper trail

According to the Justice Department, the conspiracy ran from April 2018 to July 2020. Shestowsky and co-defendant James Rasmussen conspired with others to defraud financial institutions through false and fraudulent pretenses. On April 5, 2018, prosecutors say, Shestowsky emailed Rasmussen the personal information of various individuals — including their bank account numbers — without their knowledge or permission. One email carried a listing titled “10k clients” covering eight individuals, with each person's address, phone number, bank name, bank account number and a note indicating the dollar amount held in the account.

Rasmussen then sold individuals' personal information, including information he had received from Shestowsky, on the internet for a profit, the department said. In one example it gave, between June 2019 and January 4, 2020, he sold approximately 52 M&T Bank account numbers online, again without the knowledge or permission of the account owners. M&T Bank is headquartered in Buffalo, and its customers were among those whose details were traded.

89 fraudulent cheques through three major banks

The second half of the scheme turned stolen account numbers into cash. Rasmussen incorporated a fictitious business, “First America Solutions Corp.,” in New York State, and opened bank accounts in that name, including accounts at JPMorgan Chase Bank, Bank of America and Wells Fargo Bank, prosecutors said. Fraudulent cheques made payable to First America Solutions were then deposited into those accounts, drawn on the stolen account numbers of real people.

The Justice Department broke the 89 cheques down bank by bank. Between March 10 and March 26, 2020, Shestowsky and Rasmussen caused 24 fraudulent cheques to be deposited into the JPMorgan Chase checking account, using the unauthorized bank account numbers of 24 individuals. Between March 11 and March 16, 2020, they caused 18 fraudulent cheques to be deposited into the Bank of America account using the account numbers of 18 individuals. And between March 16 and May 6, 2020, they caused 47 fraudulent cheques to be deposited into the Wells Fargo account using the account numbers of 47 individuals — including a victim in Wayne County, in the Western District of New York.

How stolen account numbers turn into money

This case shows the full chain of a common financial-crime pattern, step by step, in the prosecutors' own account. First, personal banking data — names, addresses, phone numbers and, most valuable of all, account numbers with the balances beside them — is gathered and traded. A list titled “10k clients” tells a buyer exactly which accounts hold money worth targeting. Second, the data is sold online to whoever will pay. Third, a paper company with a trustworthy-sounding name opens ordinary business accounts at major banks, and cheques drawn on the victims' accounts are deposited into them, making stolen money look like business income. By the time a victim notices an unauthorized cheque, the money has usually already moved.

The plea is the result of an investigation by the Federal Bureau of Investigation, under the direction of Special Agent in Charge Allen D. Davis, II, the Justice Department said. The case is being prosecuted by Assistant U.S. Attorney Paul E. Bonanno.

Why this matters beyond Buffalo

Buffalo sits directly across the border from Canada, and this conspiracy itself ran across that border: a defendant in Quebec, victims and banks in New York. For the many Punjabi-diaspora families in the United States and Canada who bank on both sides of the border, run trucking and small-business accounts, and routinely share account details with dispatchers, brokers and clients, the case is a concrete reminder of how little information a fraudster needs. An account number plus a name and address was enough, prosecutors say, to print cheques against a stranger's money. Checking statements for cheques you did not write, and treating account numbers as private information, are the basic defences banks and investigators point to in cases like this.

What happens next: Shestowsky will return to court for sentencing on a date the court has yet to set, where Judge Sinatra will decide his prison term under the 30-year maximum. Rasmussen's case continues separately. Anyone who believes their bank details were traded or misused can report it to the FBI and their bank; the Justice Department release did not announce a victim-notification list for this case.