Singaporean obtained Riot Games co-founder's credit card details from dark web
SINGAPORE — A Singaporean man impersonated the co-founder of a major US-based game developer after coming across his credit card details.
Ho Jun Jia, 32, then created an email apparently using Marc Merrill's credit card details and paid for cloud computing services to mine cryptocurrency. Merrill is the co-founder of Riot Games, the game developer and publisher behind the best-selling League of Legends.
Ho pleaded guilty to 12 charges, mostly under the Computer Misuse and Cybersecurity Act.
Then unemployed, Ho had registered an account with Amazon Web Services (AWS) to buy cloud computing services in 2016. He used these services to mine cryptocurrency. After several months, Ho was unable to pay for the services and had his account terminated. He was banned from using his own particulars to sign up for another account.
In 2017, Ho was involved in forging US driving licences for others by using Photoshop. He offered his services on a forum on the dark web. In return, the owner of the forum allowed him to access the “Staff/VIP” section, which contained details of individuals’ names, addresses and credit card details.
This was where he came across Merrill’s credit card details. Around 19 October 2017, Ho obtained the private details of 70 individuals, including Merrill. He knew of Merrill’s association with Riot Games.
Ho used Merrill’s details to sign up for an AWS account after researching his family background. He also used American Express’ (Amex) username and password recovery process to obtain Merrill’s password to his Amex account. He logged on and browsed the account. He also changed the email address associated with the Amex account.
After gaining control of the Amex account, Ho deceived AWS between 4 November 2017 and 28 January 2018 into believing he was Merrill and induced AWS to deliver cloud computing and related services worth about US$5,213,821.99 (S$7,111,574.99).
On 5 November 2017, AWS sent an email to Ho requesting a copy of current bill or national identification for verification. Ho then downloaded a copy of Merrill’s bill from the Amex account and used Photoshop to forge a US driving licence with a photograph of Merrill that he found online.
On 30 November 2017, AWS sent an email informing that it suspended the account due to a problem confirming the payment information. Ho again downloaded Merrill’s documents to do so.
Ho bought services worth about US$135,861.12 under Merrill’s credit card in November 2017. AWS received a chargeback request from Amex for this payment and refunded the payment after internal investigations.
The AWS account was eventually suspended when Ho failed to respond to emails to make payment.
Around the same time, Ho also registered a user account on Google Cloud Platform using Merrill's details. Between 4 November 2017 and 23 February 2018, Ho managed to deceive Google into delivering cloud computing and related services amounting to almost US$250,000. He forged an Amex card in order to verify and activate the account. This account was also suspended after Google could not process payment.
Google refunded the payments following chargeback requests from Amex.
Between 21 November 2017 and 1 March 2018, Ho acquired units of the cryptocurrency Ether, obtained by his act of cheating AWS. Ho sold a portion of the Ether units for $347,794.83 and spent the money from the sale and the remaining Ether units on personal expenses.
In 2019, Ho was charged in the US for federal crimes related to a scheme to mine cryptocurrencies using stolen computing power and services.
He will be sentenced on 20 April.
Stay in the know on-the-go: Join Yahoo Singapore's Telegram channel at http://t.me/YahooSingapore
