Gang of fraudsters hacked four million customers’ accounts on Tesco, Boots and Goldsmiths websites and scammed firms out of more than £60,000 by stealing vouchers and ordering goods online to resell

• Gang used the dark web and malicious software to gather customer login details 
• They changed an email address subtly so they’d be sent any offers and vouchers 
• Once they had these details, they bought goods, sold them at discounted prices 
• The fraudsters took advantage of the fact that people use the same passwords 

Edward Kumsah was described as the leader of the fraud gang

A gang of fraudsters scammed Tesco, Boots and Goldsmiths out of more than £60,000 after hacking the accounts of four million customers. 

The ‘substantial and sophisticated’ fraud saw the gang gain unauthorised access to loyalty accounts and buy high-value goods.

Edward Kumsah, Jade Ofomola, Demi Okoi and Jamie Evans took advantage of people using the same password for several sites and were able to access Tesco Clubcard and Boots Advantage Card accounts. 

Speaking at Cardiff Crown Court Judge Nicola Jones described the case as ‘extremely complex’.

James Davis, prosecuting, said the login details – including email addresses and passwords – were not gained from the three companies but hacked from smaller, less secure websites.

Some of the login details may have been bought from the dark web and malicious software and viruses may have also been used to gather them. 

The court heard how the fraudsters were able to log in and change a customer’s email address, often by adding a single letter or number, so that future messages went to them rather than the real customer.

This allowed them to steal vouchers, order goods online, collect them in-store and sell them on at a discounted price.

Leader Kumsah, who has worked for Tesco in the past, was jailed for 30 months and ordered to pay a £120 victim surcharge. 

The other three avoided custodial sentences.  

Mr Davis said the offending caused total loss of £63,690.24 to Tesco, Boots, and Goldsmiths Jewellers, adding: ‘This was a substantial and sophisticated fraud.’

The court heard details were taken from four million people and there was evidence malicious software had been used to obtain the data.

Prosecutors said Boots became aware of the fraud in June 2014 and set up a crisis management team with their investigation costing tens of thousands of pounds.

Mr Davis said the loss to the pharmacy was £21,335.68, with 310 customers affected. The loss to the supermarket was £23,879.56, with 432 customers affected.

The court heard the offenders ordered items including Hudl tablets from Tesco and £2,000 Tag Heuer watches from Goldsmiths. The loss to the jeweller was £18,475.

Gang took advantage of people using the same password for several sites and were able to access Tesco Clubcard and Boots Advantage Card accounts (stock photo)

Prosecutors said security at Tesco Extra in Cardiff became suspicious when they noticed a Clubcard had been used to buy several PlayStations and Xboxes.

The defendants were identified after being caught on CCTV going into stores to collect the goods.

All four were arrested at Tesco Extra in Pontypridd on November 10, 2014, when security recognised Evans. 

The other three were caught in a car outside with the door pocket full of vouchers.

Mr Davis said all of the customers had their points refunded and did not lose out.

He described Kumsah as the ‘prime mover’, who was involved in hacking, with malicious software and incriminating messages found on his computer.

The court heard he was using more than 10 fake names, including Jason Duffus, and had 50 previous offences on his record. 

Prosecutors said security at Tesco Extra in Cardiff became suspicious when they noticed a Clubcard had been used to buy several PlayStations and Xboxes (stock)

Kumsah, 44, from Ystrad in the Rhondda Fawr valley, admitted conspiring to defraud Boots and Tesco between November 2013 and December 2014.

Lucy Crowther, defending, said it was not known why there had been a five-year delay in the case, with the postal requisition sent in December last year. 

Judge Jones said Kusmah manipulated others and undermined trust in loyalty schemes, adding: ‘You were the brains behind the operation.’ 

Kumsah, who has worked for Tesco in the past, was jailed for 30 months and ordered to pay a £120 victim surcharge.

Prosecutors said Ofomola, who was in a relationship with Kumsah at the time, had a minor and unrelated offence on her record.

The 30-year-old from Porth, in the county borough of Rhondda Cynon Taf, admitted conspiring to defraud Goldsmiths between January and December 2014.

Susan Ferrier, defending, suggested her client was naive and ‘caught up’ in the relationship with her co-defendant, which has now ended.

Prosecutors said Boots became aware of the fraud in June 2014 and set up a crisis management team with their investigation costing tens of thousands of pounds (stock)

The judge noted she has physical and mental health problems and is due to have ‘life-saving medical treatment’, which has been delayed by the proceedings.

Ofomola was given a 15-month jail term, suspended for 18 months, and ordered to pay a £100 victim surcharge.

Her cousin Okoi, 22, from Coventry, admitted two counts of fraudulently obtaining goods from Tesco. 

Nick Gedge, defending, said she had no previous cautions or convictions and played a ‘peripheral role’ in the fraud.

He told the court she was 17 at the time and was staying with her older cousin Ofomola following an argument with her parents. 

Mr Gedge suggested there was a ‘significant degree of naivete’ and the case has been ‘hanging over her head’ for five years, with the delay not her fault.

He said Okoi has started a new life in the Midlands where she has been working for an insurance company. She is married and expecting a baby in November.

Judge Jones noted she is likely to lose her job as a result of the conviction and accepted she was manipulated by the older defendants but should have known what she was doing was wrong.

Okoi, described as a ‘foot soldier’ for Kumsah, was fined £250 and ordered to pay a £30 victim surcharge. 

Prosecutors said she was in an on-off relationship with Evans, who had previous convictions for assault occasioning actual bodily harm, battery, and possessing a bladed article.

Evans, 36, from Stoke-on-Trent, admitted three counts of fraudulently obtaining goods from Tesco. 

The judge asked why he failed to attend an appointment with probation for a pre-sentence report.

Andrew Kendall, defending, said Evans borrowed money for the train but realised at the station the ticket cost nearly £250 – most of his £300-a-month income.

Mr Kendall said Evans, who cares for his partner, got a job managing houses for property developers, and is hoping to start his own car business.

Judge Jones accepted he was another ‘foot soldier’ and imposed a 12-month community order, requiring him to complete 120 hours of unpaid work.

She said: ‘Four million customers had their accounts hacked. Many people have been affected by this fraud but there are many more people out there who do not know they have been hacked.’

Source: Read Full Article