Texas man gets 5 years for stealing 38,000 PayPal account credentials

A Texas man whom federal prosecutors say bought 38,000 compromised PayPal account credentials from an illegal online marketplace and used them to steal from the true account owners was sentenced to five years in prison Wednesday, the Justice Department said.

Marcos Ponce, 37, of Austin, also was ordered to pay $1.4 million in restitution, according to a Justice Department press release, which said Ponce pleaded guilty to conspiracy to commit wire fraud in October 2021.

Court documents in the case show that from at least November 2015 until November 2018, Ponce and his co-conspirators established buyer accounts on an illegal online marketplace which sold stolen payment account credentials along with complementary personal identification information.

Prosecutors contend that Ponce and his co-conspirators developed social engineering techniques so they could dupe third parties into accepting money transfers from the compromised PayPal accounts before transferring the money into accounts they controlled.

“The Justice Department remains firmly committed to protecting the American people from fraudsters like this defendant,” Assistant Attorney General Kenneth Polite, Jr. of the Justice Department’s Criminal Division said in a prepared statement. “May today’s sentencing send a clear message to would-be thieves: there are real-world consequences for online crimes.”

PayPal account credentials have proven a popular lure for cybercriminals. In August fraudsters impersonating the head of Europol, the European Union’s law enforcement agency, threatened targeted individuals with criminal prosecution before attempting to steal their PayPal account credentials.

The FBI’s Washington Field Office and the FBI San Antonio – Austin Cyber Task Force investigated Ponce’s case.

“Today’s sentencing sends a message that the FBI will pursue cybercriminals across the globe,” said Assistant Director in Charge Steven D’Antuono of the FBI’s Washington Field Office. “Hiding behind a computer does not mean you can stay anonymous or out of reach of law enforcement.”