Store IDs led to arrests

Data taken from TJX was used to buy gift cards

If you're going to buy a high-definition television using stolen credit card numbers, don't buy it at a store that has your photo and address in its records.

Six people arrested and charged with participating in a crime ring that used credit card numbers stolen from TJX Cos. of Framingham to buy more than $8 million worth of electronics at Wal-Mart and Sam's Club stores across Florida face arraignment this morning in Jacksonville. Four other defendants remain at large. Security and law-enforcement officials who built the case identified at least three of the defendants with the help of records kept by Sam's Club, the discount warehouse division of Wal-Mart Stores Inc.

To prevent non members from shopping at Sam's Club and taking advantage of its discounts , the chain requires all members to hold an identification card, nearly always with a photograph and address. In the Florida case, one break came when investigators matched the images they saw on store surveillance tapes, which recorded the customers involved in the suspicious transactions, with driver's license photos and photos the chain had in its database of Sam's Club members.

Investigators "pieced it together from the bottom up," said Bill Cervone, a Florida state attorney whose jurisdiction includes Gainesville, Fla., where a police detective took the lead after two Wal-Mart stores there reported suspicious purchases in the fall.

The chronology of events, spelled out by law enforcement officials and in an affidavit filed in connection with the case, demonstrates one way that thieves can profit from lists of stolen credit card numbers by turning them into gift cards with which to buy expensive goods -- in effect laundering the stolen numbers to make them harder to trace.

The new details also could increase pressure on TJX to do more for customers whose credit card numbers it discovered were taken, some of whom have complained the company has been slow to alert them of the breach it first reported publicly in January.

One person listed in the Florida court papers as being a victim of the data theft, Thomas Paquette, 49, a services manager in Northampton, Mass., said in an interview that he noticed roughly $2,000 charged to his Visa statement in November from a Pensacola, Fla., Wal-Mart he says he has never visited. Paquette says his card company, Visa, forgave the charge, but says he's heard nothing to date from TJX, though he had come to suspect his data was compromised in the company's breach. "I would have appreciated a call," he said.

Specifically, police allege that the individuals, six of whom have been arrested, made or obtained fake credit cards with real account information on TJX customers taken from its computers. They allegedly used the credit cards to buy gift cards from Wal-Mart and Sam's Club and then allegedly used the cards at stores throughout Florida to buy more than $8 million worth of electronic goods such as computers and big-screen televisions, returning the goods in some cases for cash. Prosecutors say police don't think the ring stole the information directly from TJX, but are still investigating whether they also sold gift cards to outsiders.

In general, retail executives say the fraudulent use of gift cards is a growing problem because the instruments are seen as secure, hard to trace, and easy to transport compared to drugs or most stolen goods.

According to the filing, known as a "probable cause affidavit" assembled mainly by Gainesville police, the investigation got started on Nov 1. when Detective Randy Roberts was contacted by loss-prevention officers at two separate Wal-Mart stores concerned about large gift card purchases.

The filing doesn't say specifically what made them suspicious, but at one store, employees wrote down the plate number of a white Jeep Commander driven away by three people, then retrieved video images of two of them from store cameras.

The next day, an associate at a third Wal-Mart store in nearby Starke, Fla., called police to report that two men had purchased $32,800 worth of gift cards in $400 increments using four credit cards on the day before. "That got someone's attention really quick," said Starke Police Sergeant Bill Brown. When Bank of America told Wal-Mart the cards had been reported stolen, Brown said, associates called police.

On Nov. 18, Roberts met with Wal-Mart security officials, Brown, and others, discussing a spate of similar activity at stores around Florida. They determined a key suspect was Miami resident Irving Escobar, 18, based on various surveillance photos from the Gainesville store. (A Starke police report also states Roberts had obtained records showing Escobar and three others had rented the Jeep).

Other evidence they eventually reviewed included Sam's Club customer photos of Escobar and his wife, Zenia Mercedes Llorente, with whom he shares a customer account.

Working backward from store-surveillance camera recordings, credit card receipts, and interviews with store employees, police and security officials put together a chronology of Escobar's movements. The affidavit says the first suspicious incident involving Escobar occurred on Aug. 3, 2006, when he entered a Miami Sam's Club and bought $2,660.88 in merchandise using Wal-Mart gift cards that had been purchased throughout Florida. The store, in Miami's western outskirts, isn't far from Escobar's home address near Miami International Airport.

Throughout September, Escobar made 11 similar transactions for a total of $2,845.70 in merchandise at the same Sam's Club, the affidavit says. By October his reach had spread; he allegedly bought $35,251 worth of Wal-Mart gift cards and merchandise at a Wal-Mart store in Jacksonville Beach on Oct. 25.

As in other transactions, many of these gift cards were worth $400 each, potentially an attempt to fly beneath Wal-Mart's fraud radar. (A Wal-Mart spokesman said the company couldn't discuss the ongoing police matter.) Escobar and several other defendants also are described making numerous visits to other Wal-Mart and Sam's Club stores throughout the state in, among other places, Jacksonville, the Tampa area, and Pensacola, the affidavit states.

Police also allege that Escobar's wife, Llorente, bought $4,601.69 worth of goods using fraudulent gift cards at a Miramar, Fla., store, and that Escobar's mother, Nair Zuleima Alvarez, made similarly suspicious purchases totaling $11,135.55 in Miami in December.

Attorneys for Escobar and Llorente declined to comment. An attorney for Alvarez said she has filed a written plea of not guilty.

Amy Osteryoung, an assistant statewide prosecutor handling the case for Florida Attorney General Bill McCollum, credited Roberts and others for pulling together many threads. "This case is a great example of agencies working together to take down a highly organized group," she said.

Osteryoung said she wasn't prepared to discuss the exact role of Escobar or his two relatives, or that of a person the filing identifies as Dianelly Hernandez, 19, a Sam's Club employee. (Her attorney declined to comment.)

Security consultant Mark Rasch, a former federal prosecutor, said card fraud cases often involve insiders. "The easiest link to corrupt is the human link," he said, adding that "You have low-wage employees who are entrusted with sensitive information, and they know the systems." Though he didn't have direct knowledge of the case, he said one possibility is that Hernandez could have helped process the transactions involving the gift cards so others wouldn't grow suspicious.

Ross Kerber can be reached at kerber@globe.com.