JAMES B. KEITH
The decision to immigrate to the United States from Angola was an easy one for Domevlo Lukamba's parents. Angola, a south-central African nation, was impoverished and had experienced an intense civil war since 1975, when the country — which had been a Portuguese territory — gained its independence. The war raged until 2002 and had taken its toll on the social and civic fabric of the fledgling nation. At the time the Lukambas emigrated, the United Nations estimated that 80 percent of Angolans had no access to medical care and more than 1 million people needed assistance to avoid starvation. Survival was the motivating factor that drove the Lukambas to the United States with their 16-year-old son.
The family settled in Chicago and opened a beauty salon. They were hardworking people who took advantage of the opportunities available to them in a country where only the limitations people imposed on themselves could hold them back. The Lukambas' business was successful and they were able to move into a home in a middle-class neighborhood in the suburbs.
In his mid-twenties, Domevlo was tall, good looking and well spoken. He had finished high school in Chicago but had a difficult time adjusting to the disparity between what had been a life of fear in Angola to one of peace, tranquility, freedom and prosperity in the States. He was in another world, but he still carried remnants of the dread he felt before he moved — it was like waiting for the other shoe to drop. Psychologists refer to this condition as posttraumatic stress disorder (PTSD). He learned to adapt the surviv-alist street smarts he developed in Angola to life in a free and democratic society. He maintained contacts with some of his relatives in Angola and had formed new connections and a network of fellow African immigrants in Chicago. Life was good, and it became easy — too easy — once he learned how to work the system.
Domevlo had a couple years of college under his belt and was living part-time with his parents and the remainder with his girlfriend, the mother of their young son, on the campus of Southern Illinois University. He had taken a few computer and IT courses but decided not to follow through with his degree. However, what he learned about computers opened up a whole new world to him, one he would learn to take advantage of criminally.
Domevlo's problems adjusting to the American lifestyle manifested themselves in a lengthy adult criminal record in the short period since his seventeenth birthday — the age of adulthood in the eyes of the law in Illinois. He had adult arrests for theft, aggravated assault, aggravated robbery, unlawful restraint, kidnapping, attempted theft by deception, aggravated discharge of a firearm, criminal trespass to a motor vehicle and criminal damage to a vehicle. He had an outstanding warrant for a traffic offense and was on felony parole for unlawful use of a weapon by a felon. His last arrest was for domestic battery on the campus of Southern Illinois University after he assaulted his girlfriend. As victims of domestic violence often do, Domevlo's girlfriend denied being struck by him, but witnesses told police what actually happened. At the time of his arrest, he was holding a credit card and a checkbook that he was using for identity theft. His possessions eventually helped us identify him as the perpetrator of a major Internet-based identity theft case that took place across multiple states.
Things were getting back to normal in LaPlace, Louisiana, after Hurricane Katrina wrought mass destruction on a level not seen before. A Category-5 hurricane, Katrina swept through LaPlace — in St. John the Baptist Parish along the east bank of the Mississippi River in the New Orleans metropolitan area — leaving in its wake great hardships for the people who stayed to rebuild. Patricia Frank, 55 years old, had lived in LaPlace ever since she moved from Kansas at the age of 13 with her parents. Before Katrina, Patricia had already survived one major Category-5 hurricane, Camille, in 1969. She recalled in a raspy voice — ravaged from years of smoking — that "we never left for either hurricane and after Katrina we were without electricity for two months."
She easily progressed in and graduated from East St. John High School. After graduation, when she was 17 years old, she met 22-year-old Michael, a Vietnam veteran who was the brother of one of her friends, and they married after a brief engagement. Patricia explained the short courtship by saying, "We didn't have to get married. I wasn't pregnant — we were in love!"
After they were married, Patricia worked in a bank's accounting department until she had her first child. Michael took a job in the local steel mill as an electrical maintenance supervisor, where he has worked ever since. They bought a historic home that was built more than 130 years ago and raised two daughters in it. Their first daughter was born five years after they were married. Both of their girls went on to graduate school and became professionals.
Patricia Frank was the epitome of a survivor. She was a small-town girl with rural values who knew how to dig in deep when times got tough. After her first child was born, she became a housewife and maintained the family's finances. She was a newcomer to the Internet and online banking. She was a world away from, and completely naïve to, the frustrations she would come to experience as a victim of identity theft.
On a normal Tuesday in February, Patricia Frank called the Olympic Gardens, Illinois, police department to say that she was a victim of identity theft. Her initial report indicated that she had received a letter from her bank, Capital Financial, thanking her for keeping them informed about her change of address to 20200 Main Street, Olympic Gardens, Illinois. Mrs. Frank had not even visited Olympic Gardens, had not moved recently and did not make the changes to her checking account, which she had opened in 1972.
Patricia immediately notified Capital Financial that she had not requested the change of address. The bank representative she spoke with told her that her certificate of deposit worth more than $7,000 had been transferred to her checking account. Her online account information had been changed, including her personal identification number (PIN), e-mail address and telephone numbers. A request was submitted for checks to be sent to the Main Street address in Olympic Gardens, and there had been several attempts to move funds out of the checking account. The bank representative informed Patricia that he had called one of the new phone numbers added to her account and spoke with a male who identified himself as Pat Frank. Shocked, Patricia promptly closed the account.
Patricia also learned that the new Main Street address and telephone number on her checking account were used to open a credit card in her name with Citibank, and there had also been an attempt to transfer $3,000 from her Bank of America credit card. Patricia complained to her local police department in Louisiana and was advised to file a report with the Olympic Gardens, Illinois, police as well. Thus began my investigation — as an officer in Olympic Gardens — which would ultimately lead to the discovery of losses totaling more than $100,000 to various victims as well as the arrest and prosecution of a suspect for federal criminal charges.
The first thing I did was try to determine who lived at 20200 Main Street in Olympic Gardens, using an online public records database to which the police department subscribed. I entered the address and a report was generated that showed the owner of record for the property was Marian N. Lukamba. I also checked the two telephone numbers that were added to Patricia's bank account. One of them was registered as a cellular telephone number for Marian N. Lukamba. There was no registration information for the other phone number, but it was assigned to the same company, B-Cellular.
The report also listed a summary of Marian's relatives, so I conducted searches on them as well. The report I generated in the same database for Marian's son, Domevlo Lukamba, indicated that he had been arrested for the unlawful use of weapons by a felon and had been sentenced to three years in the Illinois Department of Corrections. I conducted a computerized-records search for his driver's license through the Illinois secretary of state and a criminal-history check through the Illinois Department of Corrections. I learned that he had a suspended license, had an extensive criminal history and was on parole for the charge of unlawful use of a weapon by a felon. He had state and federal arrest numbers and had an active warrant for his arrest for a traffic violation. His last arrest was at Southern Illinois University just a few months ago for domestic battery and resisting arrest.
My next step was to contact the last place he was arrested, the police department for Southern Illinois University. I phoned and spoke with a savvy veteran street sergeant, John Venditti, who was Domevlo's last arresting officer. Venditti told me that he arrested Domevlo Lukamba after responding to a complaint of a domestic dispute at a campus residence. When he arrived he met with Lukamba and his girlfriend, the mother of their child, who had clearly been battered. Lukamba denied hitting her, but witnesses said he struck her in the face with his fist several times. When Venditti attempted to handcuff Lukamba, he resisted arrest and had to be tackled to the ground. When officers searched Lukamba at the police station they found a debit card in the name of Reginald Barker and a checkbook in the name of Lynn Jackson. Venditti confiscated both items.
A couple of weeks after Patricia Frank filed her original report with us, I contacted her for a follow-up interview. She told me she closed her original checking account with Capital Financial and opened a new account with them. The first statement she received for the new account showed a fraudulent charge for a cell-phone bill in the amount of $481. She closed that checking account and opened yet a third one. She talked with a fraud investigator from her bank, Mario Davis, with whom I later spoke. Davis told me that the information changes to Patricia's checking account were made online and through phone calls to Capital Financial. He provided two Internet protocol (IP) addresses that were used. Having the IP address provides law enforcement investigators — if they are armed with a grand jury subpoena — with the information needed to locate the company providing the Internet access, and who the subscriber is. It will include the name, address and telephone number for the account. Davis also told me the new telephone number on Patricia's checking account. I recognized the number as the cell phone number listed for Marian Lukamba.
I decided to conduct a garbage pull at 20200 Main Street, which consists of contacting the disposal company responsible for picking up the garbage for a given address and requesting that they turn it over to police officers after it has been collected from the curb and placed in the garbage truck. The courts have recognized that there is no right to privacy once refuse has been picked up for disposal from the residence. A garbage pull is not one of a police officer's favorite things to do, but it can yield very useful information and evidence — as was the case here. The garbage pull yielded a shipping statement addressed to Robert Black from a sportswear company for the purchase of a Chicago Bulls jersey and overdraft statements from a bank addressed to Domevlo Lukamba at 20200 Main Street. The shipping label indicated the jersey was shipped to 20200 Main Street under the name Robert Black and paid for with a Chase MasterCard; the last four numbers of the card were listed. The contact number for the purchase was the cell phone number listed to Marion Lukamba. Chase MasterCard sent out an affirmation request to the cardholder — who turned out not to be Robert Black — and learned that the account holder had not given permission for his credit card to be used for this purchase. The account was closed as an account takeover.
Because the mailing address on Patricia's bank account had been changed to 20200 Main Street, correspondence from the bank was diverted to that address. That constituted mail fraud, a federal offense that fell to the jurisdiction of the U.S. Postal Inspection Service. I suspected the U.S. Postal Service would uncover more victims whose mail had been diverted to the 20200 Main Street. I decided to contact a friend of mine who was a postal inspector, Mark Kline.
Special Agent Mark Kline was a gritty, down-to-earth, keep-your-nose-to-the-grindstone law enforcement professional who was not afraid to get involved in a tough case that presented a challenge. He had a keen wit and a sharp mind for names and details. The first time I met Mark, he rolled several boxes of reports and evidence into my police department after we realized we were pursuing the same suspect in a case. Mark had many contacts in the banking and credit card industries and had worked on a number of complex financial-crimes cases. He told me that the Postal Inspector's Office would have jurisdiction in my case and agreed to work it with me.
Special Agent Kline conducted a "mail cover," which involved monitoring the mail sent to and from the 20200 Main Street address. Mark found that Domevlo was receiving several credit card statements in various names from Capital Financial, so I contacted the investigators at Capital Financial and they requested that the post office intercept the mail. After one week, the mail cover resulted in 68 pieces from Capital Financial. Most were addressed to different people, but all went to 20200 Main Street.
I called Capital Financial's lead fraud investigator, Mario Davis, and got his permission to open the letters. They pertained to multiple credit card accounts, and eleven of them actually contained credit cards in different names. Capital Financial's fraud investigation team developed a spreadsheet of the compromised accounts with correspondence sent to 20200 Main Street, which totaled sixteen accounts and more than $100,000. I asked Mario how he thought the identity thief acquired the victims' account information, and he said it was probably obtained through a phishing scam. Such scams — also known as spoofing — are accomplished by sending an e-mail, text message or other communication to victims posing as their bank and requesting verification of their account information. The victims respond by unwittingly forwarding personal information, such as name, birth date, Social Security number, address, telephone number, account number and PINs.
During the mail cover we also intercepted a letter addressed to Reginald Barker, the name on the debit card that Domevlo Lukamba had in his possession at the time he was arrested for domestic battery at Southern Illinois University. The letter contained a bank statement. I contacted the bank and learned that two checks totaling $10,000 had been deposited to open the account; both had been returned unpaid.
Three months had passed since Patricia Frank filed her original report. Patricia was upset and said that her Discover credit card had also been compromised — the address was changed to 20200 Main Street and the credit limit had been increased. I immediately phoned a friend who was an investigator with Discover Financial, Bill McDonough. He a 26-year retired police detective from Bloomingdale, Illinois, with a forte for financial crimes investigation.
Bill looked into Patricia's account and learned that Discover had closed it as an account takeover. The perpetrator had made a request for an emergency authorized-purchaser card to be sent to the 20200 Main Street address in the name of Domevlo Lukamba; McDonough said the card had already been delivered. He checked Discover's database and learned that there were two other requests for emergency authorized-purchaser cards to the 20200 Main Street address in the name of Domevlo Lukamba, along with credit-lines increases. Both of those cards had also been sent but were not scheduled for delivery by DHL for another two days. One of the Discover cards was in the name of Kevin Reed — a name I recognized from Capital Financial's spreadsheet of account takeovers. The second was for Keith Applequist with a request to send an emergency authorized-purchaser card in the name of Domevlo Lukamba.
I decided it was time to contact the Cook County state attorney's office to seek approval for a search warrant. I called DHL and scheduled a pick-up of the two packages from their terminal before they were delivered to 20200 Main Street. Our plan was to have one of our police officers pose as a DHL deliveryman and attempt a controlled delivery of the two packages. Immediately afterward, we would execute the search warrant. We coordinated our plan with members of the Cook County Sheriff's Department Emergency Response Team, which routinely provided specialized assistance to suburban Chicago communities upon request.
The next day, officers from the Olympic Gardens Police Department, Cook County Sheriff's Department and special agents from the United States Postal Inspection Service served the search warrant at 20200 Main Street. After breaching the front and back doors of the residence — which was empty — we began our search. We found a photograph of Domevlo Lukamba and mail addressed to him in one of the bedrooms. We also seized a laptop computer; a desktop computer; several thousand dollars in cash and checks; credit cards; and almost one hundred pages of computer printouts containing addresses, phone numbers, account numbers, passwords and PINs for many of the victims we had already identified. The printouts came from Domevlo Lukamba's e-mail address — the same one he used to file fraudulent credit card applications. One of the credit cards we recovered was an emergency authorized-purchaser card for Lukamba on Patricia Frank's account. The items were seized and entered into evidence. Although Domevlo Lukamba was not at home when the warrant was served, his parents arrived shortly after we began the search. We asked them to have Domevlo contact the police department, but not surprisingly he didn't.
A few days later, information about the case began to pour in. Since Lukamba did not contact me after the search, I called his parole agent and we met to review the case. The parole agent spoke with Domevlo's parents, but they said they did not know how to contact their son; the agent then spoke with his supervisor and obtained a parole violation warrant for Lukamba.
I learned that another credit card company discovered two fraudulent requests for emergency cards to be sent to Lukamba at 20200 Main Street. Several banks provided me with video footage from local branches that showed Lukamba requesting fraudulent cash advances against the credit cards that had been sent to his parents' home. At one bank he even signed his name and put his thumbprint on the receipt.
I developed grand jury subpoenas for the IP addresses used to contact the defrauded credit card companies and learned that Marian Lukamba was the subscriber. While sifting through this new information, I received another call from Patricia Frank; she had yet again been the victim of another account takeover.
I spoke with special agents from the Federal Bureau of Investigation about Domevlo, and they conducted a background check on the Lukamba family. The agents learned that Domevlo Lukamba was not in the United States legally and could be subject to deportation proceedings.
Based on our overwhelming evidence, I sent a bulletin to law enforcement agencies in the Chicago metropolitan area announcing the arrest warrant for Domevlo Lukamba, which included his photograph and a description of his fraudulent activities. Shortly thereafter, I was notified that he had been arrested in a nearby community. Lukamba was questioned by Postal Inspector Mark Kline and he confessed to the various account takeovers we were investigating. He identified himself in the surveillance from various banks and admitted to taking cash advances against other people's credit cards and checking accounts.
Mark obtained an indictment for Domevlo Lukamba through the U.S. Attorney's Office that included charges of identity theft, credit card fraud, wire fraud and mail fraud. Domevlo Lukamba pleaded guilty and was sentenced to three years of federal incarceration. He faces deportation once his sentence has been served.
Note
Lessons Learned
I gleaned many lessons working on this case. Experience taught me that Internet fraud is nefarious in nature. The psychological cost to the victim, as well as the time, effort and money needed to repair the damage caused by an identity thief can be devastating. In this case, Domevlo Lukamba easily preyed on his victims by obtaining their financial information through a phish-ing scam. The breadth of personal information Lukamba had about his victims was astonishing and included addresses, telephone numbers, birth dates, Social Security numbers, personal identification numbers, passwords and account numbers. Consumers should be aware that their banks and financial institutions will not send out requests for them to verify personal identifiers because they already have that information. They have no need to request verification.
The number of victims and the amount of information recovered indicated the relative ease with which Lukamba was able to commit his frauds. With the personal information he obtained, he conducted full account takeovers that allowed him to transfer funds; change billing addresses, e-mail addresses and telephone numbers for the accounts; and have additional credit cards sent to him. He was also able to conduct application fraud using the victims' information to open new accounts.
A major challenge in investigating Internet fraud is that victims, suspects and witnesses can be in multiple jurisdictions. However, Internet frauds can be resolved successfully if the investigators use a combination of computer research, traditional investigative tools and interjurisdictional law enforcement cooperation.
This case required an inordinate amount of resources, time and labor to investigate. Credit card companies, financial institutions, telephone companies and Internet service providers were slow to react to our requests because they were trying to protect the privacy of their customers. Obtaining subpoenas for the information was another time-consuming task in and of itself.
Investigators should think about preservation of electronic evidence. Have trained forensic computer technicians conduct a proper search and seizure of electronic devices. Send letters to e-mail providers asking them to preserve e-mail in suspects' accounts. Delays in obtaining information result in law enforcement having to play catch-up when the suspect is several steps ahead. Once the information is obtained — which can be months after the original request was made — it takes time to analyze and report it, giving the suspect time to move and close cell phone or Internet providers. It is easy for suspects to exploit service providers by using stolen identities, which can make it difficult to identify and zero in on the actual perpetrators of the crimes.
James B. Keith, MPA, CFE, is a fraud investigator for the Illinois Department of Insurance, Workers' Compensation Fraud Unit. He has a master's degree in public administration from Governors State University in University Park, Illinois, and a BA in education from the University of Wisconsin, Superior.