A 21-year-old Timonium man has been indicted by a federal grand jury on more than a dozen charges of fraud and identity theft, according to the Office of the U.S. Attorney for the District of Maryland.
Jordan K. Milleson, of Timonium, and Kingston, Pennsylvania resident Kyell A. Bryan, 19, each face decades in prison for allegedly stealing digital currency by hacking cellphones and other electronic accounts and through “phishing" emails, a ploy that aims to steal personal or sensitive information from the recipient.
The U.S. Attorney’s Office said that Milleson hacked into computer networks and electronic and financial accounts, and that Bryan participated in some of the takeovers.
According to the indictment, from Sept. 23, 2017, to Jan. 27, 2020, Milleson registered fake internet domains, sent phishing emails and took over cellphone numbers to steal digital currency and “valuable social media accounts."
In late June last year, Milleson and Bryan conspired to take over individuals' electronic accounts and steal digital currency for their own financial gain, according to the U.S. Attorney’s Office.
Among the 15 charges against Milleson and Bryan are unauthorized access to protect computers to commit fraud, intentional damage to protected computers, aggravated identity theft and wire fraud conspiracy.
The U.S. Attorney’s Office alleges that Milleson set up internet domains and fraudulent websites and used techniques phishing and vishing, or “voice phishing,” to deceive victims into visiting the fraudulent websites and giving their credentials so that Milleson could access their electronic accounts.
The indictment also alleges that Milleson, Bryan and others used credentials stolen from employees of wireless service providers to hack into those companies' computer networks and take over individuals' accounts through “SIM swapping" — a scheme in which a customer’s phone number, which is linked to a unique subscriber identity module, or SIM, was instead rerouted to a SIM installed in a device controlled by Milleson, Bryan or co-conspirators, giving them control over those phone numbers and often also giving access to the victim’s other electronic accounts, including social media and cryptocurrency.
In one instance, Milleson and Bryan allegedly stole more than $16,000 from a cryptocurrency account after obtaining that person’s account information.
When Milleson allegedly did not share stolen currency, Bryan, in a “swatting” attack — when one person criminally harasses another by falsely reporting an incident to police that will trigger a response by the police or special weapons and tactics (SWAT) team — anonymously called Baltimore County police, pretending to be a resident of the Milleson family residence and falsely reported he had shot his father at their home on June 26, 2019.
If convicted, Milleson and Bryan face up to 30 years in federal prison for each count of wire fraud and conspiracy, and up to five years for each count of gaining unauthorized access to a protected computer to commit fraud.
They also face a mandatory minimum sentence of two years in prison for each count of aggravated identity theft.
The indictment was unsealed Wednesday at Bryan’s initial court appearance. Milleson was arrested July 29, and denied bail Wednesday by U.S. District Court in Baltimore U.S. Magistrate Judge Beth P. Gesner.
The indictment was announced by U.S. Attorney for the District of Maryland Robert K. Hur; John Eisert, special agent in charge of homeland security investigations in Baltimore, and Baltimore County Police Chief Melissa Hyatt.
Assistant U.S. Attorneys Zachary Myers and Christopher Rigali are prosecuting the case.