Phone Spoofing Used to Steal Identities from Local Credit Union

Keith Heffintrayer•

Police lights.

A Florida man is facing hundreds of felony charges after allegedly stealing more than a dozen identities from members of the Merck Sharp and Dohme Federal Credit Union.

Junior Rafael Ordonez-Funez, 20, of Miami, is charged with a total of 303 felonies, including identity theft, criminal conspiracy to commit theft, dealing in proceeds of unlawful acts, theft by unlawful taking, conspiracy to commit access device fraud, access device fraud, criminal use of a communication facility and more. An additional 122 misdemeanor charges include receiving stolen property, unlawful device-making equipment, possessing an instrument of crime and more.

According to the criminal complaint, Ordonez-Funez used software to "spoof” the calling number, so it appeared on caller identification as if the call was coming from the credit union's main telephone line. Ordonez-Funez then informed the victims that their accounts had been compromised, and asked them to verify their PIN and CVV code on the back of their card, the report states. In most cases, victims reported that the caller knew their Social Security number, date of birth and the expiration date of their card, though the complaint does not explain how Ordonez-Funez gained possession of that information.

In total, 14 victims suffered a combined loss of $6,835.33, with another $6,664.37 in attempted thefts from their accounts. Ordonez-Funez was arraigned by Magisterial District Judge Ed Levine on Sept. 27, and remanded to the Montgomery County Correctional Facility in lieu of $100,000 cash bail. His preliminary hearing is scheduled for Oct. 5 at 9 a.m.

A Multi-Jurisdiction Investigation

The arrest of Ordonez-Funez comes as a result of a joint investigation between police departments from Upper Gwynedd Township, Towamencin Township and Lansdale Borough, along with help from district loss prevention personnel from CVS Pharmacy.

According to the criminal complaint, the identity thefts began locally in early September, with nearly every incident occurring at a CVS Pharmacy in the North Penn area. The suspicious activity prompted CVS loss prevention personnel to notify staff to pay attention to unusual ATM usage and the purchasing of Visa gift cards in high-dollar amounts.

Then, on Sept. 7 at 2 p.m., Lansdale Police received a call from the Merck credit union, located along the 300 block of South Broad Street, stating that multiple members had received the "spoofed” calls claiming that their accounts had been compromised. For those who gave their information, fraudulent charges began to appear on their accounts only minutes later. Police were also given surveillance footage from the credit union’s ATM, which showed a Hispanic male.

Later that evening, members of the Towamencin Township and Hatfield Township police departments were dispatched to the CVS at Ralph’s Corner, located along the 2300 block of Welsh Road in Hatfield Township, for a report of suspicious activity around its ATM. The manager reported that a pair of men had been seen allegedly making numerous withdraws from the machine, and they matched the description given by an employee at another CVS location, who claimed they had done the same there. Upon arrival, police encountered the two men in a vehicle bearing a temporary Georgia license plate, and took them into custody.

The following day, members of the Upper Gwynedd and Lansdale police departments were notified of the arrest, and using surveillance footage from the credit union, were able to identify the passenger as Ordonez-Funez. The driver was identified but not charged.

On Sept. 11, Towamencin Township Police executed a search warrant on the vehicle, during which they allegedly discovered $17,671 in cash, four Vanilla Visa Gift Cards, clothing that matched what Ordonez-Funez wore in surveillance footage, and a Bluetooth magnetic card reader and writer, which is used to encode data onto blank cards.

In addition to the 14 victims, another seven filed reports with area police departments regarding the spoofed phone calls, but they did not surrender any personal information.

(Editor's note: All suspects and defendants are innocent until proven guilty. Should the defendant choose to issue a public statement, or is later found not guilty or has the charges dropped, we will update this article accordingly.)