Sentenced — Telecommunications Fraud — Crown Outline

Charge:  Possession of Cloned Telecommunications Device, Criminal Code, s. 327(1)

Crown Outline of the Conspiracy:   Jack Z. and Jerry Z. were members of a conspiracy to defraud legitimate telecommunication service providers. There were at least seven others involved in the conspiracy. It extended over twelve months and was committed in Metropolitan Toronto, Hamilton, and Fort Erie, Ontario; and in Florida, and Arizona, in the United States of America. The object of the conspiracy was to sell long-distance telephone service without payment by dishonestly obtaining access to the world wide telecommunications network. As a result of this agreement, legitimate telecommunication service providers were defrauded of at least $750,000.

Every cellular phone has an electronic serial number (ESN) programmed (by its manufacturer) into its secure memory. When the phone is purchased by a customer, the cellular telephone service provider, (for example, Cantel), assigns an area code and telephone number (MIN) which is programmed into the telephone by the sales agent at the retail outlet. This creates a MIN/ESN combination, which is unique to that phone. The MIN/ESN combination is emitted by the cellular telephone when turned on. It identifies the particular cellular phone to the cellular telecommunications network, enabling the cellular service providers to bill the customers for air-time used.

In furtherance of the conspiracy, one or more of the co-conspirators stole the MIN/ESN combinations of cellular phones belonging to legitimate customers living in Ontario and in the United States by reading them off the airwaves through use of a machine, purchased in the United States, known as a Curtis ESN reader.

In furtherance of the conspiracy, one or more of the co-conspirators then used computer software to fraudulently program cellular phones with the stolen MIN/ESN combinations. This process created a "clone phone," that is, a cellular telephone altered electronically to emit the same information over the airwaves as a legitimate customer's phone. Local cellular carrier equipment would read this signal as a call made by the legitimate customer, and would therefore permit the call to go through to its destination. In this way, access to the worldwide telecommunication service network was fraudulently obtained.

In furtherance of the conspiracy, the co-conspirators advertised discount long-distance telephone service in newspapers and via business cards. Customers were instructed to call a pager number or an ordinary "wireline" number to make an appointment to place a long-distance telephone call. At the appointed time, one of the co-conspirators would call the customer back using a cloned cell phone. Once the customer was on the phone, the co-conspirator would use the three-way calling function to dial the long-distance number desired by the customer (typically in South America, the Middle East, or Asia), and then connect that destination with the customer. Some of the cloned telephones used by the co-conspirators did not have the three-way calling function. In that case, the customer was called by the co-conspirator on a wireline phone, the person the customer wished to talk to was called using the cloned cellular telephone, and the cellular phone was taped to the handset of the wireline phone.

Customers were billed $20 for each 30-minute call, or $22 if one of the co-conspirators was required to pick-up the payment. Some customers paid by depositing the required fee into bank accounts controlled by co-conspirators, some left the payment in a mail box rented by a co-conspirator, and, in some cases, one of the co-conspirators visited the customer to pick-up the payment.

Upon execution of search warrants in Hamilton, Fort Erie, Phoenix, Arizona, West Palm Beach, Florida, and several locations in Toronto, the co-conspirators were found in possession of stolen calling cards, stolen ESN/MINs, computers, accessories and software used to fraudulently reprogram cellular telephones, reprogramming instructions, fraudulently reprogrammed cellular phones (clone phones), records of customers' call appointments, debt lists, customers' cheques, and/or banking records showing deposits from customers. At several search warrant locations, calls from customers wanting to book appointments were answered by police officers.

The co-conspirators used MIN/ESNs belonging to American subscribers in Canada in order to decrease the likelihood that their fraud would be detected. Local carriers do not monitor unusual usage patterns on visiting (roaming) cell phones as closely as they monitor the use of MIN/ESNs belonging to their own customers, as the visitor's carrier is primarily responsible for the costs of calls made by their customers visiting other networks. A roaming clone can also be used for a longer time than a clone with a local MIN/ESN because the local carrier has to check with the visitor's carrier to be sure that the customer is not actually visiting the local area before it can shut the phone down.

When a MIN/ESN combination belonging to a legitimate customer is cloned, the customer ultimately receives a bill for the time used by the cloned telephone. When the customer objects to payment on the basis that he or she did not make the calls, the cellular carrier does not hold the customer responsible. The result is that the cellular carrier is not paid for the airtime used by the clone, and, therefore, experiences a loss. The loss is greater if, because of the route of the call, the carrier is required to pay a third-party vendor or long-distance carrier, such as Teleglobe, Sprint, or AT&T. As a result of the conspiracy, the cellular carriers whose ESN/MINs were cloned and fraudulently used by the co-conspirators experienced a combined loss of at least $750,000.