Volodymyr Kvashuk, a former Microsoft engineer from Ukraine, is facing 9 years in prison for attempting to steal $10 million from his employer. He has been ordered to pay over $8 million in restitution fees, and may even face deportation after his prison term is complete.
Here’s how it all went down:
Kvashuk’s position as a program tester for the Microsoft Online store gave him access to a “whitelisted” store account, which automatically bypassed fraud detection protocols, to test store functionality. Purchases through whitelisted accounts were supposed to be void, but Kvashuk discovered that he was able to use the account to purchase legitimate store gift cards.
At first, he only used the credit to make small unauthorized purchases, like software and graphics cards. But nobody seemed to notice, because the purchases were linked to fake payment devices, and so Kvashuk got bolder.
He went on to make larger and larger transactions, selling his stolen Microsoft store credit for bitcoin online and spending the money on a new house and car.
As the stakes escalated, he eventually started taking more measures to conceal his tracks- like sending his largest sums through a “mixing” service to conceal their origins before he deposited them into his proper bank account. The funds were even properly reported to the IRS, but he claimed they were a gift from his dad.
Yet Kvashuk made a few damning mistakes that allowed investigators to track him down.
Most egregiously, despite being wise enough to use a VPN for this activity, he regularly reused the same connection (and therefore the same IP address). This acted like a trail of breadcrumbs that linked his known accounts and the ones directly involved with his scheme.
Investigators also highlighted the uncanny timing of the transactions in question, stating “The value of the bitcoin deposits to Kvashuk’s Coinbase account generally correlated with the value of the purchased and redeemed [Microsoft credit].”
“Stealing from your employer is bad enough,” US Attorney Brian Moran stated, “but stealing and making it appear that your colleagues are to blame widens the damage beyond dollars and cents.”
In the end, Krashuk got justice. He was found guilty of “five counts of wire fraud, six counts of money laundering, two counts of aggravated identity theft, two counts of filing false tax returns, and one count each of mail fraud, access device fraud, and access to a protected computer in furtherance of fraud,” according to court documents.
That’s quite the laundry list of offenses, but it can all be boiled down to a few simple words: “You really messed up, man.”
