Thief used burner iPhones and Apple Pay to purchase luxury goods, Bitcoin, and diamond-encrusted jewelry

Using stolen credit cards and Apple Pay, one identity thief was able to purchase more than $600,000 in luxury goods and nearly $100,000 of Bitcoin.

After purchasing more than 500 stolen credit-card numbers from the dark web, Atlanta resident Aaron Laws found himself at the center of an elaborate scheme that would land him in federal prison for three years.

Laws entered the stolen credit card numbers into burner phones equipped with Apple Pay, allowing him to make purchases without presenting a physical card. According to MarketWatch, Laws also enlisted several co-conspirators, including his childhood friends, Dennison Ellis and Jeffrey Mayfield.

Between February 2017 and December 2018, Laws and his co-conspirators purchased more than $600,000 in luxury goods, including MacBooks, iPhones, a $35,000 Rolex watch, and a diamond-encrusted medallion shaped like a Bitcoin symbol. They targeted several locations, including the Apple Store and Best Buy, as well as jewelry stores across eight states.

Laws' diamond-encrusted Bitcoin medallion | Source: U.S. Attorney's Office

On August 23, 2017, Laws purchased $93,000 worth of Bitcoin. At the time, Bitcoin was worth around $4000 per Bitcoin. In today's market, Laws' purchase would be worth nearly $745,000, assuming a price of $32,000 per Bitcoin.

Laws pleaded guilty, noting that he had "clearly made many poor decisions in this case." Laws struggled with depression and substance abuse after a knee injury prevented him from playing college basketball.

Laws was sentenced to three years in federal prison and ordered to pay $624,000 in restitution.

Laws' co-conspirators, Ellis and Mayfield, also pleaded guilty. Ellis was sentenced to six months in prison and ordered to pay $283,000 in restitution. Mayfield also was sentenced to jail time and ordered to pay $181,000.

Recently, a rash of iPhone thefts in Brazil served as yet another cautionary tale for users who store passwords in an unsecured location on their device.

Keep up with everything Apple in the weekly AppleInsider Podcast — and get a fast news update from AppleInsider Daily. Just say, "Hey, Siri," to your HomePod mini and ask for these podcasts, and our latest HomeKit Insider episode too.

If you want an ad-free main AppleInsider Podcast experience, you can support the AppleInsider podcast by subscribing for $5 per month through Apple's Podcasts app, or via Patreon if you prefer any other podcast player.

Latest Exclusives

Latest comparisons

12 Comments

crowley 10431 comments · 15 Years

About 3 years ago

I can't remember from when I set up Apple Pay, it was a long time ago, but surely you need more than just the credit card number?

Rayz2016 6957 comments · 8 Years

crowley said:

I can't remember from when I set up Apple Pay, it was a long time ago, but surely you need more than just the credit card number?

You set up the phone and the bank confirms usually through SMS.

It could be that an extra check is needed: the mobile phone that the SMS is being sent to has the same number your bank keeps on file

lkrupp 10521 comments · 19 Years

Three years in prison is just a slap on the wrist. He’ll be out in 18 months and free to continue his work. Crime does pay after all. And how will the government make these perps pay the restitution they were ordered to pay?

Xed 2874 comments · 4 Years

Rayz2016 said:

crowley said:

I can't remember from when I set up Apple Pay, it was a long time ago, but surely you need more than just the credit card number?

You set up the phone and the bank confirms usually through SMS.
It could be that an extra check is needed: the mobile phone that the SMS is being sent to has the same number your bank keeps on file

That's the main reason I don't like SMS for 2FA. Spoofing a phone number isn't that hard for the motivated individual..

lkrupp said:

Three years in prison is just a slap on the wrist. He’ll be out in 18 months and free to continue his work. Crime does pay after all. And how will the government make these perps pay the restitution they were ordered to pay?

I agree. He's a nonviolent offender, but this sentence seems far too light.

Xed said:

Rayz2016 said:

crowley said:

I can't remember from when I set up Apple Pay, it was a long time ago, but surely you need more than just the credit card number?

You set up the phone and the bank confirms usually through SMS.
It could be that an extra check is needed: the mobile phone that the SMS is being sent to has the same number your bank keeps on file

That's the main reason I don't like SMS for 2FA. Spoofing a phone number isn't that hard for the motivated individual..

Seems to me that there’s some kind of biometric check missing here. It contacts the card issuer, the card issuer sends back a request for recognition, the phone responds with “yeah, that’s him.”

But there still needs to be some proof it’s you at the bank’s end.