Socially Engineered Reward Points With Chirag Patel – Act 3: Spyware Detected!

Join us to hear the story of Chirag Patel, a former Choice Hotels employee who socially engineered reward points and credit card numbers from several of their franchised hotels. This is eCrimeBytes.com S 2 Ep 8-3 – Socially Engineered Reward Points With Chirag Patel – Act 3: Spyware Detected!

For the background, please check out the prior acts:

Socially Engineered Reward Points With Chirag Patel – Act 1: Drugs And Spyware

Socially Engineered Reward Points With Chirag Patel – Act 2: The Hack

Sources:

• https://www.justice.gov/usao-az/pr/hacker-sentenced-51-months-prison-stealing-customer-credit-card-numbers
• https://www.courtlistener.com/docket/63158296/united-states-v-patel/ 
• https://www.12news.com/article/news/crime/hacker-sentenced-stealing-hundreds-credit-card-numbers-arizona/75-81cac896-cb60-4923-83eb-d9af670475bd 

Transcript:

00:00:10:00 – 00:00:15:28
Keith
Hey, welcome back to eCrimeBytes. This is season two episode eight.

00:00:16:00 – 00:00:43:25
Keith
This is Chirag Patel, his socially engineered reward points and up until this point in Acts one and two we gave you some background and then we talked a little bit about how the hack worked, which was socially engineering or basically tricking a hotel employee to install software on their laptop or I guess the hotel sense it would be a desktop computer behind the desk that a general manager would typically log into.

00:00:43:28 – 00:01:08:28
Keith
And by doing that, they had general manager usernames and passwords for very important systems like the reward point systems and the ecommerce system. So they’re able to pull credit card numbers and they’re able to transfer these reward points, which even though they’re virtual and they’re points, they do have a monetary value to the victim company of choice hotels.

00:01:08:28 – 00:01:12:26
Keith
So we’re at the point where choice hotels in

00:01:12:26 – 00:01:20:27
Keith
June 2020 they said, holy shit, we’ve got some kind of spyware on our terminal here.

00:01:20:29 – 00:01:52:21
Keith
And specifically they found that Spyrix personal monitoring logging software. This was the one that Seth talked about in Act One that had not only the commercial views on their website of what their the product will do for you, but then have this sort of pseudo legalese section of telling you why it’s okay to use Spyrix in all your monitoring needs, because in most cases they say it’s okay to monitor which, hey, we’re not telling you this is we’re just reporting what their website says.

00:01:52:24 – 00:01:58:23
Keith
I don’t think either one of us agree with pretty much anything that they said either there, but that’s what they said. So

00:01:58:23 – 00:02:05:21
Keith
this I don’t believe we’ve have we talked about I got juice man six at.

00:02:05:23 – 00:02:09:09
Seth
We have eight. We got eight, not six.

00:02:09:11 – 00:02:34:08
Keith
Okay, So we got a new email address. I got juice man six at gmail dot com was associated with a Spyrix personal monitoring logging software that we talked about previously that was eventually detected at Choice Hotels in June of 2020. So this is a pretty new relevant new case.

00:02:34:08 – 00:03:01:25
Seth
So now we move to October 18 through June of 2020, and this is about hotel reservations. So the court documents tell us that between October 2019 and June 2020, Patel made at least 20 different hotel reservations with stolen rewards points, as well as fraudulent customer rewards accounts associated with various email addresses he use, including cptrance, Gas man, boss Gas man, CEO

00:03:01:25 – 00:03:06:09
Seth
Thomas Edwin Brooks and Thomas Brooks 99.

00:03:06:11 – 00:03:08:10
Seth
I wonder if Thomas Brooks is kind of like a,

00:03:08:10 – 00:03:11:17
Seth
you know, Mr. Underwood from the Fletch movies. But anyway,

00:03:11:17 – 00:03:31:16
Seth
Between July 2018 and 2019, December 2019, Patel attempted at least 20 purchases that were declined because he used stolen credit card numbers, as reflected in emails associated with Gas Man Boss. This is another one. Big Arab Juice two or big Arabs.

00:03:31:16 – 00:03:49:09
Seth
Juice too. That’s a good one. Bomb in the bush. I got juice. Man six Juice world. Three I’m aware that my son’s like a rapper named Juice World and Gas Man CEO So between approximately August 2019 and June of 2020, Patel added more than 20 different

00:03:49:09 – 00:03:56:02
Seth
credit card numbers to his Google Pay account associated with gas man boss at gmail.com.

00:03:56:04 – 00:04:18:24
Seth
So again, I think I need like a different ledger to keep track of all the different stolen points and accounts and different credit cards and different email addresses associated with. But keep I guess the point we’re making here to the listeners is it was an extremely complicated web of of of emails and credit cards and accounts.

00:04:18:24 – 00:04:20:04
Keith
And reward accounts.

00:04:20:07 – 00:04:20:27
Seth
And we already have.

00:04:20:27 – 00:04:49:19
Keith
So there’s a chart in this documentation that kind of summed up some of his purchases. And this is where we start to get the funnier notes. So we got one and this is where they sum up the purchases. They also put the legal counts, the legal charges against him for each row. So when I’m reading these things to you, it also comes with a count which is not good for Mr. Patel legally.

00:04:49:21 – 00:05:10:01
Keith
So count two was him using the gas man boss at gmail dot com ordering food delivery to Phenix Sky Harbor Airport in the amount of $121 using a stolen credit card number. And to me when I read that, I was like, okay, I think he’s probably testing if he can get away with this because it’s not a huge amount of money.

00:05:10:07 – 00:05:26:02
Keith
And he said somewhere very public Court three says he attempted to purchase a Southwest Airlines plane ticket in the amount of $635 using a stolen credit card number. And I thought, holy crap, if that’s

00:05:26:02 – 00:05:43:15
Keith
if it’s to himself, like you have to put a real person on a Southwest plane ticket. Right. So at some point, somebody is going to get caught with that particular purchase was when I saw that in the paperwork, I was like, whoever flies is ended up they’re going to get caught, count four

00:05:43:15 – 00:05:47:08
Keith
was back to doing the hotel reservation.

00:05:47:08 – 00:05:54:19
Keith
And this is in Jessup, Maryland, which is actually not that far from me using fraudulent rewards accounts ending in such and such a number,

00:05:54:19 – 00:06:15:13
Keith
the notes of the reservation said, Please allow Chirag Patel to check in. Yeah, all right. Kind of vanilla. And I thought that a probably the most direct, ingenious way he could probably get benefit from his crime is to stay in some swanky hotels for free on other people’s reward points.

00:06:15:13 – 00:06:31:26
Keith
Right? But he’s got to he’s got to do it by using somebody else’s name on the reservation because the rewards points is, you know, either on a fake person or a victim or something. But he must stay there. So he’s got to check in. So he’s got to put his real name on it again,

00:06:31:26 – 00:06:37:12
Keith
for law enforcement, that is a great place to catch somebody just like the plane ticket earlier.

00:06:37:12 – 00:07:01:29
Keith
Okay. So a lot of these other ones, I’m now just going to kind of give you the relevant points. I’ve given the the whole lay of the land here. So count five is in October 15th of 2019. Gas man boss, which is Patel, now made a reservation. The notes in this one says Chirag Patel is checked in this room per Eric and Eric being, you know, the fake name that he’s using for this reservation.

00:07:02:01 – 00:07:11:18
Keith
So I’m thinking like he must be. I think he’s probably getting some pushback or may not be able to check into these places because you’re going to see his notes get a lot more specific about who can check in.

00:07:11:18 – 00:07:31:17
Keith
And so count six, which is only seven days later made another reservation. And this one, he must’ve been fucking pissed because this is all caps and the notes say please allow Chirag Patel to check in per Eric and Eric’s last name, which is maybe a victim.

00:07:31:17 – 00:08:01:26
Keith
So I’m not going to say it. He continues screaming. Note. Guest as lost I.D.. Please allow guests to show a copy or something with his name on it. Thanks. And that is the whole note on the reservation. And this is where I go. Chirag must be having some issues checking into his other reservations because now he sounds pissed and he’s very specific about who should be checking in for Eric’s room. Counts seven moves on.

00:08:01:26 – 00:08:23:17
Keith
This one is very vanilla, he says. Chirag Patel will be checking in for Jeffrey Jackson. Count 8. It’s another hotel says, Please allow Mr. Chirag Patel to check in showing his itinerary or something with his name on it. And I got to think Holy shit, could you imagine actually checking in if this is real and wasn’t a scam? Could you imagine actually being able to go up to a hotel and going, Oh,

00:08:23:17 – 00:08:28:06
Keith
I have this printout of just something random with my name on it.

00:08:28:09 – 00:08:44:17
Keith
Please allow me to check into this room. It’s just mind boggling. So Count nine was another hotel. It says, Please allow Chirag Patel to check in for Eric and he seems to be using the same name over and over here. So I think he’s probably using the same account.

00:08:44:17 – 00:08:49:19
Keith
Count ten was another hotel. This is now in November of 2019.

00:08:49:19 – 00:09:15:03
Keith
And the note on this one says Chirag Patel will be the guest checking in for Eric and his last name so that even like Chirag is using the hotel and Eric’s letting them know he’s just the guest of Eric and Count 11 is a few days later. Two days later. Gas man boss, he changes his note. Now a Chirag Patel is a guest checking in.

00:09:15:05 – 00:09:21:20
Keith
Please allow him to check in as requested by CRS. Guest can show a copy of his I.D..

00:09:21:20 – 00:09:34:01
Keith
And the last count, which is count 12, is gas man boss. And he just simply says on this note room is booked for Chirag Patel. It just sounds like he gave up at this point.

00:09:34:04 – 00:09:37:26
Seth
And I would think, no, this point is.

00:09:37:28 – 00:10:02:17
Keith
So I just, I just gave you a whole shit ton of information. Listener I told you about 12 counts that Chirag Patel is being charged with, and I told you all the notes that he included on those hotel reservations, which in my opinion was kind of humorous of his attempts and finally just giving up on it. And that brings us to the end of Act three, because in Act four, we have his arrest and sentencing.

00:10:02:17 – 00:10:15:08
Keith
You knew there was going to be one because we had 12 counts that I just read to you. So if there’s anything in these first three acts that you like, please like it subscribe or whatever application you’re listening. And we try to be as

00:10:15:08 – 00:10:24:20
Keith
platform independent as possible so you can watch us on social media platforms or YouTube or even just listen to us on audio only podcasting apps.

00:10:24:22 – 00:10:49:17
Keith
And if you’re over there, especially if you’re on Apple Podcasts, if you give us a five star review and just in the description, just tell us what episode you like the best that would help us move up the charts and find listeners that never knew about us, find us. And lastly, if you can reshare however you’re watching us, if you can reshare with your friends that you might think like true crime podcasts, that have a little bit of humor added to it.

00:10:49:19 – 00:11:08:20
Keith
We would appreciate that so much because we’re not going to go out there and buy ads and bombard people with it. We’re just going to try to grow organically with the research that we bring every week. And with that we’re going to finish act three and we’re going to bring it at four, which is the concluding act, and that’s arrests and sentencing.