Employing a fairly elaborate process and apparently enabled by access to personal employee information, an individual has been indicted on charges that he fraudulently siphoned hundreds of thousands of dollars from Boeing employees’ retirement accounts.
A federal grand jury has charged Hoa Vo, 30, (he has aliases that include “Hoa Thanh Tran Vo” and “Andy Vo”) of Santa Ana, CA with three counts of bank fraud and one count of aggravated identity theft.
According to the indictment, from January 2019 to June 2019, Vo obtained the personal identifying information of Boeing employees (how isn’t disclosed), along with information about their retirement accounts. He then allegedly made fraudulent withdrawal requests for checks and electronic money transfers totaling hundreds of thousands of dollars from the retirement accounts of various Boeing employees.
Elaborate Process
He did so through a fairly elaborate process; according to a press release from the U.S. Attorney’s Office of the Central District of California, knowing that notifications and checks related to these fraudulent requests would be mailed out, Vo placed holds on the Boeing employees’ mail with the U.S. Postal Service. Once the mail was held, Vo allegedly intercepted it by presenting to a postal employee a fraudulent California driver’s license with a Boeing employee’s personal identifying information, and a fraudulent note purportedly written or signed by the Boeing employee authorizing Vo to pick up the employee’s mail.
Vo then allegedly deposited the stolen checks into a bank account that had been fraudulently opened in a Boeing employee’s name, cashed checks written to himself from the fraudulently opened bank account (by using the Boeing employee’s forged signature), and endorsed the checks himself, according to the indictment.
In total, Vo attempted to obtain approximately $783,328 from Boeing employees’ retirement accounts—though he “only” actually obtained approximately $360,847.
If convicted of all charges, Vo would face a statutory maximum sentence of 92 years in federal prison.
This matter was investigated by the U.S. Secret Service, the Huntington Beach Police Department, the Irvine Police Department and the Westminster Police Department.
As has been the case in other recent instances, the theft was apparently enabled by access to personal information regarding the individuals in question, which led to access to their account (or the process that did so). Most recently it has resulted in litigation against both the plan sponsor and recordkeeper (see Plan Sponsor, RK Sued for Fiduciary Breach in 401(k) Account Hack and Recordkeeper, Plan Sponsor Charged in 401(k) Account Theft). While there certainly have been growing concerns about cybersecurity risks, there also have been recent cases where individuals within the sponsoring employer and others in which TPA or recordkeeping staff have taken advantage of their access to misappropriate funds.
