A Tennessee law enforcer dismantled a $4 million international fraud scheme targeting America’s elderly and poor with three low-tech tools: an undercover operative, a snitch and a trap.

FBI Cyber Task Force Officer James Knipper’s work in securing indictments in a massive nationwide fraud plot between business people in India and the U.S. is detailed in recently unsealed U.S. District Court records reviewed by Knox News.

Federal prosecutors accuse Ankur Khemani of India of conspiring with American business colleagues to defraud the elderly and poor by offering bogus tech support services.

Named as conspirators in defrauding thousands of U.S. citizens, including dozens in Tennessee, of at least $4 million in five years are: Gaurav Bhasin of Maryland; Marilyn Sterk of Iowa; and Sterk’s daughter and daughter-in-law, respectively, Teresa Sterk Vanbaale and Jennifer Sterk of Iowa.

The alleged scheme is commonplace in the internet age: using pop-up ads and fake computer security crises to con people into paying for services they didn’t need. But this particular scheme might well have gone unnoticed, court records show, if not for Knipper, then a newbie to the Knoxville FBI task force.

Investigative shoe leather

“I have identified thousands of victims across the United States, including approximately 55 in Tennessee,” Knipper wrote in a then-secret complaint in January. “I have personally interviewed 29 of those victims in the Eastern District of Tennessee, 26 of whom are over the age of 60 and on fixed incomes.

“Victims all report a similar story. They spoke to persons with what sounded like Indian accents, yet gave Anglo names. These technicians often told victims that their computers were being ‘hacked’ from various overseas locations.”

“In every case, victims reported that they were persuaded to allow technicians to remotely access their computers,” Knipper wrote.

Knipper took a job with the Tennessee Department of Safety and Homeland Security in 2012. Four years later, he was tapped to join the FBI’s joint cyber task force.

He soon noticed a troubling trend when he scrolled the task force database: The same three firms — Azure Support, M&A Tech and Toler Tech — were at the center of thousands of complaints across the country.

Undercover cyber operative

“The first complaint was registered on July 5, 2014,” Knipper wrote. “Consumers from all over the United States, including in the Eastern District of Tennessee, have filed complaints.”

In September 2017, Knipper recruited an undercover operative and gave the person a computer free of viruses and working properly to run an online search for tech support. Azure Support quickly offered help and seized remote control of the computer, the agent wrote.

Knipper took a series of screenshots as the undercover operative played along with the support technician’s directions and explanations.

The agent wrote in his complaint the technician repeatedly lied about security threats to the computer and ultimately charged the undercover operative more than $400.

Armed with that evidence, Knipper tracked down and targeted an American conspirator, Butler Foster, who owned a marketing firm.

Pressed by the agent, Foster admitted he set up a half dozen “fictitious businesses” for a man he met in Las Vegas at a tech conference in early 2017, the complaint stated.

That man, Foster told the agent, was Khemani.

“He was directed by Khemani to wire money from the fictitious company bank accounts to India-based entities,” Knipper wrote.

And, Foster told Knipper, he was set to meet Khemani at the same Las Vegas conference in early 2020.

Laying a trap

Knipper soon confirmed Khemani’s arrival in the United States through a U.S. Customers and Border Protection alert Jan. 23, the complaint stated, and tracked him to the MGM Grand Hotel in Las Vegas, where Khemani was attending a business summit.

Knipper immediately sought a federal warrant from U.S. Magistrate Bruce Guyton, records show.

“Based on my investigation, it is apparent that Khemani is traveling to Las Vegas in an attempt to recruit U.S.-based individuals to perpetuate tech support fraud schemes,” Knipper wrote in that warrant.

Khemani was arrested as he left the Las Vegas hotel. Guyton last week ordered Khemani jailed pending trial. His alleged co-conspirators were also arrested but are free under various travel restrictions. A trial has tentatively been set in May.

Email Jamie Satterfield at jamie.satterfield@knoxnews.com and follow her on Twitter @jamiescoop. If you enjoy Jamie’s coverage, support strong local journalism by subscribing for full access to all our content on every platform.



Please enter your comment!
Please enter your name here