Project Red Hook: Chinese Gift Card Fraud at Scale

Project Red Hook is a Homeland Security Investigations operation examining how Chinese Organized Crime is committing wholesale Gift Card Fraud by using Chinese illegal immigrants to steal gift cards, reveal their PIN, reseal the cards, and return them to store racks.  When the card is later purchased and activated, operators are standing by to quickly drain the card before the customer can use it. How many cards are we talking about?  More than $1 Billion worth! 

Here are a few cases of interest to me - especially the first one! 

Birmingham, Alabama 

https://www.justice.gov/usao-ndal/pr/chinese-nationals-charged-illegally-possessing-counterfeit-and-unauthorized-gift-cards

25JUN2025 - the Hoover Alabama Police Department put out a BOLO for two Asian males in a gray Lexus SUV with California tag DE53Y62 who were switching gift cards in racks at local CVS stores.  Jiadong Cao, 36, and Xuejun Zheng, 48, were stopped and arrested the following day in Pelham, Alabama and found to possess more than 5,000 gift cards.  Portions of the gift card numbers had been destroyed on the cards, which would allow the cards to be activated at the register, but not used by the customer who purchased them. 300 altered cards for Home Depot, Amazon, Sephora, Macy's and Nike were found in their car.  Home Depot reviewed their cards and confirmed they had not been sold.

The Federal criminal complaint was written up by a former student of mine!  USSS Special Agent Scott Easterwood! Jiadong Cao is a Chinese citizen who entered the US in September 2024 and is illegally in the country now.  Xuejun Zheng also entered the US in September and has filed for asylum in the US. In the CVS store that started this investigation, they had added altered gift cards to the rack, including six Nike cards, ten Macy's cards, and nine Best Buy cards. 

Louisville, Kentucky

https://www.wlky.com/article/men-arrested-gift-card-scam-louisville-millions-lost/62673181

19OCT2024 - Kroger security personnel observed Chaoming Lin placing gift cards back on a rack at a store on North Hubbards Lane. He was stopped shortly thereafter by St. Matthews Police, who found him in the car with Zhiqiang Huang.  Around 5,000 gift cards were found in a search of the vehicle, with at least 2,000 appearing to have been altered. That same day, Kroger loss prevention reported another instance and that an Asian man was seen leaving in a black Dodge Charger.  That car was also stopped with Tianlong Chen and Huixing Yu in the car with several cell phones and 658 gift cards in the car.   These four had hit stores in Ohio, Pennsylvania, and New York before being arrested in Kentucky. 

St. Matthew's Police chief Barry Wilkerson said the gift cards they recovered were worth at least $1 million. Tianlong Chen entered a guilty plea on 11JUL2025 and will remain in custody until sentencing on 16OCT2025. 

Gainesville, Florida

https://www.documentcloud.org/documents/24536188-gainesville-case-detailed-arrest-report/

24AUG2024 - The Alachua County Sheriff's office pulled over a Hertz rental vehicle being driven by Cheng Li, 25, with female passenger Jiaxin Jiang, 24.   The car was rented by Jiang despite him only possessing a New York Learner's permit.  After a narcotics K-9 hit on the car, the car was searched and found to contain 1,764 gift cards from Apple, Target, Visa, Mastercard, and American Express.  A GPS review provided by Hertz confirmed that the pair had left Long Island, New York, stopping at two Target stores in Laurel, Virginia, ten Target stores in the Duluth/Atlanta Georgia area, two Target stores in Knoxville, Tennessee, and a Target store in Johnson City, North Carolina before being arrested after a stop at the Target store in Gainesville, Florida.  Their mapping software indicated they were headed to a Target store in Ocala, Florida next. 

A review of Cheng's cell phones (after a search warrant) revealed that he had been involved in "Target fraud" chats on WeChat since as far back as December 2022. Ledgers on Jiang's computer showed they had been collecting gift card numbers and their associated PINs going back as far as 09AUG2022. WeChat groups retrieved by the phone show groups with as many as 1558 messages and 257 photos with some groups having as many as eleven members who all seemed involved in the same types of activities. 

The Chinese language website "https://www.uscardforum.com/t/topic/321165" shared a Chinese version of the traffic stop, complete with opening the trunk and finding the cards! 

The couple tell the police they are in Florida because they wanted to see a crocodile! 

 (Watch on YouTube here: https://www.youtube.com/watch?v=YChGKg2KrDo - jump to 16:40 for the "trunk reveal." ) 

Ventura, California

15MAY2024 - Ventura County detectives are part of the Ventura County Organized Retail Theft Task Force (VCORTTF).  They were operating a "blitz" against organized retail crime, deploying detectives in coordination with loss prevention specialists in retail stores. when they arrested Tingxiang Yang, 39, and Lingyu Chen, 35.  They were in possession of 800 gift cards stolen from a Moorpark Target store. They were released after posting $20,000 bail. 

Ocala, Florida

 https://www.ice.gov/news/releases/chinese-national-pleads-guilty-gift-card-fraud-scheme

17OCT2023 - a police officer in Ocala, Florida arrested Donghui Liao, age 32.  Liao was observed taking gift cards from his black shoulder back and placing those gift cards on a gift card display in a Target store. Seventy-one cards on the rack were found to have been altered.  The cards had been shop-lifted, scratched to reveal their PIN, "re-silvered" so that they did not appear to have been scratched, and then returned to card racks in stores.  Liao was found to be on surveillance camera imagery at stores in Ohio, Georgia, North Carolina, and Florida. 

When police searched his car, they found 6,032 additional gift cards with a face value of $1,886,000! 

Donghui was sentenced to 33 months in prison with 3 years supervised release to follow. 

Target Database Breach "Phishing" Email leads to . . .

Several folks that also do security research called and texted and Facebook messaged today asking if we had seen "the New Target Phishing email"? We're normally pretty good folks to ask about that sort of thing, since Malcovery Security has both a Spam Data Mine, which is often a good source for such messages, and our PhishIQ system. I thought if it existed to the point that there was "buzz" about it, I should have hundreds of copies. But I didn't. I had three. Kinda.

Here's what the emails actually looked like.

I'll tell you what it does in just a minute.

By the way, if you find phishing sites and aren't sure what to do with them, we LOVE collecting phish! Use Malcovery's PhishIQ Report Phish page to send us any links!

Target Gift Card Spam

When I ran my search, I found all of the "normal" Target spam. People love to use Target to convince people to give up their personal contact information through the "Impossible to get Gift Card" scam.

We've blogged about Gift Card spam and related malware on several occasions including:

• Cyber Monday 2010 - when we warned about scams using Victoria Secrets and Oliver Garden gift cards. In that scam you have to complete a series of "tasks" in order to earn your gift card, after going through several steps where you think you have "won" something. The final tasks back then were things like "Stay three nights in a Red Horse Inn hotel's luxury suite" or "buy a new car from General Motors!" but LONG before you found out about those tasks, the criminals already had your email, home address, cell phone number, and your agreement to let them share that data with other marketing firms.

• A Day in the Life of Spam (2009) - in that blog I tried to fully categorize 10,583 spam messages received on October 4, 2009. 28 of the emails were "Giveaway gotchas" -- gift cards, plane tickets, cell phones, laptops that you had "won" if you would just perform some tasks.

• We also told you about the Member Source Media LLC case where the FTC fined Chris Sommer $200,000 for running his spam scam where he sent email for "Free Products that Weren't Free".

So, today, I wasn't surprised to see spam with subjects and senders like these:

Share Your Opinion. Do you Love Target	Shopping Opinion	ShoppingOpinion@ramblerose.info
Share Your Opinion. Do you Love Target	Target Shopping Survey	TargetShoppingSurvey@ramblerose.info
Shopped Target Lately	ShoppingOpinion	ShoppingOpinion@ramblerose.info
Special: Snag a $100 Target Gift Card!	SavingCenterUSA	Sours@frigidfiz.com
Complete the Target Shopping Survey	ShoppingOpinion	ShoppingOpinion@ramblerose.info
Chance to Get a $100 Target Reward! Complete Sponsor Offers	SavingCenterUSA	Bakewell@frigidfiz.com
Back to School Savings - get a $100 Target Gift Card	SavingsCenterUSA	Keels@coldfiz.com

Here's what these usually look like (or at least the more high end ones):

Target Phish? Not really ...!

All of those are normal, everyday occurrences. But these caught my eye!

Alert to Target Shoppers - your identity is at risk.

Local Alert

tps0128@yahoo.com

So what happens if you click on the links in the email? Let's find out!

Here's the Fiddler capture of the redirect stream: So, clicking on the link where it says "Has your identity been stolen - CLICK HERE to check the database" or where it says "CHECK TO SEE IF YOUR IDENTITY HAS BEEN STOLEN - CLICK HERE NOW!" takes you through a chain of "automatically redirected" websites:

• www.mb01.com
• www.maxbounty.com
• khvx.secoptim.com
• rewardzone.surveyblogonlne.com

All of those numbers out next to the URLs? Those are the Affiliate Codes and Redirect Codes, so the scammers can make sure to direct you to the correct scam and to make sure the right spammer gets credit for his hard work stealing your time, money, and possibly identity.

and then your "Political Opinion Survey" starts up . . .

The Fine Print

Before we go win our $1000 Shopping Voucher, make sure to read the fine print on that one . . .

rewardzone.surveyblogonlne.com is not sponsored by or affiliated with This Website. This Website has not authored, participated in, or in any way reviewed this advertisement or authorized it. The trial products offered on the last page pay this website for leads generated. *Free trial offers may require shipping and handling. See manufacturer's site for details as terms vary with offers.

You'll also want to pay special attention to

How Do We Use The Personal Information?

How Do We Use The Personal Information?

We may use the Personal Information for any legally permissible purpose in our sole discretion Ad Serving Companies

We may use third party ad networks or ad serving companies to serve advertisements on our websites. We may pass the Personal Information about you to these companies so that they can deliver targeted advertisements that they believe will be of interest to you. The information passed to these companies may include, but is not limited to, your IP address, e-mail address, name, mailing address, telephone number, date of birth, gender, and any other information you provide to us. Web pages that are served by these companies will be subject to their own applicable privacy policies, if any.

Marketing Partners

We may share, license or sell your Personal Information to third parties for various marketing purposes, including their online (e.g., e-mail marketing) and offline (e.g., telemarketing, cell phone text messaging, skip tracing, and direct mail) marketing programs.

That's just part of it, there are many additional things they can do with your data!

Back to the Survey

There was a third question, but you get the idea. I finish question 3, it congratulates me and then sends me to get my reward! Wait? Where is the Target Gift Card? Well, I guess $1,000 shopping voucher at Sears/JCPenney/Kohl's/Macy's will have to do for now. Oh! And there is only ONE remaining! I better snag that!

By our Fiddler trace, you can see that we've just been handed off from one Affiliate marketing program to another. We are leaving the "rewardzone" system, and headed to the "shopping-sweepstakes.com" system, with "t.afftrackr.com" making sure that everyone is going to get paid for their participation in scamming us.

So, here we go ... we said we wanted the $1,000 Sears/Macy's/Kohl's/JCPenney card, so we choose one and start our NEXT survey

After it "calculated my eligibility" it asked me for my email address. I accidentally hit "Back" then and now it is begging me not to go!

Oh goodie! More prizes! Hey? Wasn't I supposed to be getting $1,000 from JCPenney? I just got a big pay cut for all my hard work here. But that's cool, I shop at WalMart too. I'll take $150 Walmart card, I guess . . . Oh. Actually, our Fiddler tells us that we've swapped systems again...We're now on at www.marktflow.com.

But wait! We ALWAYS read the fine print!

Got that? You must complete 2 silver, 2 gold, and 8 platinum offers ... WITHIN ONE CALENDAR DAY! So, it's 6:00 PM for me now, so I have 6 hours to do all the offers, or I get NOTHING.

In case the website goes down later, here's a local copy of some of the "example offers" that you have to finish TODAY!

OK? Let the Privacy Rape Begin!

Here comes the personal information extract . . . first, we're going to need a PHONE NUMBER, EMAIL, BIRTHDATE, and GENDER. Why? Because $150 Walmart Gift Card, that's why!

OK, you get the point. . . I have 13 more questions to go . . . see the Progress Bar? We are SO CLOSE to getting our gift card! Let's skip through the rest of the questions for now, but ask yourself, "what is likely to happen now that I've told these people that I have a house, a car, I'm planning to move, I like to go on vacation, I have a pet, an active checking account, and at least $15,000 in debt, as well as the next 13 questions . . .

• Are you currently employed full time?
• Are you interested in continuing your education?
• Do you have health insurance?
• Do you ever pay out of pocket for prescription drugs?
• Do you smoke?
• Does anyone at your home suffer from Asthma?
• Back Pain?
• Diabetes?
• Joint Pain?
• Sleep Apnea?
• Anxiety or Depression?
• Have you had a colonoscopy?

Remember. This guy has your email address and your telephone number. Whew! At least our 20 questions are done, right?

And then we start getting all the pop-up offers!

Wait! My home address? My birthday? Oh yeah, I forgot...they have to ship me my Gift Card, so of COURSE they need my home address! Duh!

Just in case though, it might be worth noting in Fiddler that we are no longer talking to MarktFlow. Through T.AffTrackr.com (passing along the credit so the right scammers keep getting paid) we are now seeing offers from "www.offersfromqh.com" associated with "www.qualityhealth.com".

FINALLY! All I have to do is confirm my Email Address (I gave them a valid email: privacyrape@gmail.com wonder if it will start getting spam?) and now I will have my card! It says right there this is the Last Step, right?

Not quite. "YOU MUST INSTALL TO CONTINUE?" What am I installing?

My favorite part there, see the part where it says "I want to earn points for searching the web?" Make ShopAtHome.com my Default Search Provider. Make ShopAtHome.com my Default New Tab. (So, every time your browser opens a new tab, you reload the SearchAtHome.com website. How convenient!)

NOW, All I have to do it complete those 2 Silver, 2 Gold and 8 Platinum offers!

So, I have to EITHER buy a set of Santoku Cooking Knives, (which I can return and keep one $100 knife for FREE!) or sign up for CreditReport.com. I already have a Credit Report service, so I guess I'll buy the knives. That's one down!

Now I can either get Vitamins (don't believe in them), Dr. Seuss Book Club (don't have kids at home), Amora Coffee (I drink Starbucks and already have a local roaster's coffee delivered to the house), a Hunting Knife (I don't hunt), Disney Movie Club (no kids at home), or M-Go Movie Rentals (I already have NetFlix AND Hulu). Hmmm. $150 Walmart Gift Card though ... Shoot. I guess I'll buy some Dr. Seuss books for my nieces.

Wait ... The Gold Offers are mostly the Silver offers I didn't want! And I have to buy TWO of them! I can choose from M-Go movie rentals, a Non-stick ceramic skillet (only $79.95), Dr. Seuss book club sign-up, Disney Movie Club sign up, Sedona Beauty products sign up, or Amora Coffee sign up. Well, I don't have kids at home, and already have NetFlix, I'm already beautiful, and I already have coffee delivered to the house, so I guess I go for the Ceramic Skillet. Cool! It comes with free scissors! ($79.95 plus shipping) and . . . shoot I guess you can never have too much coffee!

Wait. I have to do EIGHT Platinum Offers?? Hmmm... I already bought the knives as my Silver, so I guess I buy the MuscleXLerator, because $150 Walmart Gift Card, and . . .

Oh heck. I'll take the Free Hunting Knife, Sign up from Freester.com, Get ProtectMyID by Experian (don't you wonder if these companies know so many of their referrals are from criminals? I wonder if they care?) Pimsleur Language Learning, because my Rosetta Stone has been on my shelf for two full years and I still can't speak Mandarin, (speaking of heavily spam-advertised products! Pimsleur! Shame on you!) How many is that . . . Shoot. I still need three more.

Well? I guess I'll get ActionProWhite teeth Whitener so I can have that inhuman glow in the dark smile, Join the Disney Movie Club (I can cancel at any time) and well, I do have a lot of wrinkles around my eyes, but that's because I smile so much. Come on Sedona Beauty Secrets!

NOW THAT, Ladies and Gentlemen, is How you get a Free $1000 Target Gift Card, except they actually plan to give me a $150 WalMart gift card instead . . . *IF* I complete 2 Silver, 2 Gold, and 8 Platinum tasks.

$1000 Target Gift Card? Tell the Spammers No Thank You!

TJX: From Florida to the Ukraine?

Last week the media lit up with speculations that 24 year old Ukrainian hacker, Maksym Yastremskiy, who had been arrested in Turkey on August 2nd, may be behind the TJX Credit Card hack. The Boston Globe's Ross Kerber may have had the best coverage with his story "Suspect
named in TJX credit card probe" on August 21. The story quoted Greg Crabb of the US Postal Inspection Service's global investigations division. Crabb said Maksym was "likely the largest seller of stolen TJX numbers". TJX, the financial company in the TJ Maxx conglomerate, believes that as many as 45.7 million credit cards were stolen during a breach during 2005 and 2006, which captured credit card transactions all the way back to 2003.

How's your Turkish? This August 2nd article , "Antalya'da yakalanan Ukraynalı hacker 80 bin kişiyi dolandırmış", interviews Turkish police officer, Feyzullah Arslan, who arrested Maksym after a sting in a luxury night club in Kerem, Turkey.



Using a "follow-the-money" investigative technique, the investigation began with 10 guilty pleas in Florida back in March from a crew of careless cyber criminals who had racked up millions of dollars of purchases from Wal-Mart and other Florida retailers using stolen credit cards that tracked back to TJX. The Florida investigation actually started when Gainesville police were contacted regarding two local Wal-Mart stores who had made individual gift-card sales in the amounts of $18,000 and $24,000. HINT: IF SOMEONE WANTS $24,000 IN WAL-MART GIFT CARD, THERE MAY BE A CRIME LYING ABOUT.

Those cards were used at a Sam's Club in Miami, along with many other cards, to buy large quantities of electronics and jewelry. At that time, the cards were all tracked back to TJX, and an estimate of the loss from the database hack was released in the news -- Gainesville police Sergeant Ray Barber revealed "They estimate the loss from that hack job to be around $8 million", although this particular crew had only rung up $1 million in charges so far. (See, for example: "Florida police make arrests in TJX, Winners credit card theft".

The first six, arrested March 19, were:

Irving Jose Escobar, 18
Reinier Camaraza Alvarez, 27
Julio Oscar Alberti, 33
Dianelly Hernandez, 19
Nair Zuleima Alvarez, 40
Zenia Mercedes Llorente

All ten, including the additional:

Erick Fernandez Rodriguez
Hector Alfaro Rodriguez
Alexis Arcia
Armando Ochoa

have Mugshots posted on eweek.com.




In a USA Today story a map of Irving Escobar's shopping spree, where he bought as many as 60 $400 gift cards in a single location, and then spent the money from November 1st to January 18th, is mapped out.



The big break in this first case came when an alert Wal-Mart employee followed the gift card purchases out of the store and recorded their license plate number. (For more, see the March 24, 2007 Boston Globe story by Ross Kerber, quoted here: Scam May Be Tied to Stolen TJX Data

A second Florida-based TJX gang plead guilty in late June. This group was charged with possessing 172,000 sets of credit card data, which had been used to make at least $75 Million in bogus credit card charges. Arrested in this scam were:

Miguel Alegria, 46, of Hialeah, FL
Raynier Pupo, 22, of Miami, FL
Ariel Montero, 32, of Aventura, FL
Javier Padron-Bravo, 35, of Aventura, FL
Julio Lopez, 30, of Hialeah, FL
and Anett VIllar, 26, of Hialeah, FL



Alegria, Pupo, Montero, and Padron-Bravo plead guilty to conspiracy in exchange for a plea agreement that included cooperation.

The Nashville Secret Service ran the investigation as "Operation Blinky" named for the first suspect's online name, which they co-opted as an undercover identity. For more see: TJX, Polo Data Surfaces In Another Credit Card Bust.