18 U.S.C. § 1029
Fraud and Related Activity in Connection with Access Devices
Key Facts
- Statutory Citation: 18 U.S.C. § 1029.
- Official Offense: Fraud and Related Activity in Connection with Access Devices.
- Jurisdiction: United States (Federal).
- Correlated across 8 primary case matters in this library.
Prosecutorial Elements in Cyber Cases
Governs trafficking in stolen payment card Track 1/Track 2 dumps, automated carding shops, PIN harvesting, and unauthorized account access credentials.
Statutory Sentencing Exposure
Up to 10 or 15 years imprisonment depending on subsection (20 years for repeat offenses) and mandatory card-issuer restitution.
Representative Prosecution Cases (8)
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
U.S. v. Albert Gonzalez (TJX & Heartland Payment Systems)
Mastermind of the largest credit card theft operation in history at the time, hacking TJX Companies, BJ's Wholesale Club, OfficeMax, and Heartland Payment Systems, stealing over 130 million payment cards.
U.S. v. Sergey Medvedev et al. (Infraud Organization)
Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.
U.S. v. Denis Gennadievich Kulkov (Try2Check Card Checking Service)
Creator of Try2Check, the preeminent criminal card-checking platform that processed tens of millions of card verification requests annually for cybercriminals buying stolen credit cards.
U.S. v. Aleksandr Sikerin & Yevgeniy Polyanin (REvil Operations)
International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.
Target Corporation Point-of-Sale Data Breach (Fazio Mechanical Ingress)
Landmark retail cyberattack where attackers penetrated Target internal corporate networks using stolen billing portal credentials from a third-party refrigeration and HVAC vendor, subsequently deploying BlackPOS memory scraping malware to steal 40 million credit card numbers and 70 million customer records.
Marriott Starwood 383 Million Guest Reservation Breach
State-sponsored cyber espionage operators maintained undetected access to the Starwood guest reservation database for four years, deploying remote access trojans and memory scrapers to exfiltrate unencrypted passport numbers, payment cards, and travel itineraries.