ben shekelberg 
Updated July 18th, 2019
A Macedonian citizen was sentenced to more than seven years in federal prison for selling stolen financial information through Codeshop, the fraudster’s storefront for stolen credit card numbers and bank account information.
In April 2019, United States District Judge Eric N. Vitaliano sentenced Djevair Ametovski to seven years and six months in federal prison for aggravated identity theft and access device fraud. The United States Attorney for the Eastern District of New York, Richard P. Donoghue, announced the sentence alongside a Special Agent in Charge of the New York Field Office of the United States Secret Service. The investigation that led to Ametovski’s conviction and prison sentence involved an assortment of law enforcement agencies in the United States and other countries. Unlike many similar cases, the United States Federal Bureau of Investigation had no public role in the Codeshop takedown.
Between 2010 and 2014, Ametovski, under the name “xhevo” and “sindrom,” launched phishing campaigns against a significant number of companies in the United States in an attempt to collect valuable data from the companies he had targeted. Alongside his co-conspirators, Ametovski hacked the servers of unidentified companies and accessed databases that stored private customer or cardholder information. Ametovski downloaded the databases and added them to searchable databases on Codeshop. Codeshop, according to law enforcement, was a fully indexed storefront for fraud that allowed customers to find and purchase very specific stolen information. A spokesperson for the United States Attorney’s Office of the Eastern District of New York said that customers of Codeshop could search for information by “bank identification number, financial institution, country, state and card brand.” Codeshop provided a service that very fraud shops or vendors could match by allowing users to purchase stolen financial information catered to the user’s personal situation, location, and intention.
According to court documents prepared by Secret Service Special Agent Christian Wilson, Ametovski stole and resold more than one million credit and debit card numbers through Codeshop. When the United States Secret Service investigated the Codeshop servers in the Czech Republic and in the Netherlands, they found an additional 400,000 credit and debit card numbers in the site’s searchable database. At the recent sentencing hearing, a federal judge ordered a forfeiture of $250,000 — Ametovski’s share of the money made through Codeshop. Investigators said that Ametovski and his co-conspirators used anonymous currency exchanges to launder their income before cashing out by purchasing Bitcoin and other cryptocurrencies. Although Ametovski owned and operated Codeshop, three additional defendants had elevated access to the site. All three, according to prosecutors, uploaded stolen data and collected profits from their own sales.
Slovenian authorities arrested Ametovski in January 2014 after arresting one of his co-conspirators. The co-conspirator provided Slovenian authorities with information about a prolific criminal in exchange for a reduced penalty for related charges he faced in Slovenia. The man identified Ametovski as the operator of Codeshop and provided Slovenian authorities with the evidence needed to link a picture of Ametovski and his girlfriend to the “xhevo” and “sindrom” identities used by the Codeshop owner. Once Slovenian authorities had confirmed this information and arrested Ametovski, they reached out to the United States Department of State Regional Security Officers in Slovenia. The Department of State then contacted the United States Secret Service, United States Marshals Service, and the United States Justice Department’s Office of International Affairs. The Secret Service had been investigating Codeshop for years; the Marshals specialized in transporting suspects and executing federal arrest warrants; and the Justice Department’s Office of International Affairs interfaced with law enforcement entities outside of the United States.
The evidence Slovenian law enforcement gave the Secret Service helped the Secret Service identify a second Codeshop server in the Netherlands. With help from the Justice Department’s Office of International Affairs in the Netherlands, the Secret Service gained access to the server and seized the data they had uncovered. During the Secret Service’s investigation, the United States Department of Justice worked on Ametovski’s extradition to face three charges in the United States. After two years in court in Slovenia, the United States Marshals Service arrested Ametovski and brought him to the United States. Ametovski maintained his innocence until 2017. He pleaded guilty to two of the three original charges in exchange for a reduced sentence – aggravated identity theft for the theft and sale of stolen financial information and access device fraud for obtaining financial information through hacking and phishing. The prosecutors had asked the judge to sentence Ametovski to 17 years in prison. A sentence of that length accurately reflected the scale of the damage Ametovski had caused during the operation of Codeshop. According to MasterCard, Codeshop customers had stolen a combined total of at least $30 million.
Ametovski will only spend seven years and six months in prison. He will pay $250,000 to the court and an undecided sum to the financial companies burdened with the cost of the money stolen during Codeshop’s operation.
