Identity Fraud Ring Exploited Sports Betting Bonuses Using Stolen PII

Two Connecticut men stand accused of orchestrating a sophisticated identity fraud operation that exploited promotional bonuses on sports betting platforms, netting $3 million over five years using stolen personal information from thousands of victims. Amitoj Kapoor and Siddharth Lillaney, both 29, allegedly leveraged darknet markets and Telegram to acquire personally identifiable information (PII), then systematically created fraudulent accounts across FanDuel, DraftKings, and BetMGM.

According to a 45-count federal indictment, the operation ran from April 2021 through February 2026. The defendants purchased comprehensive identity packages including names, Social Security numbers, birthdates, addresses, email accounts, and phone numbers. To bypass identity verification checks, they subscribed to background-check services like TruthFinder and BeenVerified, cross-referencing data to create convincing fake profiles.

Kapoor maintained a detailed "Tracker.xlsx" spreadsheet to organize stolen data, referencing in a text message how he efficiently matched Social Security numbers with names using reverse phone searches. "Didn't even have to open BeenVerified for the last 8 accounts I made that way," he allegedly told Lillaney.

The scheme specifically targeted new-user incentives—promotional credits offered when accounts made initial deposits or bets. When bets placed with these credits won, the defendants transferred winnings to virtual stored-value cards permitted by FanDuel, then funneled proceeds into bank and investment accounts. This layered approach allegedly laundered funds while obscuring the fraud's origin.

Security Implications and Victim Impact

U.S. Attorney David X. Sullivan emphasized the scale of harm: "These two men used thousands of stolen identities to open online gambling accounts and exploit new user incentives, gambling with stolen money for years." IRS Special Agent Thomas Demeo added that victims face "immeasurable hardship" due to the identity theft, including potential credit damage and complex recovery processes.

Charges against the defendants include:

• Wire fraud (23 counts, up to 20 years per count)
• Aggravated identity theft (2 counts, mandatory 2-year consecutive sentences)
• Money laundering conspiracy (up to 20 years)
• Identity fraud (8 counts, up to 15 years each)

Protective Measures for Individuals and Platforms

Security experts recommend these protective actions:

For individuals:

• Enable transaction alerts on financial accounts and credit freezes with major bureaus (Experian, Equifax, TransUnion)
• Use unique, complex passwords for gambling/financial accounts and enable multi-factor authentication
• Regularly review credit reports for unrecognized accounts or inquiries
• Avoid sharing SSNs or birthdates on unverified platforms

For betting platforms:

• Implement behavioral analytics to detect abnormal betting patterns or bonus exploitation
• Cross-verify new accounts against identity verification services with live checks
• Limit withdrawal methods for new accounts and monitor for rapid fund movement
• Audit internal access to customer PII and encrypt sensitive data stores

This case highlights how promotional incentives can become attack vectors when combined with readily available stolen identity data. As U.S. Attorney Sullivan noted: "Individuals who commit identity theft of this magnitude deserve to be punished to the fullest extent of the law." The indictment signals increased scrutiny of fraud targeting the rapidly growing online sports betting industry.