Fourteen charged in Texas over alleged $370 million bank account takeover scheme
Federal prosecutors in the Northern District of Texas unsealed an indictment charging fourteen people over an alleged nationwide scheme to take over victims' bank accounts. Prosecutors say the defendants included corrupt insiders at banks and telecommunications companies.
The US Attorney's Office for the Northern District of Texas announced on 3 November 2026 that a federal grand jury had indicted fourteen defendants over an alleged nationwide bank account takeover conspiracy, which the release headline describes as a $370 million scheme. The 22-count indictment charges conspiracy to commit wire fraud and bank fraud, bank fraud, wire fraud and aggravated identity theft. The indictment was unsealed on 3 November 2026.
Prosecutors allege that Muhamed Dieye, 35, of Dallas, was the leader of the scheme. According to the US Attorney's Office, he kept a spreadsheet with personal and business details of nearly 3,000 victims who together held more than $373 million in their bank accounts. Prosecutors say Dieye was arrested at a gate at JFK airport in New York after his boarding pass for a one-way flight to Malaysia had been scanned.
From July 2023 through November 2024, the defendants allegedly obtained personal identifying information, made and trafficked fake identity documents, impersonated victims, took control of victims' phone lines through spoofing and SIM swapping, and intercepted security codes. Prosecutors allege the group also used corrupt insiders at banks and telecommunications companies to get around authentication checks. The release names Truist Bank, Bank of America, First Bank, Woodforest National Bank, JPMorgan Chase Bank and Charles Schwab as banks where victim accounts were accessed or funds withdrawn, and describes an attempted $2,000,000 wire to Emirates Islamic Bank. The release does not say how much money was actually taken.
The Diplomatic Security Service was the lead investigating agency, with help from many other federal and local agencies. The release states that an indictment is only an allegation and that all defendants are presumed innocent until proven guilty.
Why it matters to AML professionals
Account takeover cases show that strong passwords and one-time codes can fail when criminals control a customer's phone number or have help from an insider. AML professionals and fraud teams need to connect login, device and phone-change data with payment activity, and treat insider access as a real risk. Cases like this also produce many linked accounts, so pattern-based reviews matter more than single-alert reviews.
Red flags in this case
- A customer's phone number or SIM changes shortly before a password reset, new payee set-up or large outgoing payment
- Logins from new devices or locations followed quickly by changes to contact details and a large transfer
- Staff accessing customer records or overriding authentication steps with no related service request
- Attempted large international wires from accounts that have never sent payments abroad
If this landed in your queue
- Review recent changes to the customer's phone number, email, address and devices, and compare their timing with the payments in the alert
- Contact the customer through a channel already on file before the changes, not the new contact details, to confirm the activity
- Check which staff accessed the account and whether any authentication overrides were used, and escalate unexplained access to the insider risk team
- Hold or recall outgoing payments where policy allows, look for linked accounts with the same pattern, and file a suspicious activity report if the activity is not explained
Key terms
- Account takeover
- When a criminal gains control of a real customer's account, usually by stealing login details or bypassing security checks, and uses it to move money.
- SIM swapping
- Moving a victim's phone number to a SIM card the criminal controls, so the criminal receives the victim's calls and security codes.
- Indictment
- A formal charge approved by a grand jury; it is an accusation, not a finding of guilt.
Interview angle
What signs would make you suspect that a customer's account has been taken over rather than used by the customer?
Mention recent phone, SIM, email or device changes, logins from unusual places, new payees followed quickly by large transfers, and possible insider involvement. Then explain how you would verify with the customer through a trusted channel and escalate.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.