Wow, the coverup is actually even more hilarious than the initial fraud here. Kind of clever, you can see they thought they might get away with it.
> 133. While Javice was working with the Data Science Professor in early August 2021, Amar contacted ASL to obtain the ASL List containing student data for 4.5 million college students.
> 136. Amar continued to correspond with ASL over the following days. Through this additional correspondence, Amar learned that ASL could sell Frank a list of data for 4.5 million college students for a cost of $105,000.
So basically they knew they would eventually be found out, so they just elected to buy the 4.5 million contacts for $105K from ASL.
> 149. Ultimately, Javice presented to the Data Science Professor the ASL List of 4.5 million college students and told him that she wanted to "augment" that list. Upon information and belief, Javice represented to the Data Science Professor that the 4.5 million college students on the list were actual Frank accounts. Javice directed the Data Science professor to find a company that could "augment" the list with additional information, including phone numbers, dates of birth, and email addresses.
This data apparently wasn't complete enough, so they then got the original "Data Science Professor" to try to enrich it through commercial sources. Hilarious, the two companies he explores are Emformion and...Acxiom! This freaked them out, so they told him not to tell Acxiom who he was working for. Which they didn't buy. So they only got 1.9M of the 4.5M email addresses matched through Emformion. And things unraveled from there, as they eventually were asked to provide the original list and of course they didn't have it, or anything close to it. Etc etc
I'm naive to this space, but would this perhaps have just been legit business if they had done it in reverse order?
1. First buy data from ASL. Instead of 4.5M, buy as many as you can, like 40M, the entire 15-24 population if they got it. Apparently at ~$100K/~5M, this is only like $1M.
2. Do your own aggressive email/marketing outreach to these people.
3. If you can get 10% response rate, that's 4M customers right there.
You can't get anywhere near a 10% click rate with random leads like that.
The reason companies like this are sought after is the idea that their users are warm leads with an existing relationship with the brand. People who have (supposedly) gone out of their way to sign up for something are several orders of magnitude more likely to engage with e-mails compared to e-mailing them randomly from an unknown brand.
> JPMC reached out via email to a random sample of the list Frank provided – approximately 400,000 purported customers of Frank – with offers to open Chase checking or savings accounts. Of those 400,000, only 103 even clicked through to Frank’s website.
So a clickthrough rate of 0.026%.
Good luck getting anything close to 10% when you're starting with a cold, and possibly partially trash, dataset.
Of course, that makes sense. I liked how Levine highlighted that using the figures here for the acquisition cost we can ballpark the warm leads as ~1000x more valuable than the trash leads.
That back of the napkin math is interesting, but I'd argue it's also not right.
JPMC wasn't just attempting to buy a large email list. Notably, they were also attempting to buy _future expected email list subscribers_.
In theory, if JPMC buys the entire company and then lets the company keep running, they'd expect the list to keep growing over time at a rate similar to whatever Frank's user growth graphs indicated.
They also, I assume, believed they were acquiring a group of people with expertise in marketing to this segment since, well, if you have a warm list of 4M people, that means you also have the abilities to build such a list, which is valuable as well.
I'm not going to try and estimate what percentage of the price was what, but I'll point out there's more to it than just the raw size of the email list at the time of the deal since JPMC didn't _just_ buy an email list and nothing else.
If you can get a 10% response rate on cold leads like that, you're not selling the company based on those leads to JPM for $175MM. You're selling your services at crafting email campaigns to everyone.
Yeah, that would work, but the problem is they told JP Morgan they already had the list, and had nowhere near enough time to legitimately grow to the number of customers they said they had
Reminded me some quote I read about how some many "scale" business are in the junkyard because the creator thought even if only 1% succeed, forgot that there is a success rate below 1%. ZERO.
Whenever something like this comes to light, the real question I wonder about it the number of similar things that didn't get exposed. E.g., the acquirer is too embarrassed to admit they got taken. Or too chaotic to notice. Or the founder stays on and is sufficiently good at covering things up. Or just charming enough that it's all let go. Or there's a post-acquisition strategic change or high-level executive turnover such that nobody really notices or cares that it never works. Or that it gets covered up internally because the executive who pushed for the deal doesn't want to look bad in front of other execs. And so on, and so on.
It covers in detail a startup that was supposedly working on wireless power transmission via ultrasound. From the way he tells it, the company kept raising money long past the point it was obvious the technology couldn't work.
I know of a person that lied about what the company was doing from a C-level position (the company was in the US and they worked in EU so there wasn’t direct transparency). They got demoted since they sucked at their job but kept presenting themself as C-level to build up network and contacts. They then went on to found a prominent start up based on that PR while also stealing ideas from their previous employer. The company did nothing about it since it got hit heavily by Covid and had other problems. You can find posts by this company on HN. They’re pretty hyped up.
I have to wonder if it's like doping in some sports, where cheating isn't easy to detect, and then people feel obliged to cheat to keep up with other cheaters, making cheating common.
> The Director of Engineering questioned whether creating and using such a data set was legal, but Javice tried to assure the engineer by claiming that this was perfectly acceptable in an investment situation and she did not believe that anyone would end up in an "orange jumpsuit" over this project.
> The Director of Engineering was not persuaded and told Javice and Amar that he would not perform the task and only would send them the file containing Frank's actual users, which amounted to approximately 293,000 individuals at that time.
Had she managed to successfully persuade him, would the Director of Engineering have been liable for fraud? She clearly tried to make it seem all look legal.
What should an engineer do when asked to do something that he's not sure whether it's legal or not?
It’s hard to imagine a non-fraudulent scenario where anyone internal to the company would be asked to generate a list of realistic-looking customer names that was 10X the size of your customer base. Even testing data doesn’t have a strict requirement of looking as realistic as possible.
Intent matters in these cases. If the situation had somehow been adjusted so that the engineer genuinely believed the generation was for legitimate purposes, it would be very unlikely that they would be at risk from the initial list generation.
However, I don’t really see how Director of Engineering could have not known the purpose, given that the ultimate goal was to load them into the production DB and the request was coming from outside of engineering.
The engineer would have had a hard time convincing authorities that he was not a part of the fraud conspiracy. He made a very good decision not to participate. There really isn't a very plausible non-criminal explanation for why you'd create all those fake identities.
> There really isn't a very plausible non-criminal explanation for why you'd create all those fake identities.
I think "they told me to do it" is perfectly reasonable defence in this case.
If your employer tells you to build a knife why would you be held responsible for him stabbing someone or themselves? Even if they bragged to you that exactly what they are going to do.
I think then engineer in question shown very high morals, way above their pay grade and deserves respect.
>If your employer tells you to build a knife why would you be held responsible for him stabbing someone or themselves? Even if they bragged to you that exactly what they are going to do.
This exactly fits the description of abetting a crime: "A charge of aiding and abetting has three requirements. First, someone else must have committed a crime. Second, the defendant must have assisted that person in the commission of the crime. Third, the defendant must have had knowledge of that person's criminal intent or criminal plans." https://www.justia.com/criminal/offenses/inchoate-crimes/aid...
A prosecutor could argue that a VP engineer who made up all those fake identities must have known the reason for it was fraudulent.
I'm actually pretty curious how Acxiom's identity verification let this through. It would have been trivially easy to see that the match rate against real human beings was close to 0%. None of the name + city pairs would match except through random chance... this would have stuck out like a sore thumb against any consumer database.
I'm a little surprised JPMC isn't publicly pushing Acxiom hard on this...
I interpreted it as Acxiom only looking at a few key points that they were told to do such as confirming that there were 4.3M rows/users. You would think that they would identity match and spot check a sample...
> JPMC first noticed irregularities with the list when a JPMC employee observed that the list contained exactly 1,048,576 rows, the maximum permitted by Microsoft Excel.
> JPMC has all the emails showing the fraud because Javice and Amar used Frank's email accounts to create the Fake Customer List and the email accounts now belong to JPMC following the Merger
Seems pretty sloppy for defrauding a company out of $175 million.
Do acquisitions usually have more due diligence for verifying customers? It seems like it would be trivial to create 4 million plausible customers in a spreadsheet.
I’m no m&a expert but I’ve been involved with due diligence for a few acquisitions nearly identical to this. It’s a somewhat adversarial process wrapped in pleasantries and some extension of good faith. It’s nearly impossible to vet everything, particularly when the investment isn’t of material risk to the organization and the business wants to move quickly.
The challenge here is with the fact that privacy rules still very much apply and data management during due diligence can be haphazard. The acquiring company doesn’t just automatically get access to everything, it’s a negotiation. JPMC could have literally asked ‘send us your customer database’ and Frank could (and should) say no way and talks still continue.
The one thing i don’t get is how this didn’t also show in their financials.
imagine if all engineers had a moral backbone and stuck with it, not just in outright fraud cases, but in how tech is shaped and impacts society.
The argument one "has to pay the bills" is silly and self-serving. All professionals have to pay the bills. There is something like a sectoral ethos and culture. Technies probably not the worst offenders (that would be the banking sector) but with tech seeping in everywhere it matters more and more.
> 91. Next, the Data Science Professor moved on to email addresses. In an email at 12:56 p.m., the Data Science Professor, referring to the template Javice sent an hour earlier, asked Javice: You have the student email marked as 'provided as unique ID' but didn't we agree to make fake ones a la 'asdugnsdf@gmail.com'? Or do you want unique ID after all?"
> 92. In a response sent six minutes later at 1:02 p.m., Javice asked, “will the fake emails look real with an eye check or better to use unique ID?" At 1:37 p.m., the Data Science Professor confirmed "they will look fake. So let's use unique ID."
Ethics aside, it’s rather surprising that the Data Science Professor couldn’t even generate convincing looking email addresses. This happened in 2021, not 2001. I’d say she could have hired someone more competent at a lot less than $600/hr.
So.. I should start a whistleblower due diligence platform where a potential acquirer can discretely connect with employees of a company and get unfiltered responses. Maybe let them know just how much bullshit is being peddled? Surely that'd have easily been worth a $250k bonus to a mid-career analyst at Frank who could have told JPMC "nah we actually have about 300k customers, our CEO is lying".
Why though? Companied invest in due diligence people and processes (unlike us plebs) If they get swindled, a fool and his money are soon parted.
My intrigue is that due dilligence is quite lax for certain types of people. I wonder what the criteria are. Surely 'those' academically excellent M&A people would never slack on a 100mil+ transaction, or so we are led to believe.
It’s cute that they anonymized the “data science professor”’s name. This person knowingly participated in this alleged fraud which should put their ethics and their reputation into question.
To top it off, this person was later offered a “deal” to be hired into their alleged fraud business once it was merged.
Looks like I need to stop offering "creative solutions", like this Data Science Professor allegedly did, since the legal document made it sound like some kind of criminal euphemism.
No one at any point did any quick back-of-the-envelope math on the size of the user list vs. the number of college students in America and suspected anything suspicious. Smart!
Random website says there are roughly 20 million college students. If the site was operating for several years, the tail could be a higher total. Still a high percentage, but not impossible.
"Mr. Salisbury, a former director of institutional research and assessment at Augustana College, estimates that two million students start college each year for the first time. Having done the FAFSA once, he figured, most families wouldn’t seek help from a company like Frank the second time they needed to and beyond. So if Frank had served five million people in just half a decade, it would have captured a sizable share of new college students who needed financial aid."
Since this has to do with financial aid applications, the number of total possible customers / students is much lower than 20 million. Which means their 5 million number is WAY exaggerated.
Some random startup gets a major fraction of the entire base of US college students to use their service after only being around for a few years. Yeah, right. Not going to happen for a financial service. Yes for something related to social media, porn or something else actually addictive/enticing in some way.
Friendly reminder that litigants can and do make wildly outlandish accusations that may not have any relationship to the facts. This is a lawsuit, not journalism.
Do you think the emails and screenshots in the lawsuit could be fake? I know nothing about the law but how would that not cause someone to become disbarred?
> 133. While Javice was working with the Data Science Professor in early August 2021, Amar contacted ASL to obtain the ASL List containing student data for 4.5 million college students.
> 136. Amar continued to correspond with ASL over the following days. Through this additional correspondence, Amar learned that ASL could sell Frank a list of data for 4.5 million college students for a cost of $105,000.
So basically they knew they would eventually be found out, so they just elected to buy the 4.5 million contacts for $105K from ASL.
> 149. Ultimately, Javice presented to the Data Science Professor the ASL List of 4.5 million college students and told him that she wanted to "augment" that list. Upon information and belief, Javice represented to the Data Science Professor that the 4.5 million college students on the list were actual Frank accounts. Javice directed the Data Science professor to find a company that could "augment" the list with additional information, including phone numbers, dates of birth, and email addresses.
This data apparently wasn't complete enough, so they then got the original "Data Science Professor" to try to enrich it through commercial sources. Hilarious, the two companies he explores are Emformion and...Acxiom! This freaked them out, so they told him not to tell Acxiom who he was working for. Which they didn't buy. So they only got 1.9M of the 4.5M email addresses matched through Emformion. And things unraveled from there, as they eventually were asked to provide the original list and of course they didn't have it, or anything close to it. Etc etc