Feds say Mission Hill gang found a lucrative way to supplement its traditional drug sales - check theft and fraud

Last month, the US Attorney's office announced roundups of alleged members of the H Block and Mission Hill gangs.

The alleged associates of the H Block gang, based on the streets north of Franklin Park, were charged with the sort of gun- and drug-related offenses you'd expect. But their Mission Hill counterparts - based at the Mission Main and Annunciation Road projects - were charged with a different kind of crime with which to support their own violent warring: Heading out into wealthy suburbs and stealing large amounts of mail which they'd rifle for checks, so they could "wash" them with chemicals and make out checks in large amounts to themselves or accomplices.

In an 81-page affidavit, an ATF agent on the Mission Hill case detailed an investigation that included the Secret Service, the Department of Labor, postal inspectors and Boston Police that stretched from blue USPS boxes outside post offices in Wellesley, Weston, Needham and Newton - and one at a West Roxbury strip mall on the Brookline border - to banks across the area and post offices where gang members, after successfully depositing their fraudulent checks in accounts, would stock up on postal money orders, the proceeds of which could go to everything from buying more guns to just getting something at a local Dunkin' Donuts.

According to the affidavit, the investigation started in Wellesley last year, where police began getting reports of a wave of stolen checks. Four years earlier, the Postal Service thought it had tamped down an epidemic of check theft by replacing the old large-mouth blue postal collection boxes with a new generation of narrow-slit boxes that made it hard to "fish" for letters with string and two-sided tape. Thieves, though, soon realized they could easily collect even more check-bearing mail by robbing letter carriers of the "arrow" keys they use to open mailboxes on their routes.

And the Mission Hill gang - whose members often wore Milwaukee Brewers gear and tattoos - got into check fraud bigtime, using public Instagram pages to recruit people looking to make some fast cash; when the members weren't busy making YouTube music videos and beefing with the archrivals, the Heath Street gang - which itself had gotten into an unusual side line: Covid relief fraud.

The players

On Aug. 29, the US Attorney's office announced charges of crimes including wire and bank fraud and conspiracy to steal and possess stolen mail against nine alleged Mission Hill associates, none of whom actually live on Mission Hill anymore: Imanol Rios-Franco, 24, of Brookline, Jairo Cabral-Santos, 22, of Dorchester; Brandon Baez, 22, of Framingham; Jiovanny Matos, 25, of Boston, but possibly living with Baez's mother in Framingham; Josman Romero Delgado, 22, of East Boston; Jonathan Martinez, 25, of Roslindale; Anthony Worthen, 28, of Roslindale; Tyrone Brimage, 28, of Roxbury; and Glenroy Miller, 28, of Dorchester.

The affidavits states all have extensive records. In fact, only six were arrested on Aug. 29 because two were already in state custody on other state charges while another, Glenroy Miller, was in federal custody following his arrest in October, 2023 on charges of firearms trafficking and being a convicted felon in possession of a firearm. Because of the complexities of getting inmates to a courtroom on new charges, the three only made their first appearances on the current charges last week.

Miller is sort of a one-man nexus of the gang's war with Heath Street, according to the affidavit. When he was locked up in the Suffolk County jail earlier, on other charges, he got into "multiple gang fights with Heath Street members" - and a Heath Street member shot him and another Mission Hill associate on Dec. 20, 2017.

Matos, meanwhile, was convicted last year of stealing a murdered Heath Street associate's tombstone from a Roslindale cemetery and then "displaying it in the Mission Hill area," the affidavit states.

Other people swept up last month have records that include violations of state gun and assault laws. Three - Baez, Rios-Franco and Cabral-Santos - have previously been nabbed on charges related to the theft of mail theft and bank fraud similar to what they now face on a federal level.

Anatomy of the scheme

Before describing specific incidents - many captured by security cameras set up by postal inspectors near collection boxes - the ATF agent set the stage by describing just how the gang's new business, known as "card cracking," worked:

Once mail is stolen, offenders wash stolen checks with chemicals that erase hand-written ink, leaving the check otherwise intact. This process allows for the blank check to be rewritten to any intended payee in any amount. This facilitates a bank and wire fraud scheme known as card cracking.

In card cracking schemes, bank account holders are often recruited to have stolen checks deposited into their accounts. This process helps to keep primary offenders from being identified by investigators. Account holders are typically recruited through social media or word of mouth. They provide the primary suspects with their debit card, PIN code, and online banking login information in exchange for a portion of funds from a deposited stolen check. Account holders essentially allow for a card cracking suspect to take control of their bank account. Stolen, washed checks are deposited into account holders’ bank accounts via ATM deposits or mobile deposits, the account balance is monitored, and cash is withdrawn at ATM machines as soon as it is made available by the bank.

Due to the vast reach of some social media recruitment efforts, some account holders are several times removed from the primary offenders and may be actual unwitting parties. Many account holders, however, are co-conspirators or are willfully blind to the scheme.

He added that in addition to direct money making, the gang took advantage of another opportunity: Reselling information and signatures from the checks they stole on the black market, to people who would then use the information to create entirely forged checks. The affidavit reports that several victims were victimized repeatedly after their check data got released by the gang.

Putting the investigation's wheels in motion

With pole cameras in place, investigators watched gang members drive up to mailboxes outside two post offices in Wellesley and one in Needham - often in cars rented from the same New York-based "subscription" car-rental startup:

Theft in black and white - alleged mail theft at a Wellesley post office, once via a rented black Audi, once via a white one:

July 1, 2023, mail theft - at 5:09 a.m., a black Audi Q5, New Hampshire registration 5195314,, occupied by multiple individuals, was used in the theft of mail from three USPS collection boxes at the Grove Street Post Office in Wellesley. The driver of the Audi exited the vehicle, accessed all three collection boxes with a key, and stole the contents of each box.

The thieves then struck the same post office again on July 20 - bad news for three victims who had dropped off checks there:

July 20, 2023, mail theft - at 3:11 a.m., individuals used the Black Audi in another mail theft incident in which individuals stole mail from three USPS collection boxes at the Grove Street Post Office in Wellesley. During the theft, the driver exited the Black Audi, accessed all three collection boxes with a key, and stole the contents.

Gang members repeated the process repeatedly in wealthier suburbs, from Weston to Needham - although the affidavit adds that a prime source of checks for them, from Brookline residents, was a USPS blue box outside a UPS office in the Hancock Village mall on VFW Parkway at Independence Drive in West Roxbury.

Instagram recruiting

Another part of the investigation involved pouring through page after page of Instagram and Snapchat posts by scheme members to recruit new participants:

Beginning on June 29, 2023, MATOS engaged in a direct message conversation with an Instagram user about defrauding bank accounts. The conversation started when the user messaged MATOS stating, "Wassup letssss do suuuum watchu fucking with ?" MATOS replied, "All banks tap in gang I'll get you right on my seed." The user then stated, "I got 2 td and chase." During the conversation MATOS stated, "N****s can get crazy w em you just gotta be out here I can't leave the state gang my brace." This comment indicated that MATOS was wearing a court-ordered GPS monitoring device and could not leave Massachusetts. I believe that MATOS encouraged this user to come to Massachusetts so that MATOS could recruit the user into this card cracking conspiracy.

In response to a question about "Chase," which I believe to be a reference to Chase Bank, MATOS replied "If it's old its valid a new one can't really get crazy," reflecting his knowledge that established Chase accounts can be exploited for more money, whereas newer accounts are more closely scrutinized.

Need cash? The scheme advertised on Instagram it had plenty:

The affidavit adds that following a court appearance in West Roxbury on July 20, Matos texted the person: "I'm off the bracelet bitch."

In some cases, gang members didn't think using bank accounts with other people's names was enough to launder the money, so they'd go back to post offices, but this time to use their ATM cards to buy postal money orders:

USPIS Inspectors learned that this PMO and two others were purchased on July 21, 2023, at a Framingham Post Office 18 using an Eastern Bank debit card in the name of W.B. W.B.'s account was funded by a $3,335.01 mobile deposit of a washed check belonging to Victims 5 of Newton. Victim 5 reported that they most likely mailed this check and other checks at a USPS collection box outside of the Newton Centre Post Office. Two of these PMOs were made payable to W.B.; one was cashed by BAEZ at a Framingham Post Office later that day.

The victims

In total, the affidavit lists 21 victims, mostly from some of the richer towns in the area, with one victim from West Roxbury and one from Brockton. Eastern Bank, in particular, had to make up many of the losses, because scheme participants seemed to favor it for creating the fake accounts or using other's accounts to make their bogus deposits.

Eastern Bank investigators informed agents that since this check was drawn from Victim 9's account, additional forged checks bearing Victim 9's account information have appeared at some of their branches. In similar investigations, agents have learned that subjects who steal checks from the mail often photograph them and re-sell the account information to profit more from the scheme. Stolen account information is then used to produce forged checks in attempts to draw money from victims' accounts. While conducting court authorized searches of cell phones seized from mail theft offenders, agents have seen advertisements for photos of stolen checks for sale on social media platforms. In fact, a photograph of Victim 9's check, made payable to ROMERO DELGADO, was found in BAEZ's private Instagram messages.

The affidavit continues with multiple accounts of people discovering their bank accounts had been drained, sometimes of tens of thousands of dollars:

October 16, 2023 - a fraudulent check for $7,750.22 was deposited at an ATM in Newton into a Bank of America account under the name "F.R." of Providence, Rhode Island. F.R. opened the account on January 11, 2023, in Providence. The check belonged to Victim 10 of Needham, who mailed four checks in a USPS collection box outside the Needham Post Office on October 9, 2023. Two of those checks were later altered and made payable to J.B. for $18,605.22 and F.R. for $7,750.22. Victim 10 confirmed that they did not write any checks payable to J.B. or F.R.

Making deposits

A victim identified as Victim 10 from Needham, had four checks he had mailed on Oct. 9 stolen, one of which was altered to be payable to somebody working with the scheme for $18,605.22, deposited at a TD Bank ATM in Bedford on Oct. 20, the affidavit states. Another wound up at a Needham bank where, as shown in the photo at the top of this story, Brendan Baez (allegedly) deposited it:

Needham Police Detectives obtained CCTV and account records from TD Bank documenting the deposit of Victim 10's check into J.B.'s account. CCTV from the bank depicted a dark colored SUV backing into a parking space nearly out of camera view. A masked subject emerged from the passenger side of the SUV, approached the drive-up ATM on foot, and deposited Victim 10's check. The video depicted the subject wearing a sweatshirt with a unique design in possession of a TD Bank card and a blue Apple iPhone that he manipulated throughout the transaction.

Participants seemed to favor early morning hours for putting money in the bank.

July 27, 2023 - at 6:45 a.m., the business owner at Mike's Gas at 1005 Worcester Street [in Wellesley] contacted the police to report that a black Jeep Grand Cherokee had parked in front of his business and two men had exited the Jeep wearing ski masks. The caller reported that as the two men approached the TD Bank at 999 Worcester Street, the owner confronted them about parking at his gas station. The two refused to park at the bank and said they were going to use the ATM machine. The caller asked them why they were wearing masks and one of the men replied "What, I can't have a sheisty on?"

The caller further described the vehicle as a black Jeep Grand Cherokee, 2015 model, with blacked out windows that were "super dark."

Officers arrived at Mike's Gas and the TD Bank minutes later but the Jeep had already left the area. They observed a receipt in the TD Bank ATM documenting $740 worth of cash withdrawals from an account ending in 0547. TD Bank ultimately identified four Eastern Bank debit cards that were swiped at the ATM machine during the transactions. Eastern Bank provided account records for three of the cards. The bank was unable to locate an account associated with the fourth card.

Getting sloppy

As investigators collected more and more evidence, alleged gang members kept inadvertently helping them:

July 31, 2023 - a [Wellesley] officer stopped BAEZ's vehicle for not displaying a front license plate and having excessive window tint. He learned that the driver - BAEZ - was the registered owner of the vehicle and that BAEZ had a suspended license. The officer arrested BAEZ. BAEZ had more than $1,200 in his pocket, despite claiming to be unemployed. During an inventory of the vehicle, officers discovered stolen checks from Wellesley, Sherborn, and Newton, debit cards issued to people other than BAEZ, an Eastern Bank ATM cash withdrawal receipt, receipts for PMOs, and chemicals used for check washing. WPD found an ATM withdrawal receipt associated with the July 26, 2023 ATM withdrawal as well as Victim 14's washed check. ...

September 4, 2023 - [A] mail theft occurred in Wellesley in the early morning hours of September 4, 2023 involving the Black Jeep. At approximately 7:45 a.m. that same morning, the Black Jeep was involved in a crash along the Arborway in Boston. MSP responded to the scene and identified the driver as RIOS-FRANCO. RIOS-FRANCO told the Trooper he had just dropped "his boy" off and was on his way home when he crashed into another car and ultimately a pole. RIOS-FRANCO was picked up from the scene of the crash by two friends, including MARTINEZ. MARTINEZ wore bright blue Croc shoes, consistent with the shoes he wore at the TD Bank cash withdrawal in Wellesley on July 27 and those seized from the MARTINEZ RESIDENCE.

Wrapping things up

The investigation began closing in on the gang members on Feb. 27 of this year, when investigators executed search warrants at many of the members' homes, including:

At the RIOS-FRANCO RESIDENCE [In the Metro Mark complex on Washington Street in Jamaica Plain], investigators detained RIOS-FRANCO and seized 131 checks issued by dozens of individuals and businesses organized inside a clear plastic box. These checks appear to have been stolen because they had no connection to RIOS-FRANCO. Investigators identified some of the victims of these stolen checks seized from RIOS-FRANCO's residence and corresponded with 41 of those individuals and businesses whose stolen checks were seized from the RIOS-FRANCO RESIDENCE. All of the 41 identified victims reported that they had mailed the checks and none of them issued any checks to RIOS-FRANCO. Agents also seized numerous debit cards in other individuals' names. Some were seized throughout the residence and some were contained within the clear box with the stolen checks.

At the CABRAL-SANTOS RESIDENCE, investigators encountered CABRAL-SANTOS' brothers. CABRAL-SANTOS was not present at the time of the search warrant execution. When agents entered the residence, one of CABRAL-SANTOS' brothers was flushing pieces of checks in the toilet. Remnants of the checks were observed and photographed in the toilet. [A]gents seized a sweatshirt from the residence that matched one that CABRAL-SANTOS wore to steal mail and make fraudulent deposits and withdrawals. Investigators also seized additional checks that appeared to be stolen. Investigators corresponded with two individuals who reported that they had mailed the checks that were seized from the CABRAL-SANTOS RESIDENCE and that no checks were issued to CABRAL-SANTOS. In addition, investigators seized paperwork belonging to CABRAL-SANTOS, a bottle of chemicals used to wash checks, and numerous debit cards in other individuals' names.

At the MATOS RESIDENCE, investigators detained MATOS and seized documents in MATOS' name, bank receipts, debit cards in other individuals' names, and several checks that appeared to be stolen because they had no connection to MATOS. One of the checks was issued by the City of Aspen, Colorado. A representative of the city reported that the check was mailed and was not issued to MATOS.

In the kitchen, agents seized blank debit and credit-style cards. These cards had the weight and shape of a typical debit card but were white and had no embossing or print on them. Also in the kitchen, agents seized a card printing, embossing, and encoding machine. This machine could be used to print, emboss, and encode these blank cards to appear and work like a debit card. Agents also seized from the kitchen a bottle of a chemical commonly used to wash ink from checks.

Complete affidavit (11.6M PDF).

Innocent, etc.