Key takeaway: Payment processors should treat onboarding checks on new accounts as a fraud control in their own right. So should the merchants who rely on them. Prosecutors allege that shell companies built on stolen identities kept debiting third parties’ bank accounts. The alleged debits ran across at least three processors for about five years.
Federal prosecutors in the Southern District of New York charged two Illinois men. Paris Baker, 38, is from Chicago, and Michael Sullivan, 50, is from Calumet City, Illinois. Prosecutors allege the two men set up shell companies in the names of identity theft victims. They allegedly used those companies to pull unauthorized debits from third parties’ bank accounts through payment processors.
The U.S. Attorney’s Office announced the charges on November 10, 2026. According to the release, the alleged scheme ran from about 2019 to 2024. Prosecutors say the defendants opened accounts for the shell entities with at least three payment processors. One of those processors is based in Rockland County, New York. The defendants then used the accounts to debit third parties’ bank accounts, purportedly for services rendered.
The defendants allegedly attempted about $3.7 million in debits. They allegedly obtained about $1.3 million of that, which they then spent or moved to other accounts. The release names six shell entities. They are Sebi Property Management, Sada Property Group, Vollen Medical Center, Acclimate Property Management, Majani Wellness Center and Fruitive Medical & Rehab Center.
Each defendant faces wire fraud and conspiracy to commit wire fraud, carrying a maximum of 20 years. Each also faces access device fraud and conspiracy to commit access device fraud, carrying a maximum of 15 years. The charges also include conspiracy to commit money laundering, carrying a maximum of 20 years. They also include aggravated identity theft, which carries a mandatory minimum of two years. Authorities arrested Baker in Thousand Oaks, California, and Sullivan in Calumet City, Illinois.
U.S. Attorney Jamie McDonald said, “Paris Baker and Michael Sullivan allegedly created businesses that existed only on paper, using stolen identities to give their scheme the appearance of legitimacy while initiating millions of dollars in unauthorized bank transactions.” FBI Assistant Director in Charge James C. Barnacle, Jr. said, “Baker and Sullivan allegedly stole millions of dollars over the course of a five-year wire fraud scheme.”
He added, “The FBI takes fraud seriously and works tirelessly to follow the money and identify those responsible. Let this case serve as a warning to others: pursuing illegal profits is not worth the consequences.”
The investigation involved three FBI field offices, in New York, Chicago and Los Angeles. It also involved the U.S. Attorney’s Offices for the Northern District of Illinois and the Central District of California. Local partners included the Illinois Attorney General’s office and the Palos Heights and Chicago police departments. All charges are allegations, and the defendants are presumed innocent unless proven guilty.
Why it matters: The allegations describe how someone can use stolen identities to create business accounts that look legitimate at onboarding. Risk and fraud teams often group unauthorized bank debits like these under the broader label of ACH fraud. ACH fraud is the term for unapproved electronic debits pulled straight from an account.
Shell businesses can reportedly pull debits for years. That reach touches the consumers whose accounts get debited, the banks handling the disputes, and the processors carrying the accounts. Risk teams may want to review how they verify the people behind new accounts. They may also want to review how they monitor debit activity on businesses with little transaction history.
Source: U.S. Attorney’s Office for the Southern District of New York