University student jailed for selling phishing kits to fraudsters

Holman, of Eastcote in West London, previously pleaded guilty to seven counts, including encouraging or assisting the commission of an offence, making or supplying articles for use in fraud and transferring, acquiring and possessing criminal property. 

At Southwark Crown Court on 23 July, Holman was sentenced to seven years of imprisonment. He was also given a Serious Crime Prevention Order following an application from the prosecution.

The Crown Prosecution Service authorised the charges against Holman following an investigation conducted by the City of London Police, supported by international partners in Switzerland (ie the Office of the Attorney General of Switzerland and the Federal Office of Police) and Finland.

Widespread fraud

Sarah Jennings, specialist prosecutor for the Crown Prosecution Service, said: “By creating and selling phishing kits, Ollie Holman facilitated a widespread fraud which others used to exploit innocent victims on a vast scale. Holman acted with greed and profited handsomely from this illegal enterprise, funding his own lavish lifestyle at the expense of countless individuals and businesses who suffered devastating financial losses and emotional harm.”

Jennings added: “The prosecution team, working closely with the City of London Police and international partners, was able to build a strong case with clear and compelling evidence, resulting in the defendant’s guilty pleas.”

In conclusion, Jennings noted: “I hope this case sends a clear message to those intent on committing fraud. No matter how sophisticated your methods, you cannot hide behind online anonymity or encrypted platforms. Fraudsters like Holman will be robustly pursued by law enforcement, prosecuted by the Crown Prosecution Service and brought to justice.”

Estimated losses

The defendant was responsible for the creation and supply of 1,052 phishing kits, which targeted 69 financial institutions and large organisations, including charities, in no fewer than 24 countries and resulted in estimated losses of at least £100 million globally.

These kits contained a phishing web page which was designed to look real. These fraudulent web pages had built-in scripts to enable the harvesting of information entered, including account log-in details and bank details.

Holman distributed these phishing pages via the encrypted messaging service Telegram, where he also offered his advice and technical support to others intent on committing fraud.

Holman was arrested in October 2023. His university accommodation in Canterbury was searched and his devices seized. After his initial arrest, Holman continued to use his Telegram channel to provide support and maintenance of phishing kits until he was arrested again at his home address on 20 May last year, with further devices seized.

The investigation uncovered a large amount of digital evidence, which the prosecution used to build a strong case and successfully link Holman to the online offending.

Following his sentencing, the Crown Prosecution Service’s Proceeds of Crime Division will be taking Holman back to court to pursue confiscation proceedings against the defendant in a bid to recover his ill-gotten gains.