Ex-Microsoft dev used test account to swipe $10M in store credits

But like in Office Space, when the account gets big enough it has to eventually be investigated and people aren't smart to run up a big amount but get greedy, whether they find the money or not who knows but someone will know.

I'd assume a $100m hole in a company balance sheets when they get audited would make the news.

Also got greedy - he could have had 1 million and live on the interest, but he had to keep going.

Given how much money actually is estimated to be skimmed and how few that actually get caught I doubt this.

Plus there's a weird psychological effect in some people where they feel guilty and actually want to get caught. A few years ago I dropped my wallet somewhere, and someone picked it up and used the contactless cards a couple times. They caught him when, the next day, he was shouting and threatening people and generally acting obnoxious, and was arrested with my wallet (complete with my photo ID) still on him.

Why did the guy suddenly get himself arrested? Why didn't he at least get rid of the wallet first? Maybe there's no connection between the two, but people are complicated.

They don't always get caught.

> This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely.

This is very true. Easy money skews how you think. When I was into credit card fraud money became less meaningful. I could get almost anything I wanted for free using stolen cards.

That said, I also kept my activities below what I considered a safe threshold, volumes that would be less likely to cause a large investigation.

Buy Monero with Biticoin -> Transfer Monero to another wallet -> Buy Bitcoin with Monero.

But I guess it isn't that easy.

It's also possible they both knew the address which was paid out to buy the stolen merchandise and they saw he had withdrawals from a bitcoin exchange in bank records. Given these two facts, it's pretty easy to draw a line between them even when mixers are used. But if you don't already know who to suspect this is much harder to do.

Wouldn't Microsoft be able to trace the digital currency to the whitelisted test account? I'm assuming there's some kind of approval process for whitelisting test accounts (or at least you have to be in the right permissions group), otherwise anyone (even non-QA) could make a test account that bypasses their security.

Nothing new here. I thought transparent history was one of the main points of distributed ledgers. BTC was never meant to be anonymous

A hyperbolic explanation [1] so I don't have to retype something similar:

> Federal sentences are calculated using the United States Sentencing Guidelines. The guidelines are a very complex set of rules used to calculate a federal sentence based upon the crime charged, the circumstances of the case, and the criminal record of the defendant. Calculating a very simple sentence is like completing a very simple tax return under, say, 1040-EZ; a complex sentence is like completing a tax return for a troubled entity engaged in questionable tax practices. Or, for you old-school geeks, like creating a Runequest character for a friend who is an argumentative rules-lawyer. From the enactment of the guidelines in the 1980s until United States v. Booker in 2005, the guidelines were binding upon federal judges — they had to follow the guidelines unless there were grounds for a "departure," meaning the rare circumstance not contemplated by the guidelines. Guidelines-application litigation was time-consuming, tedious, and generally despised by trial and appellate judges. In 2005, the Supreme Court decided to construe the guidelines as mere recommendations which federal judges must consider, thus avoiding the Constitutional dilemma of the sentencing judge making findings of fact driving the sentence without a jury's input. Now, federal judges calculate and consider guidelines sentences, but make their own determination, taking into account the factors required by federal statute. Appellate courts review trial judges' sentences for "reasonableness," in which adherence to the guidelines is one factor. Sentences within the guidelines are presumed reasonable. Most federal judges tend to issue sentences close to the guidelines; some impose sentences below, but it's rarer to see one impose a sentence above.

[1] excerpted from the much longer and funnier https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...

So the only thing you can achieve by reporting a theft is that someone gets subjected to the US justice system (assuming they do anything at all). It is highly unlikely you get anything back. So you shouldn't do it to recover your goods.

Furthermore, reporting anything to the police has extra consequences:

1) they will investigate, and may find something wrong with you

2) they may report it to other government organizations which may use it in ways you did not anticipate and really don't want (e.g. child services: your house was broken into and is "not livable")

3) just the association, or that the neighborhood sees police officers near/in your house will spread and may have consequences.

There's nothing to gain from using the justice system and everything to lose.

>There is no getting reduced sentences for good behavior

>If he gets 20 years, he has to serve at least 16 by law.

I am assuming that the 4 year difference would be applied in the event of... Good behavior?

There was a time when MSFT called them "dash trash". Good times. /s