Apple couldn’t tell fake iPhones from real ones, lost $2.5M to scammers

Two men involved in an elaborate scheme duping Apple into replacing about 6,000 counterfeit iPhones with genuine iPhones were sentenced to prison this week, the US Department of Justice announced Thursday.

Together with their co-conspirators, the 34-year-old scammers, Haotian Sun and Pengfei Xue, squeezed Apple for about $2.5 million, as employees for years failed to detect what the DOJ described as a rather "sophisticated" scheme between 2017 and 2019.

Now Sun has been sentenced to 57 months in prison and must pay more than $1 million to Apple in restitution. For his part, Xue was sentenced to 54 months and ordered to pay $397,800 in restitution, the DOJ said. Additionally, both men must also serve three years of supervised release and forfeit thousands more following the judgment.

The scheme depended on tricking Apple into accepting bogus phones during returns by spoofing serial numbers or International Mobile Equipment Identity (IMEI) numbers linked to real customers' iPhones that were still under warranty. (Apple provides a one-year warranty for new iPhones discovered to have defects and sells insurance plans to extend the warranties.)

The scammers were caught and convicted of mail fraud and conspiracy to commit mail fraud after an Apple investigator tipped law enforcement off, a 2019 affidavit from postal inspector Stephen Cohen said.

Law enforcement intercepted packages and confirmed that thousands of counterfeit phones were being shipped from China, then submitted to Apple for repairs either by mail or in person. These counterfeit phones, Cohen said, were either out of warranty or contained counterfeit parts, but Apple "wrongly" believed that they were real phones under real warranties, often replacing dozens of fake phones fraudulently returned in a single shipment, Cohen said.

Apple has some measures in place to stop repeated fraudulent returns, Cohen noted, including "rejecting any requests to repair and/or replace a phone from a particular individual or address." But this was easy for the scammers to circumvent by simply using different aliases and opening new mailboxes. According to Cohen, Sun was linked to at least eight UPS Store mailboxes monitored by law enforcement.

Both Sun and Xue were identified as co-conspirators after federal agents started intercepting packages that were either addressed to them or one of their known aliases.

After cops started digging through the packages, they didn't immediately arrest the men, however. Instead, they wrote down IMEI numbers of every phone in every package they intercepted and "then allowed the shipments to be delivered to the intended recipients," Cohen said.

From there, the cops would go back to Apple, which shared information about returns linked to those IMEI numbers, Cohen said. The information Apple shared included names, addresses, and email addresses. Sun apparently submitted more than 1,000 repair requests through various email addresses, some of which were registered in his real name.

Investigators went to great lengths to stop the multimillion-dollar scheme, Cohen said, noting that cops even dug through trash outside the suspects' homes and conducted stakeouts to track when men brought intercepted packages into Apple Stores.

Apple also cooperated by verifying spoofed IMEI and serial numbers, as well as confirming when phones contained counterfeit parts, Cohen said.