Huddersfield cybercriminal ‘who enabled fraud on industrial scale’ jailed for eight years

Zak Coyne, 24, was the co-creator and worldwide administrator for a website, LabHost, with a million victims in 91 countries, Minshull Street Crown Court in Manchester heard.

Coyne, aged 20 at the time and on the autism spectrum, had an "obsessional interest" in computer programming, the court heard, and received around £200,000 from criminals subscribing to his services, paid for in cryptocurrency he converted to sterling.

Data logs showed LabHost had stolen 429,114 credit card numbers, 887,609 unique passwords and 62,532 unique mother's maiden names and shortly before police swooped in April 2024 , there were nearly 13,000 subscribers.

The father-of-one, from Woodbine Road, Huddersfield, admitted two offences of fraud and one of transferring criminal property at an earlier hearing.

Passing sentence, Judge Jenny Lester-Ashworth , told the defendant: "LabHost enabled fraud on an industrial scale with one million victims worldwide.

"It was one of the most professional and sophisticated websites in the world for committing online fraud.

"You also enjoyed what you were doing and also by being immersed in the criminal underworld operating online."

LabHost was co-created by Coyne and a Canadian individual, who has not been identified, in August 2021 .

It was an online subscription-based service hosting phishing pages, that is, realistic-looking, fake versions of 185 major banking, government and commercial websites, including Amazon, Netflix , Uber and 26 UK banks, designed to dupe victims into providing their confidential information.

It enabled thousands of other criminals, located worldwide, to commit crimes, Simon Gurney, prosecuting, told the court.

In return for payment of the membership fee of £250 a month, LabHost provided criminals with access to an array of fake phishing websites tailored to each subscriber's geographical location.

With fake internet pages set up, subscribers would send messages to their intended victims, often saying there had been a problem with the account, getting the customer to log in to the fake website pages and stealing their details.

Subscribers could either utilise the credentials obtained or sell them onwards, or choose prompts to direct their victims.

Mr Gurney said: "Whilst it is impossible to establish a precise figure for the loss caused by the defendant's provision and promotion of the LabHost platform, the court can conclude with confidence that the actual losses exceed £100 million.

"It is likely that the losses caused were substantially greater. The risk of loss occasioned by the frauds committed through LabHost can be measured in multiple billions of pounds."

Coyne received around 250,000 US dollars in cryptocurrency from subscribers, which he converted to cash using a jeweller named John Haag in Chesterfield, who is under police investigation.

The Metropolitan Police's cybercrime unit began an investigation, Operation Stargrew, in June 2022.

Coyne told an undercover officer his "scampages" were "good for banks all over the world".

Other figures give a potential loss in Canada of up to £523 million, in Ireland of £125 million and in Australia of £64 million.

Mr Gurney said aggregating the average potential losses across the world would give a global figure of £12 billion.

Coyne was arrested on April 14 last year in the departures lounge at Manchester Airport .

At an earlier hearing, he admitted one count of supplying an article, namely the LabHost website, knowing it was for use in fraud, one count of encouraging or assisting fraud and one count of transferring criminal property.

In mitigation, Adam Roxborough, defending, said: "He actually did not give any real thought to the overall scale of what he was enabling.

"Once he engaged, it became something of an obsession with him."

Thomas Short , specialist prosecutor for the Crown Prosecution Service , said: "Zak Coyne operated a phishing service that provided fraudsters with the tools to impersonate trusted institutions and steal sensitive information from unsuspecting victims.

"This was a sophisticated, worldwide criminal enterprise which enabled others to perpetrate fraud on a massive scale, resulting in losses totalling more than £100 million.

"Fraud is far from a victimless crime and the harm caused by Coyne's offending are measured not just in monetary terms, but also in the distress inflicted on countless victims who fell prey to these scams."

Commander Stephen Clayman, specialist crime - frontline policing, Metropolitan Police Service, said: "The outcome of this case demonstrates the unwavering commitment of the Met in pursuing individuals like Coyne who mastermind a network of fraudulent activity, which ultimately brings misery to thousands of innocent people.

"This also demonstrates the commitment across law enforcement to identify and hold those to account who facilitate criminal-enabling functions and think they can remain undetected. We will find you and take action.

"This has been a monumental operation lead by the Met and I would like to thank all the partners (including the National Crime Agency , City of London Police and Cyber Defence Alliance ) involved for their invaluable input and without whom, this would not have been a success."