Starting in 2019, a Massachusetts man bought stolen Massachusetts driver's licenses and Social Security numbers sold on the darknet. With them, he and others opened driver accounts on rideshare and food delivery apps. The accounts passed every background check the platforms and the state required: criminal history, sex offender registry and driving record.
According to prosecutors, the checks were run on the wrong people. According to the Justice Department, the accounts were then used or rented out to drivers who could not pass a background check themselves.
A background check describes the identity it is run on. Here, prosecutors said, that identity was stolen.
How the scheme worked
Thiago de Souza Prado used the accounts himself or rented them to other drivers. He collected referral bonuses by "referring" his own fake accounts as new drivers, and used a GPS spoofing app to create rides that never happened or to stretch real ones. Payments went to bank accounts opened in the names of identity theft victims.
In September 2023, a federal jury convicted him of conspiracy to commit wire fraud, wire fraud and aggravated identity theft. In December 2023, he was sentenced to 70 months in prison and fined $50,000. In July 2025, the First Circuit upheld the conviction and sentence.
From stolen licenses to the appeal
- Stolen identities bought
Massachusetts driver’s licenses and SSNs from the darknet are used to open driver accounts.
- Accounts rented out
Drivers who could not pass a background check drive under other people’s names.
- Charged with 17 others
A federal case covering rideshare and food delivery accounts nationwide.
- Jury verdict
Convicted of wire fraud conspiracy, wire fraud and aggravated identity theft.
- 70-month sentence
Plus three years of supervised release and a $50,000 fine.
- Appeal rejected
The First Circuit affirms the conviction and the sentence.
3types of checks passed with stolen identities: criminal, sex offender registry and driving record
Three lessons for platforms
1. A clean report describes the identity, not the driver
Criminal searches, registry checks and the MVR all run on a name, a date of birth, an SSN and a license number. When those belong to a real person with a clean history, every report comes back clean. The question none of them answers is whether that person is the one who signed up.
2. Match the face to the license
The license in this case was real. A live selfie compared to the photo on that license is the step that connects the record to the person. Without it, the strongest check in the package can verify the wrong driver.
3. Who drives is a question after onboarding too
Renting out an approved account turns one clean onboarding into many unscreened drivers. Platforms need their own controls for who is using an account after approval. Background checks cover the person at onboarding; they do not see who logs in later.
