Yue Cao was hired at an Ohio bank as a quant analytics manager, a role meant to help protect customers from fraud. A federal jury in Cleveland found in February 2026 that he used that access to target more than 100 customers ages 90 to 103 instead, and a judge sentenced him on September 17, 2026, to 10 years in prison. Prosecutors said the scheme reached victims in five states and moved about $2 million out of their accounts before it was caught. The case is one of the more detailed accounts federal prosecutors have released this year of how a single insider, rather than an outside scam ring, can reach older account holders at scale.
How the Scheme Reached Victims Ages 90 to 103
Cao created email addresses in the names of more than 100 victims using an offshore service, then enrolled each one in online banking without the customer’s knowledge, according to the U.S. Attorney’s Office for the Northern District of Ohio. Once an account’s statements and login notifications were routed to an email address Cao controlled rather than the customer’s own, he could act on the account without the victim ever seeing a login alert or a suspicious-transaction notice. The scheme ran from 2022 through 2023, prosecutors said, reaching victims in New York, Pennsylvania, Connecticut, Washington and Ohio, including Canton in Stark County.
Inside the kit: A scheme built on redirected email notifications leaves an account looking normal to its owner right up until a statement stops arriving. The free credit-freeze steps and a fraud evidence and report log in The Senior Fraud Defense & First-Hour Recovery Kit cover what to check first when a routine notice goes missing.
A Trusted Role Turned Into the Access
Cao’s job title mattered to how the scheme worked. He held a quant analytics position that, according to the U.S. Attorney’s Office’s account of the guilty verdict, existed to help the bank protect customers from fraud rather than commit it. That access is what let him enroll accounts in online banking and redirect their notifications without triggering the reviews a bank normally runs on outside requests, since the changes were coming from inside its own systems. A federal jury reached its verdict on February 10, 2026, after weighing evidence built largely from the bank’s own transaction and enrollment records.
The Charges, the Verdict and the Sentence
The jury convicted Cao on all 15 counts: 10 counts of bank fraud, four counts of aggravated identity theft and one count of money laundering. U.S. District Judge J. Philip Calabrese sentenced him on September 17, 2026, to 120 months, or 10 years, in prison, to be followed by five years of supervised release. The charges carried a statutory maximum of up to 30 years, with a two-year mandatory minimum on the identity-theft counts, according to the U.S. Attorney’s Office. More than seven months passed between the February verdict and the September sentencing, the period federal courts typically use to prepare a presentence investigation report before a judge sets a term.
Where the Nearly $2 Million Went
Cao transferred the stolen funds into his own bank and credit-card accounts, prosecutors said, then went further, opening brokerage accounts in some victims’ names and using their money to trade options, a step that put the funds at market risk on top of the theft itself. Assistant U.S. Attorneys Edward D. Brydle and Michael L. Collyer, who prosecuted the case, built it around records showing customers rarely reviewed statements they never received, since Cao had rerouted the notifications before any of the transfers began. The Federal Bureau of Investigation’s Cleveland Division led the investigation that traced the pattern across accounts in five states, work that involved matching Cao’s personal financial records against the redirected email addresses and the timing of each unauthorized transfer.
Elder Fraud Reporting Beyond a Single Bank
A scheme built on an employee’s own access, rather than an outside caller’s script, is harder for any one customer to catch on their own, which is part of why the U.S. Department of Justice’s Elder Justice Initiative directs families toward a dedicated hotline rather than relying on an account holder alone. The National Elder Fraud Hotline, 1-833-372-8311, connects callers with staff who can help identify which agency a suspected case belongs to, whether that is a bank’s own fraud department, the FBI, or a state’s Adult Protective Services office. The same page lists the Eldercare Locator, 1-800-677-1116, for finding state and local elder-abuse resources beyond the federal hotline. Neither hotline can undo a transfer that has already cleared, but both exist precisely for cases like this one, where the first sign of trouble is a document that simply never arrives rather than an obvious theft.
The FBI’s Cleveland Division investigated the case alongside the U.S. Attorney’s Office for the Northern District of Ohio, whose prosecutors secured convictions on all 15 counts before Cao’s September 17 sentencing. Ohio was only one of the five states where victims lived, which meant investigators had to coordinate with banks and, in some cases, local authorities well outside Cleveland before the case was ready for trial.
An Inside Job Looks Like Nothing on the Statement
Cao’s case worked because the accounts he touched looked ordinary from the outside: no missed payment, no locked card, just a notification quietly redirected somewhere else. That kind of gap tends to surface only when someone other than the account holder starts asking pointed questions about a statement that never showed up.
The Senior Fraud Defense & First-Hour Recovery Kit sets out the first-hour recovery plan and the family code word for a household deciding who to call first once something about an account stops adding up.
Open the first-hour recovery plan in The Senior Fraud Defense & First-Hour Recovery Kit.
This article was produced with AI assistance and reviewed by a human editor. The sentencing details come directly from the federal prosecutor’s announcement.
