A young Miami computer programmer named Milad Avazdavani booked stays from Denver to Dubai, along with a string of fancy car rentals — all using frequent flier miles from American Airlines.
Absolutely none of those miles belonged to him.
The former Florida International University student now stands accused of hacking into the AAdvantage accounts of high-mileage customers and siphoning off enough points to charge trips and cars worth more than $260,000.
When confronted, police say he confessed with braggadocio. But Avazdavani, who has been jailed for a year awaiting trial, says he has admitted to nothing, insisting he is not stupid enough to use stolen miles to book trips in his own name.
Yes, he took some trips and rented some cars, Avazdavani said, speaking publicly for the first time in an interview in jail last week. But he swore he was only guilty of “bargain shopping” for travel deals on the internet. He refused to pinpoint who is to blame, cryptically adding “you become a victim when you socialize with the wrong crowd.”
“It was a third party, that’s all I can say,” Avazdavani said, cuffed and seated in a wheelchair because of a bad back. “There are other names, other suspects.”
The unusual case against the student from Iran will likely end in a trial this summer on 19 felony counts, including fraudulent use of someone’s identity, grand theft, organized scheme to defraud and computer offenses.
In South Florida, where multimillion-dollar Medicare fraud, money laundering and Ponzi schemes are routine, the case against Avazdavani doesn’t exactly rank as the white-collar crime of the century. But it is highly unusual and reveals a potential vulnerability to hacking in popular airline points programs used by millions of travelers.
“These cases are pretty rare because it takes a lot of investigative work on behalf of the airlines, and the police department,” said former Miami-Dade Assistant State Attorney Manny Reboso, the original prosecutor on the case. “And as with any computer crime, there needs to be evidence that the defendant was behind the computer.”
Airline travel accounts have been breached in the past. In December, thieves acquired stolen passwords to access the accounts of thousands of frequent fliers at both American and United, according to the Associated Press. The hackers attempted to steal miles to book free trips for themselves or to obtain upgrades. American told AP that it had frozen some of those accounts and has moved to set up new ones for customers with compromised security credentials.
In the Avazdavani case, American’s security protocols helped to short-circuit the intrusion. Its computer system sends automatic alerts to customers if an e-mail has been changed to a new address — a common way for fraudsters to access miles — and one alerted the airline of the suspicious move.
“If there is any fraudulent activity, we take it very seriously,” said American spokesman Ross Feinstein.
Avazdavani seems an unlikely character to land in Miami-Dade jail.
A gifted math and science student, he grew up in Isfahan, Iran’s second-largest city. At age 19, he moved to Tampa to attend the University of South Florida, where he graduated with a degree in biology. He worked briefly as a research technician in the school’s department of cell biology, microbiology and molecular biology.
Afterward, he worked as a scientist at Doosan Hydro, a global tech company based in Tampa that specializes in water and waste technology. Reached by phone, a Doosan Hydro human resources worker acknowledged he worked there, but refused to give details.
Avazdavani was arrested in Tampa on marijuana possession charges and put on probation in 2014 but otherwise had no criminal record. That same year, he moved to South Florida and enrolled at FIU to study biomedical engineering.
“He was doing very well. I don’t know what happened. I think he got involved with the wrong people,” said his uncle, Jay Estefandiary, of Fort Lauderdale. “He’s very intelligent, but sometimes, he doesn’t realize what is right and what is wrong.”
Avazdavani claims he is “being held hostage” at the jail, where one inmate attacked him. He also says he is an Ashkenazi Jew who will be persecuted if he is deported to the Muslim country. His attorney, Lauren Dawson, was not available for comment on Friday, according to an assistant in her office.
Prosecutors believe Avazdavani masterminded the hacking of American’s AAdvantage program, which allows customers to accrue “miles” every time they book flights, shop with partner businesses or use sponsored credit cards. Over time, a customer can redeem those miles toward flights, hotel stays and other goods.
The criminal probe began with a Texas-based American Airlines investigator named Linda Harper, who in early 2015 began noticing a pattern of suspicious mile-redemption transactions all leading to Miami.
In one case, a Southern California man named Eric Michaelson had 275,000 miles pilfered. Somebody changed his e-mail, then used his account to buy four plane tickets to Denver, book stays at a Fort Lauderdale Embassy Suites and the Seminole Hard Rock in Hollywood, and to rent a Chevy Tahoe.
The transactions immediately sent an alert to Michaelson, who runs a company that manufactures ballistics armor. He called American, and eventually filed a police report. The company reinstated the miles.
“It was a slight nuisance, but it wasn’t earth shattering,” Michaelson said. “I’m more disappointed that when American merged with US Airways, they lost a quarter million of my miles.”
The unauthorized transactions were all made in the name, “Milad Avaz.” The pattern — changed customer e-mails, stays at local hotels and rental cars — repeated itself, from the same computer IP address, according to a police report. At least six customers had miles stolen.
“None of the customers impacted lost miles,” said Feinstein, the AA spokesman. “They were reinstated.”
Avazdavani could not always redeem the hotel bookings — twice, stays at the luxury Jumeirah Emirates Towers in Dubai were canceled by American because of suspected fraud. But he did get the cars, five of them in all, according to police, and there is video surveillance of him renting one in Tampa. He crashed one Camaro in Manatee County, according to police reports.
Avazdavani doesn’t deny using the rental cars but says any disputes with the rental car companies are “civil, not criminal.”
“My name was on the reservation. All I had to do was go there and give my name and rent the car,” Avazdavani said. “Every single one of them was returned. My personal credit card was on file, for incidentals ... all I knew I had the reservation booked for me.”
American turned the investigation over to detectives at Miami-Dade’s airport district. By tracking one rented BMW Z4, Detective Steven Kaufman found Avazdavani in a West Miami-Dade home where he was renting a room in early 2015.
When the homeowner let Kaufman in, according to a police report, Avazdavani locked himself in his room briefly, blurting out that the cops had “no grounds to secure a search warrant so there is no way to get into my room.” Despite the fluency he exhibited, he also added, “I do not speak English,” according to the report.
Inside the room, detectives found a slew of credit cards in other people’s name, as well as 150 grams of marijuana. According to Kaufman’s report, Avazdavani eventually copped to the fraud — but warned there was a “time limit” on his interview with the detective.
“Because when he bonds out he would disappear, take on another identity and would never be seen again,” Kaufman wrote.