A former bank analyst has been sentenced to 10 years in federal prison after a jury convicted him of bank fraud, aggravated identity theft and money laundering in a scheme prosecutors said involved secretly creating online banking access for elderly customers and moving approximately $2 million without authorization.
Yue Cao, 36, was convicted in February of 10 counts of bank fraud, four counts of aggravated identity theft and one count of money laundering. U.S. District Judge J. Philip Calabrese imposed the 120-month sentence and five years of supervised release, according to the U.S. Attorney’s Office for the Northern District of Ohio.
The victims ranged from 90 to 103 years old and lived in New York, Pennsylvania, Connecticut, Washington and Ohio. Prosecutors said Cao focused on customers who had not enrolled in online banking, then created digital access in their names without permission.
An April 2025 federal court opinion recounting the government’s investigative record says the case began to unfold after a second financial institution detected an unauthorized $50,000 transfer from one of those customers into Cao’s checking account. The banks’ internal investigations eventually led to the FBI.
He Created Email Accounts in More Than 100 Customers’ Names
Cao worked from 2015 until June 2022 as a quantitative modeling analyst for a federally insured financial institution based in Cleveland. His position gave him access to substantial customer and account information.
After that employment ended, another financial institution in Westlake, Texas, hired Cao to build internal models designed to predict and track fraud, according to a federal court opinion.
The U.S. Attorney’s Office said evidence presented at trial showed that Cao used an offshore service to create email addresses in the names of more than 100 customers. He then used those addresses to enroll the customers in online banking without their knowledge or authorization, allowing statements and other notifications to be directed to email accounts he controlled.
Prosecutors said Cao also used victims’ identities to open additional bank and brokerage accounts. Money from their legitimate accounts was transferred into those accounts, where he engaged in options trading and, in some instances, arranged trades involving his own brokerage account.
A $50,000 Transfer Triggered the Investigation
The April 2025 court opinion says the second bank’s internal systems detected an unauthorized $50,000 transfer in April 2023 from a customer at the Cleveland institution into Cao’s checking account. Bank personnel then reviewed Cao’s accounts and identified additional transactions originating from the same customer’s account.
According to the opinion’s account of the investigation, Cao also attempted to link three more customer accounts to his brokerage account. The second bank’s monitoring system rejected those attempts because Cao’s Social Security number did not match the account holders’ information. The government said two of the attempts originated from the IP address of Cao’s residence.
The opinion says Cao denied the allegations and claimed he did not know about the unauthorized transfers during two interviews with the bank. The institution terminated his employment on April 20, 2023. Five days later, Cao filed a complaint with the FBI’s Internet Crime Complaint Center claiming that his accounts and home internet router had been hacked.
The second bank then notified the Cleveland institution about the unauthorized activity involving its customers. The court opinion says the Cleveland bank conducted its own investigation and found online banking profiles created with elderly customers’ personal information, along with transfers to unauthorized accounts and Cao’s personal accounts. It worked with other financial institutions to recover as many of the unauthorized transfers as possible before notifying law enforcement.
Two Counts Were Dismissed Before Trial
Cao was originally indicted in May 2024 on 17 federal counts. The case later changed after one customer in his mid-90s gave investigators different information about a $100,000 transfer and an account prosecutors had initially treated as unauthorized.
The customer later told the FBI that he had opened the account and authorized the $100,000 transfer. The government subsequently asked the court to dismiss the corresponding bank fraud and aggravated identity theft counts, along with a related forfeiture allegation.
Judge Calabrese granted that request in April 2025, dismissing Counts 6 and 14 without prejudice. Cao also sought access to grand jury transcripts, arguing that the issues involving that customer and other parts of the investigation raised questions about what had been presented to the grand jury.
The court denied that request. Judge Calabrese found that the circumstances involving the dismissed counts did not provide a basis for disclosure of the broader grand jury record and that the indictment showed probable cause for the remaining allegations independent of those counts.
The opinion also addressed errors in descriptions of certain IP-address evidence. The government acknowledged that one affidavit referred to a Bank of America account when the account at issue was actually Cao’s Robinhood account. It also acknowledged that another IP address had incorrectly been described as being located in St. Louis; prosecutors said it was instead associated with a mobile IP assigned to the network provider for Cao’s cellphone carrier. The court found that neither issue undermined the grand jury’s probable-cause determination.
The case went to trial on the remaining 15 counts in February 2026. After a five-day trial, the jury convicted Cao on all 15.
Cao Appealed Four Days After Sentencing
Cao’s sentence was imposed Sept. 17. Four days later, a case was opened in the U.S. Court of Appeals for the Sixth Circuit.
A federal appellate docket mirrored by Justia shows that United States v. Yue Cao, Case No. 26-3859, was opened Sept. 21. The docket states that a notice was filed by Cao as the appellant and that a transcript is needed. The Sept. 21 docket entry does not identify the issues Cao intends to raise on appeal.
Customers Can Watch for Changes They Did Not Make
The Federal Deposit Insurance Corporation advises customers to monitor statements and contact their bank when an expected statement does not arrive, because account documentation can be redirected. The agency also recommends reviewing transactions for unauthorized activity. A separate FDIC guide notes that banks may offer alerts for account activity, password changes or unusual activity.
The Federal Trade Commission identifies unexplained withdrawals, accounts a consumer does not recognize and unexpectedly missing bills as possible signs of identity theft.