Melbourne man Patrick Hric pleads guilty after using stolen data to access bank accounts, personal information

A woman watched her pay disappear in “real time” from her banking app as payments were made to Dan Murphy’s, UberEats and BP by an Australian hacker, a court has been told. Details of how Patrick Michael Hric was able to impersonate the woman online, and eight other victims, were aired in the County Court in Melbourne on Thursday as the 35-year-old pleaded guilty to 12 charges. Outlining the facts of the case, prosecutor Jessica Mackay said Hric was caught with personal identity information for an estimated 1500 people when he was arrested by the AFP at his Lynbrook home in March last year. These included pay slips, bank details, government account information and passports or drivers licences. The court was told Hric had begun buying “key logger files” from a dark web marketplace the year prior for $US10 each, which contained logs of data covertly recorded from personal devices. Using software to “circumvent” security measures from mobile service provider TPG in a process “akin to hacking”, he then began attempting to transfer victims’ phone numbers to TPG eSIMS he controlled using the stolen data, the prosecutor said. Ms MacKay told the court police had identified nine victims who then provided statements to police but also located records of 35 other phone numbers successfully “ported” and 54 unsuccessful attempts. Of the identified victims, Hric was able to access personal accounts for eight of them through the phone number porting method while the ninth involved using a man’s Latitude credit card to buy three Apple MacBook laptops, a tablet and a Samsung phone for about $12,000 from JB Hi-Fi. Ms MacKay said police identified a Facebook account under a false name linked to Hric offering to sell three MacBooks for $2000 each in October 2024. On July 19, 2024, Hric was able to access one victim’s CommSec trading platform, where he placed an order to sell 800 shares for $23,000. The man was able to block the move after receiving an email from the platform. Days later, on July 21, 2024, another victim noticed between $330 and $350 was missing from her NAB account, later watching live as purchases were made at Dan Murphy’s, UberEats and BP. Ms MacKay said the woman watched her weekly wage deposit “disappear in real time” as somewhere between $1300 and $1400 was taken before NAB was able to recoup $920. Hric gained access to another woman’s phone number on July 23, with her discovering that about $9000 had been transferred out of her bank account the following day. The court was told a few days later the woman received a UBank credit card Hric had set up, and a month later on August 8 the woman attempted to transfer her husband $300 to pay for his Meals on Wheels service. Ms MacKay said after being told the Meals on Wheels debit had been declined, the woman discovered his payee details, along with several others, had been changed in her bank app. A fourth victim was contacted by a friend who’d received a $5000 transfer from her and a suspicious message. “I’ve accidentally sent a 5k payment to you, can you send it back to me. Do you have my current bank details?” the message read. Ms MacKay said Hric had been “flagged by every bank under the sun” and was unable to hold a bank account at the time, with the Crown alleging this message was a “roundabout” way for Hric to attempt to receive the cash. She told the court Hric had also opened bank accounts, credit cards or cryptocurrency accounts in the names of others. Commvault CEO Sanjay Mirchandani explains how companies can recognise the threat of cyberattacks and recover quickly. In a police interview after his arrest, the self-described “pretty tech-savvy guy” said once he’d been able to take control of a person’s mobile phone number, he’d begin going through their email accounts for banking information by requesting a one-time password be sent over text. “The end game was always financial gain, probably eight out of 10 times I would get nothing out of it,” he said. Hric pleaded guilty to nine counts of unauthorised access to data with intent to commit a serious offence, one count of dealing with identity information, one count of obtaining financial advantage by deception and one count of possessing identity information. The court was told the actual monetary benefit he received was unknown. In statements to the court, two victims said the experience had been violating, leaving them feeling an ongoing lack of security. “This was not just a theft, it was an invasion into the most private parts of my life,” one man said. Hric’s barrister, Stephanie Gillahan, told the court that while the offending was sophisticated, her client’s motivation was less so. She said Hric had been motivated by his ice addiction, likening his behaviour to “almost the equivalent of stealing credit cards”. Ms Gillahan said he had co-operated fully with police upon his arrest even to the extent of explaining the weaknesses he’d exploited so they “knew how other people were operating”. Hric, the court was told, had written a letter of apology expressly stating he was not asking for mercy and was prepared to face the consequences of his actions. Ms Gillahan said hearing about the impact of his offending on victims had left an impact on her client, arguing he had good prospects of rehabilitation if he stays off ice. The court was told both prosecutors and defence agreed a term of imprisonment was appropriate for the offending. Hric’s case was adjourned by Judge Anthony Lewis and the plea hearing will continue at a later date.