The Prisoner Who Emailed Himself Free

On March 9, 2015, Neil Moore was in Wandsworth Prison, a maximum security prison in England, awaiting trial. He was charged with orchestrating a series of bank heists, with his modus operandi centering on fraud. He’d pretend to be a bank official and, via a bit of social engineering, convince (real) staffers at other financial institutions to wire him some cash. Using four different aliases — some male, some female — Moore ended up unlawfully acquiring £1,819,000 (about $2.65 million) in total, in eight such heists.

On March 10, 2015, Neil Moore was released from prison. An official from Southwark Crown Court emailed Wandsworth to inform them that Moore had been granted bail.

On March 13, 2015, attorneys (solicitors) went to Moore’s cell to interview him regarding his pending case. He, of course, wasn’t there. But he should have been. No one at Southwalk Crown Court had authorized his release.

If you’ve noticed what appears to be a typo there, congratulations — you caught something that the officials at Wandsworth did not. The email came from Southwalk — pay attention to the second to last letter — and not Southwark, as is the court’s actual name, per the BBC. Further, as NBC News notes, the sender’s email domain was @hmcts-gsi-gov.org.uk; the true email address of the Royal Court’s staff is @hmcts.gsi.gov.uk. The email was Moore’s latest act of fraud.

Moore took advantage of a tried-and-true (but scummy) practice called “typosquatting,” where a person or company registers a domain name similar to a common destination or otherwise recognizable entity. For example, ntyimes.com leads to something other than the New York Times (it goes to a page of ads). Of course, that’s not the web surfer’s intent —  the vast majority of those who transpose the “t” and “y” do so because they wanted to go to nytimes.com but their fingers erred along the way. Moore employed a similar strategy. He registered a domain name similar to that of the Royal Courts, using an illicit cell phone he somehow obtained while in Wandsworth, and then used his new domain to email himself a few days of freedom. Both the prosecutor and judge were impressed; the former called Moore’s stunt “extraordinary criminal inventiveness, deviousness and creativity,” while the latter called the escape “sophisticated and ingenious.”

But alas, it was all for naught.  On March 16, 2015, Moore turned himself in — why he opted against making a run for it has gone unreported. In April, he pled guilty to the eight counts of fraud he was originally charged with — and, in addition, one count of escape from lawful custody.

Bonus Fact: In 2004, a 17-year-old Canadian named Mike Rowe decided he needed a website, and, showing the humor consistent with being a 17-year-old, registered the domain name “MikeRoweSoft.com” (say it out loud). Microsoft, showing the humor consistent with being a multinational corporation, had their lawyers send Rowe a letter demanding that he hand over his domain name. Rowe responded by asking Microsoft to buy the domain; they countered with an offer of $10. (Yes, ten dollars.) Rowe rejected the offer. Microsoft’s ridiculousness made headlines and sparked thousands of people to visit his site. Ultimately, Rowe gave up the domain name — for some Microsoft loot, including an Xbox.

Take the Quiz: Identify the fictional owner of each of these fake email addresses.

From the Archives: The slave who shipped himself to freedom. (It worked.)

Related: A jail you can probably break out of.