← back to the index
YL-013 Crypto yield scheme · United States 2022

IcomTech — A Trading Club Targeting Immigrant Savers Collapsed into Conviction

yield-savingsconvictedcollapse-era
Program
IcomTech
Total Losses
$8.4 million
Investors
~190 investors (documented victims)
Status
Convicted

Summary

IcomTech, a New York-based cryptocurrency scheme operated principally by Marco Ruiz Ochoa, also known as Miguel Ángel Caballero Ochoa, defrauded at least 190 investors of approximately $8.4 million between 2018 and 2019 by falsely claiming to operate a crypto trading platform that generated consistent daily returns. Co-operator David Brend assisted in recruitment and promotion. The scheme drew primarily from Dominican-American and other immigrant communities in New York City and the surrounding area, presenting membership as access to a professional crypto trading system otherwise unavailable to ordinary retail investors.

IcomTech offered members purported returns from automated cryptocurrency trading, collected deposits denominated in Bitcoin and other cryptocurrencies, and paid early participants with funds contributed by later recruits — the structural hallmark of a Ponzi scheme with no underlying trading operation. Members were encouraged to recruit new participants in exchange for commissions on downstream deposits, adding a multi-level marketing dimension that accelerated both growth and eventual losses. The scheme operated through in-person presentations, community gatherings, and social media promotion, in some cases held at venues familiar to the immigrant communities it targeted.

By late 2019 withdrawals had effectively ceased and the scheme collapsed. Federal prosecutors charged Ochoa and Brend with wire fraud and money laundering conspiracy. Ochoa was arrested and ultimately convicted in 2022; Brend entered a guilty plea. Victim restitution was ordered but recovery remained limited, with much of the $8.4 million dissipated through Ochoa's personal expenditures.

Timeline

2018
IcomTech launches
Marco Ruiz Ochoa and David Brend establish IcomTech in New York, marketing it as a professional cryptocurrency trading platform offering consistent daily returns to members who deposit Bitcoin and other crypto assets.
2018–2019
Recruitment through immigrant communities
Promoters reach into Dominican-American communities in New York and New Jersey through in-person presentations, social media, and referral networks; depositors are encouraged to recruit new members and earn commissions on downstream deposits.
2018–2019
Ponzi payments sustained by new inflows
IcomTech distributes daily returns to early investors funded entirely by capital from later depositors; no trading operation generates the claimed profits; Ochoa spends substantial funds on personal luxury items and lifestyle expenses.
Late 2019
Withdrawals freeze
IcomTech stops processing withdrawal requests; members who attempt to access their funds receive no payment; the scheme effectively collapses as new recruitment slows.
2019–2020
Federal investigation opens
The Department of Justice and FBI begin investigating IcomTech following victim complaints; blockchain forensics trace deposit flows to Ochoa-controlled accounts and personal expenditures.
October 2020
Indictment unsealed
A federal grand jury in the Southern District of New York indicts Marco Ruiz Ochoa and David Brend on charges of wire fraud conspiracy and money laundering conspiracy; Ochoa is identified as the primary architect of the scheme.
2020–2021
Brend pleads guilty
David Brend enters a guilty plea and cooperates with prosecutors; he is later sentenced on reduced charges.
2022
Ochoa convicted
Marco Ruiz Ochoa is convicted at trial in the Southern District of New York on wire fraud and money laundering conspiracy counts; the court finds that the scheme defrauded investors of $8.4 million between 2018 and 2019.
2022
Sentencing
Ochoa is sentenced to prison; the court orders restitution for identified victims; recovery prospects remain limited given dissipation of investor funds.
2022–present
Victim recovery efforts continue
Federal prosecutors and victim advocates work to identify all eligible victims; no substantial asset recovery fund has been established to restore investor losses.

The Platform: Technological Credibility Without a Trading Operation

IcomTech was marketed not as a speculative investment but as a membership in a professional trading infrastructure that happened to be accessible in community settings. Promoters presented the platform as a sophisticated system that executed cryptocurrency arbitrage and trading across multiple exchanges, generating daily returns that members received as a share of the platform's profits. The presentation at in-person events, often in community centers, churches, or private homes, used laptop demonstrations, projected earnings charts, and testimonials from early members who had received genuine payments — payments funded by later deposits rather than any trading revenue.

The claim of daily profitability was central to the scheme's appeal and its credibility problem. Legitimate asset managers in any jurisdiction do not offer guaranteed daily returns on volatile assets; the mechanics of real arbitrage trading involve risk, slippage, and operational costs that preclude guaranteed outcomes. But the platform's community presentation context — explaining cryptocurrency to audiences encountering it primarily through this scheme — meant that the professional framing of the pitch carried weight that it would not have carried among investors with broader market experience. Promoters were fluent in Spanish and tailored their communications to audiences whose primary financial references were labor income and remittances rather than capital markets.

Referral commissions were structured to reward members who brought in new depositors, creating a second income stream alongside the stated trading returns. This produced a network of participants who had a direct financial stake in the scheme's continued growth and who functioned as credibility intermediaries within their own social networks — friends and family members vouching for the platform based on payments they had personally received.

The Mechanism: How Deposits Were Taken and Redirected

Investors deposited Bitcoin and other cryptocurrencies into IcomTech accounts, surrendering custody of those assets at the point of transfer. Unlike schemes that rely on centralized exchange infrastructure or documented wallet architectures, IcomTech operated through a relatively simple custody model: funds were directed to Ochoa-controlled wallets, commingled, and distributed from a single pool that served both payment obligations to existing members and Ochoa's personal accounts.

Department of Justice filings documented that Ochoa used investor deposits to purchase personal luxury goods, fund travel, and cover living expenses inconsistent with the returns that an operator legitimately managing $8.4 million in trading capital would have access to. The absence of any segregation between investor funds and Ochoa's personal accounts was a defining structural feature of the fraud: there was never a trading account in the conventional sense, only an aggregated deposit pool from which obligations and personal expenses were paid until the pool was insufficient to sustain both simultaneously.

When withdrawal requests exceeded the scheme's ability to pay — the defining moment of collapse for any Ponzi structure — Ochoa did not announce closure, pivot to a new branding, or transfer funds to a jurisdiction beyond enforcement reach. The scheme simply stopped paying. Members who had recruited their own social networks to join the platform were left to manage the consequences within those relationships. For investors who had reinvested prior payouts rather than withdrawing them, the compounding of initial deposits into larger balances meant that their documented losses were higher than their original cash outlays, a distinction that the DOJ's loss calculation attempted to reflect accurately.

The Harm: What $8.4 Million Meant to Working Investors

The dollar figure attached to IcomTech — $8.4 million — is smaller than those of many schemes in this archive, but its distribution among the victim population requires context. Court filings identified approximately 190 documented investors, producing an average documented loss of approximately $44,000 per victim. For working-class families in New York City's immigrant communities, where participants were described in federal proceedings as having invested savings accumulated through wage labor, that figure represents months to years of household income, in many cases contributed as lump-sum deposits from capital that had no near-term replacement.

Victims who recruited their own family members and community contacts faced losses that extended beyond the financial: the social cost of having vouched for a scheme that subsequently defrauded people within one's own network is not reflected in the court's restitution order. Federal victim advocacy resources documented cases of families who had pooled resources across multiple contributing members to invest together, amplifying the household impact of a single investment decision.

The targeting of immigrant communities is not incidental background context for this case — it is the scheme's operational logic. IcomTech's operators chose to operate within communities where trust is built through shared language and cultural context, where skepticism toward financial institutions may be higher than in broader populations (often for historically justified reasons), and where there is limited institutional infrastructure for reporting fraud or accessing investor protection resources. That operational choice was deliberate and, in the language of the indictment, was part of the mechanism of the fraud itself.

The Five Factors

01
Community-trust architecture as fraud infrastructure
IcomTech succeeded not by placing advertisements in financial media but by embedding itself within existing social trust networks in immigrant communities. Promoters who shared language, cultural background, and in some cases family or workplace relationships with their recruits functioned as credibility intermediaries more effective than any external marketing channel. The scheme's architecture was built to route investment decisions through trusted personal relationships rather than through independent due diligence — a mechanism that exploits the social capital of a community precisely to damage it.
02
Yield-promise psychology adapted for new investors
The guarantee of daily returns from a described-but-opaque trading system operated with particular effectiveness among audiences encountering cryptocurrency primarily through this scheme. When a platform is the first exposure to an asset class, no prior knowledge base exists to calibrate the implausibility of the stated returns. IcomTech's operators adapted the standard yield-promise playbook to a context where comparisons to legitimate yield instruments were unlikely to occur spontaneously to investors in the pitch environment.
03
Referral commissions as silencing and complicity mechanisms
Multi-level commission structures create populations of participants who are financially incentivized to advocate for the scheme and financially harmed by any public skepticism that slows recruitment. Members who had recruited family members to invest were, by definition, unable to publicly voice doubt without confronting the consequences of that doubt for people they had personally brought in. The commission structure converted recruits into embedded promoters who suppressed their own misgivings for reasons that were psychologically and financially coherent given their circumstances.
04
Unregulated crypto custody without verification
IcomTech investors transferred cryptocurrency to operator-controlled addresses at the point of deposit and had no subsequent technical means of verifying that those assets existed, were segregated, or were deployed in trading as claimed. No independent custodian held the funds; no audited reserve statement was published; no blockchain-verifiable trading activity corresponded to the described strategy. The regulatory gap in crypto custody requirements — which at the time imposed no independent verification obligations on retail-facing yield platforms — meant that the scheme's stated activity was entirely unverifiable by design.
05
Enforcement gap in community-scale fraud
At $8.4 million, IcomTech operated at a scale that historically received less federal enforcement attention than nine- and ten-figure schemes, despite the harm relative to victims' resources being comparable or greater. The scheme operated for approximately two years before federal charges were filed. The enforcement gap for small- to medium-scale community-targeted crypto fraud reflects both investigative resource allocation and the difficulty of aggregating dispersed, community-contained victim reports into cases that reach federal prosecution thresholds. IcomTech was prosecuted — but many comparable schemes in similar communities have not been.

Aftermath

Marco Ruiz Ochoa was convicted in the Southern District of New York in 2022 on wire fraud and money laundering conspiracy charges relating to the IcomTech scheme. He was sentenced to prison and ordered to pay restitution to identified victims. David Brend entered a guilty plea and was sentenced separately on related charges following his cooperation with federal prosecutors.

Victim recovery from the $8.4 million in losses was limited. Ochoa's personal expenditure of investor funds — on travel, personal goods, and lifestyle costs — meant that a substantial portion of the deposited capital was dissipated rather than retained in recoverable form. Asset forfeiture proceedings attempted to claw back identifiable proceeds, but the restitution order exceeded recoverable assets. Identified victims were entitled to file claims in the federal restitution process; the number of investors who ultimately recovered any amount was not fully disclosed in public proceedings.

The IcomTech prosecution contributed to a growing body of DOJ crypto fraud cases focused on community-targeted schemes and has been cited in outreach materials directed at immigrant investor protection. The FBI and CFTC have subsequently published guidance in Spanish and other languages addressing crypto investment fraud specifically, in part in response to the pattern of schemes — IcomTech among them — that exploited immigrant community networks.

Lessons

  1. Guaranteed daily returns on cryptocurrency deposits are structurally impossible from legitimate trading operations; any platform making this claim without independently audited trade records and regulated custodial arrangements should be treated as presumptively fraudulent regardless of the social context in which the offer is made.
  2. Crypto investment platforms operating through community presentations and referral networks rather than regulated channels and public disclosures are not supplementary to formal investment infrastructure — their deliberate avoidance of regulated channels is itself a warning sign.
  3. Before depositing cryptocurrency into any yield platform, verify that assets are held by an independent custodian, that trading activity is audited by a named third party, and that the operator is registered with a relevant financial regulator; absence of all three is sufficient grounds to decline.
  4. Regulators and prosecutors should weight enforcement resources toward community-targeted fraud based on harm relative to victim resources, not solely on absolute dollar totals; a scheme causing $44,000 in average losses among working-class investors warrants the same analytical priority as larger-scale frauds affecting wealthier populations.
  5. Investors who are approached by community members with a crypto yield opportunity should independently verify the platform through official financial regulator databases before investing, regardless of the relationship with the person making the introduction.

References