Police on May 20 arrested a 33-year-old Canoga Park, Calif. man by warrant in connection with the theft of $1,272,500 from a New Canaan-based real estate investment company in 2024.
The man is accused of hacking email accounts at the company and using them to fool a bank into wiring the money into his own account, according to the affidavit of New Canaan Police Office Thomas Patten that forms the major part of an arrest warrant application signed in October 2025 by state Superior Court judge Bruce Hudock.
The company reported the fraud to police in March 2024, Patten said in the affidavit, after making “an investment into a real estate project in the metro Boston area.”
“The construction lender, Santander Bank, required [the company] to deposit $2,172,500 with the bank as a completion guaranty for hitting certain construction milestones,” the arrest warrant application said.
The company had started hitting those milestones in February 2024 “and they were to have $1,272,500 released back to their investor account at their Bankwell bank account at 156 Cherry Street in New Canaan,” but those funds never arrived, the application said.
Company officials soon discovered that their emails had been hacked for some unknown period of time and were “being monitored by the perpetrator(s),” whose methodology included funneling emails related to the wire transfer into unopened folders in Microsoft Outlook while also using email accounts “to provide alternative wire instructions,” Patten said in the affidavit.
“Santander Bank normally sends an encrypted form for wire instructions, however, in this instance this one was not done,” the affidavit said. “The perpetrator(s) filled out the Santander Bank wire form, from Holzberg’s hacked account, which was then forwarded to the real Santander Bank team.”
“A spoofed email, made to look like [a company employee’s] email, was also sent to the real Santander Bank team explaining why the account instructions would be changing,” it said. “Believing this email to be authentic, there was no phone call made to [another company employee], which is protocol to confirm the wire verbally. Santander Bank then sent the funds from the account at their bank.”
The funds were sent to the perpetrator’s account “late in the day of Feb. 23” in 2024, the application said.
“[The company] received a fraudulent email from a spoofed Santander Bank email account saying that things were almost wrapped up,” Patten said in the affidavit. “[A company employee] was on a call for other matters with coworkers on February 20th when they realized that the fraud had been committed. When they looked at the email from that morning they discovered the spoofed email addresses and began their own internal forensic analysis.”
NCPD investigators found that a fraudulent account had been created at Citibank with a name similar to the defrauded New Canaan company. In April 2024, investigators obtained a search-and-seizure warrant for Citibank records and identified the perpetrator by name as a Los Angeles man. Surveillance video at a Citibank branch on Wilshire Boulevard showed “the same white male with a beard,” and of the images captured showed a “tattoo on his right tricep”—the same that showed up in a photo on the suspect’s Facebook profile.
During their investigation, New Canaan Police found that the man had committed crimes elsewhere.
For example, police while reviewing bank records flagged a $100,000 transfer and discovered that it was a fraud that had been reported to authorities in Pennsylvania. In addition, on April 30, 2024, during a motor vehicle stop in Los Angeles for having tinted front windows, the suspect “became uncooperative and ignored all commands,” Patten said, citing information from a Los Angeles County Sheriff’s Department report. “He was subsequently removed from the vehicle and placed in handcuffs. A search incident to arrest found that inside the vehicle were three wallets containing 14 fraudulent credit cards in the names of several different people, 5 fraudulent Social Security cards in the names of several different people, and 18 fraudulent driver’s licenses with [the suspect’s] picture on them but in the names of several different people.” (His booking photo showed the same tattoo that authorities saw in the Citibank video surveillance footage.)
Patten also followed up on the owner of the residence that the man had listed as his address in bank records. The Los Angeles landlord told police that the man “is no longer a tenant and left without paying his last month’s payment and also left the apartment completely destroyed.”
Police charged him with first-degree larceny, first-degree identity theft and first-degree computer crime.
The man turned himself in to police at about 5:22 a.m. on May 20. He was held on $2 million bond and scheduled to appear the same day. The court reduced his bond to $100,000 and the man remains in custody, according to Connecticut Judicial Branch records. He has not yet pleaded, the records show. His lawyer is Hartford-based Gerace & Cavallari LLC and he’s now scheduled for arraignment July 29.