A Florida woman has been sentenced to 22 months in prison for conspiracy to traffic thousands of stolen Windows 10 and MS Office keys via their Certificate of Authenticity stickers
The US Attorney's Office for the Middle District of Florida has announced the sentencing of a 52-year-old woman after she was found guilty of "conspiring to traffic in illicit Microsoft Certificate of Authenticity (COA) labels."
Heidi Richards, a resident of Brandon, Florida, was sentenced to 22 months in US federal prison for her part in the scheme, alongside a $50,000 fine.
Richards operated an e-commerce business called Trinity Software Distribution, which the Attorney's Office claims was used to purchase millions of dollars worth of genuine, standalone Microsoft COA labels at prices significantly lower than the the retail price of the associated software (via Bleeping Computer).
COA labels are small stickers carrying Microsoft product key codes, which can then be used to activate products sold as physical media including Windows 10 and MS Office, as was the case here.
Richards, along with her employees, were said to have harvested the product key codes from tens of thousands of stickers—typing them by hand into Excel documents—before selling them on in bulk to the company's customers. COA labels are not to be sold separately from the license and hardware that they are intended to accompany, according to federal law.
The trafficking of the illicit labels was said to occur between July 2018 and January 2023, and Richard's company is said to have wired $5,148,181.50 to the original Texas-based supplier during this period—although it's unclear exactly how much profit was made on the keys during this time.
The indictment lists a number of bulk purchases of the labels over a roughly five-and-a-half-year period, with the largest said to have been "approximately $100,000". Still, with Richards now sentenced and the scheme unravelled, it looks like the license resale game is now up. Who knew there were so many illicit gains to be made in a sticker? Or thousands of them, at the very least.