Buffalo ISO Gets 87 Months for Loan Fraud Using 63 Customers’ Identities
Quick Take: Paul Paredes, 54, of Buffalo, New York, has been sentenced to 87 months in federal prison for a scheme in which, prosecutors said, he used the identities of at least 63 people to take financing from at least 23 lenders, the U.S. Attorney’s Office for the Western District of New York announced on November 5.
Most of the fraud that reaches this industry’s news starts with a borrower lying about their own business. Inflated revenue, doctored bank statements, a company that only exists on paper. This case runs the other way. The people whose names went on the applications never applied for anything. The person who did was the consultant (ISO) they had trusted with their paperwork.
The man in the middle
Paul Paredes had owned J&E Business Consulting LLC since 2013. According to the Justice Department, the firm provided merchant services to client businesses, including acting as an ISO (independent Sales Organization), also commonly called a broker, between credit card processing companies and smaller retail businesses.
That role put him where every intermediary in commercial finance sits. His customers gave J&E their owners’ driver’s licenses, Social Security numbers and email addresses, along with their bank account information.
Between April 2019 and August 2023, prosecutors said, Paredes used that information to submit hundreds of fraudulent financing applications to dozens of lenders under his customers’ identities, without their knowledge or consent. The applications were for goods and services he supposedly provided, and the money was paid into bank accounts he controlled, at least 12 of them. Prosecutors said the applications were sent from Rochester to lenders in other states.
How this loan fraud stayed quiet for four years
Two details in the release explain how the scheme ran as long as it did.
First, Paredes used part of the money to make payments to the lenders, which prosecutors said was meant to avoid detection. A financing agreement that pays on time does not trigger collections, and a collections call is usually how someone finds out their name is on a contract they never signed.
Second, when customers did hear from lenders and asked him about it, prosecutors said he misled them about what the contact was for and told them he would handle it. The person they naturally turned to with questions was the person running the scheme.
The rest of the money went to his personal expenses and to salaries and operating costs at J&E, according to the release.
The case by the numbers
Identities used: at least 63
Lenders defrauded: at least 23, including lenders in New Jersey, Virginia, Illinois, Texas, North Carolina, Florida, Washington, Pennsylvania, Iowa, Colorado and Minnesota
Bank accounts he controlled: at least 12
Total loss: at least $3.5 million, per prosecutors
Restitution ordered: about $8.75 million to 57 victims
Sentence: 87 months in federal prison
Court records give some context for why the restitution order is so much larger than the loss figure, though not a full explanation. The docket shows the loss amount was still an open issue in June 2026, and in July Paredes and prosecutors signed a sentencing stipulation, which avoided an evidentiary hearing the government said would otherwise be needed. A court order from October says the two sides had also agreed on the restitution amount, and that much of the nearly 300 pages the government filed before sentencing was documentation supporting restitution claims.
Neither the release nor the public docket says how either figure was calculated. We were not able to review the presentence report, as it is sealed.
The Justice Department has not named the lenders, but court records and news reports show at least three filed civil suits in 2023 against Paredes’s company. BFG Corporation, which does business as Byline Financial Group, sued J&E Business Consulting LLC and Paredes in federal court in Illinois, alleging he used former customers’ identities to take out five equipment finance agreements, and Stearns Bank National Association sued J&E Business Consulting LLC in federal court in Minnesota. Channel Partners Capital LLC, a New York City finance company, also sued Paredes and his company, the NY Daily Record reported. These are civil claims, and neither the public criminal docket nor the Justice Department’s releases name any lender as a victim.
How the case got here
Paredes pleaded guilty to wire fraud and aggravated identity theft in October 2024. At the time, the U.S. Attorney’s Office said the charges carried a mandatory minimum of two years in prison and a maximum of 20 years. Sentencing was originally set for April 2025. Chief U.S. District Judge Elizabeth A. Wolford imposed the 87-month term on November 5, 2026: 63 months on the first count and 24 months on the second, served back-to-back.
Assistant U.S. Attorney Katelyn M. Hartford prosecuted the case. It was investigated by the FBI, IRS Criminal Investigation, and the New York State Department of Financial Services’ Criminal Investigation Bureau.
What funders and brokers should take from it?
The release does not describe what checks the lenders ran, so this is not a story about any one funder missing something. It is a clear picture of where the gaps sit when the same ISO holds the customer’s identity, the customer’s paperwork, and the account the money lands in.
The documents were real. Every identity on these applications was genuine, handed over by its owner for a different purpose. Identity checks pass when the identity is real. What they cannot confirm is consent. A direct call to the business owner, on a number found independently rather than the one on the application, is one of a few checks that test it.
Follow the money. As the Justice Department describes it, the financing was for goods and services Paredes said he provided, and the funds went to accounts he controlled. When a deal pays a third party rather than the business itself, confirming with the customer that they asked for the financing and received what it paid for closes much of that gap.
A performing file is not a verified file. The payments to lenders kept these accounts quiet. Good payment history tells you the money is moving. It does not tell you who is moving it.
Look across files, not only within one. Hundreds of applications in different names, routed through a dozen accounts controlled by one person, is the kind of pattern that shows up when payees, contact details, and submitting parties are compared across deals, and across lenders where that data is shared.
For brokers and ISOs, the lesson is about custody. Driver’s licenses, Social Security numbers, and bank details sit in broker inboxes and CRMs every day, because the business requires it. This case is what abuse of that access looks like, and a good reason for every shop holding that data to know exactly who can reach it.
The identities were real. The customers who owned them never applied.
For another case built on other people’s names, read The Receivables Didn’t Exist: Inside a $4.6 Million Factoring Fraud.