John Toney

John joined EY in December 2015 as a senior manager in the Fraud Investigation & Dispute Services practice. Prior to joining EY, he served as a special agent with the U.S. Secret Service, specializing in electronic crimes, critical systems protection and protective operations.

John began his U.S. Secret Service career assigned to the financial crimes unit of the Philadelphia Field Office. In this role, he led multi-state investigations dealing with bank fraud, large scale identity theft and violations of the Bank Secrecy Act.

John was among the first agents selected for the Network Intrusion Response program. Through training designed by the Department of Defense and Secret Service, John studied advanced concepts in network architecture, packet analysis and penetration testing. He investigated crimes ranging from e-commerce data thefts to privilege escalation exploits. His work was also formally recognized by the National Center for Missing and Exploited Children for the identification of 18 child victims and the arrest of their abuser.

He has served as a subject matter expert for the U.S. Attorney’s Office in the Eastern District of Pennsylvania, educating assistant U.S. attorneys on cyber investigations. John has extensive trial experience, managing all phases of trial preparation as well as appearing in U.S. District Court, before federal Grand Juries and preparing civil asset forfeiture matters. John’s casework has also withstood review by the U.S. Circuit Court of Appeals.

John has led digital forensics and incident response investigations such as: ransomware attacks (to include incident triage, server decryption, data restoration, enterprise remediation, active monitoring and follow-up investigation under attorney-client privilege); polymorphic worm infections; shadow investigations; phishing attacks; business email compromise attacks; unauthorized access and privilege escalations; and loss of personally identifiable information requiring victim notification.

John also has extensive global experience, conducting on-site assessments in Belgium, Mauritius, Namibia, Botswana, Vietnam and Cambodia. He reviewed controls and policies governing the protection of assets valued between $16 million dollars and $240 million dollars per site, and designed remediation solutions for gaps requiring urgent attention.

John has supervised nationwide teams of investigators during a large scope anti-money laundering transaction lookback involving 500,000 accounts and 250 million transactions spanning a four year period. During the course of this engagement, John traced transactions involving high-risk jurisdictions, and completed detailed risk assessments based upon customer profile, due diligence information and movement of funds internationally.