Skip to main content

John Toney


John Toney joined EY in December 2015 as a Senior Manager in the Fraud Investigation Dispute Services practice. Prior to joining EY, John served as a Special Agent with the US Secret Service, specializing in electronic crimes, critical systems protection, and protective operations. John began his US Secret Service career assigned to the financial crimes unit of the Philadelphia Field Office. In this role, he led multi- state investigations dealing with bank
fraud, large scale identity theft, and violations of the Bank Secrecy Act. John was among the first agents selected for the Network Intrusion Response (NITRO) program. Through training designed by the Department of Defense, and US Secret Service, John studied advanced concepts in network architecture, packet analysis, and penetration testing. He investigated
crimes ranging from e-commerce data thefts to privilege escalation exploits. His work was also formally recognized by the National Center for Missing and Exploited Children for the identification of eighteen child victims and the arrest of their abuser. He has served as a subject matter expert for the US Attorney’s Office in the Eastern District of Pennsylvania, educating Assistant US Attorneys on cyber investigations. John has extensive trial experience, managing all phases of trial preparation as well as appearing in US District
Court, before federal Grand Juries, and preparing civil asset forfeiture matters. John’s casework has also withstood review by the US Circuit Court of Appeals. John has led digital forensics and incident response (DFIR) investigations such as: Ransomware attacks (to include incident triage, server decryption, data restoration, enterprise remediation, active
monitoring, and follow-up investigation under attorney-client privilege); polymorphic worm infections; shadow investigations; phishing attacks; business email compromise attacks; unauthorized access and privilege escalations; and loss of PII requiring victim notification. John also has extensive global experience, conducting on-site assessments in Belgium,
Mauritius, Namibia, Botswana, Vietnam, and Cambodia. He reviewed controls and policies governing the protection of assets valued between $16 million dollars and $240 million dollars per site, and designed remediation solutions for gaps requiring urgent attention. John has supervised nationwide teams of investigators during a large scope Anti-Money Laundering transaction lookback involving 500,000 accounts and 250 million transactions
spanning a four year period. During the course of this engagement, John traced transactions involving high risk jurisdictions, and completed detailed risk assessments based upon customer profile, due diligence information, and movement of funds internationally.