Dark-web card data, 98 Bunnings items, and one PowerPass account: how a South Australian man was caught
Aijaypal Tim Sanghera used stolen credit card numbers, almost certainly bought on the dark web, to order $15,899 worth of goods from Bunnings stores across South Australia. A loyalty account tied every transaction to his name.
Key points
- Aijaypal Tim Sanghera, 38, pleaded guilty to 12 counts of dishonest dealing with property at Berri Magistrates Court in South Australia.
- He placed 11 click-and-collect orders across three Bunnings stores over five weeks in April and May 2026, totalling $15,899.65.
- Police believe he bought a bulk set of stolen credit card numbers from the dark web, a collection of hidden websites not accessible through normal browsers.
- Twenty of the 98 items ordered were $500 Bunnings gift cards, all linked to Sanghera's own Bunnings PowerPass trade loyalty account.
- Sanghera was sentenced to four months in prison and a two-month good behaviour bond.
Some crimes are elaborate. This one was almost mundane, which is exactly what makes it worth understanding.
Over five weeks in April and May 2026, Sanghera placed 11 click-and-collect orders at Bunnings stores in Berri, Parafield Gardens and Edwardstown. He paid with stolen credit card numbers that police prosecutors, as reported by ABC News Australia, told the court were "likely" purchased as a bulk dataset from the dark web. Our card skimmer story from 15 August showed how stolen card data moves from physical readers into exactly these bulk datasets; the pipeline from breach to dark-web sale is well-worn.
How did he get caught?
He used his own loyalty account. Twenty of the 98 items were $500 Bunnings gift cards, and every one was registered to his Bunnings PowerPass account, a trade membership scheme that logs purchases. That single link gave investigators a clear thread to pull.
Police searched Sanghera's home in Bookpurnong on 10 June 2026 and found some goods still there, along with less than a gram of methamphetamine, three ice pipes and a prohibited weapon.
| Detail | Figure |
|---|---|
| Total fraudulent spend | $15,899.65 |
| Items ordered | 98 |
| Gift cards purchased | 20 x $500 |
| Bunnings' unrecovered loss | $14,592 |
| Prison sentence | 4 months |
| Good behaviour bond | 2 months |
The credit card companies reversed the charges, so the individuals whose details were used weren't left out of pocket. Bunnings absorbed the $14,592 that wasn't recovered.
Should ordinary people worry about their card details?
Yes, but calmly. Stolen card numbers circulate on the dark web long after the original breach that exposed them. You may never know your details were taken until a fraudulent charge appears. Check statements at least weekly. If your card issuer offers instant transaction alerts, turn them on. Report anything unfamiliar immediately; banks are generally required to reverse fraudulent charges, as happened here.
Magistrate Jay Pandya described Sanghera's offending as "deliberate and relentless", driven by the need to fund drug use. She accepted his guilty plea and noted genuine remorse, but said community protection had to come first. Defence lawyer Craig Caldicott argued that prison doesn't address addiction at its root, a point the court acknowledged in the relatively short sentence.
The deeper lesson isn't about Bunnings or dark-web markets. It's about how a loyalty account, designed to reward customers, became the thing that made a fraud trail trivially easy to follow. Convenience and accountability run in both directions.
