A US federal court has sentenced a Nigerian national to eight years in prison for hacking tax preparation businesses, stealing sensitive customer information and using those identities to obtain millions of dollars in fraudulent tax refunds and government loans.
Chukwuemeka Victor Amachukwu, 40, had earlier pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud.
Prosecutors said Amachukwu and his associates compromised US tax businesses and stole personal and tax information belonging to at least 800 customers.
The group then used those identities to submit fraudulent tax returns and loan applications.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Tax Firms Targeted Through Spearphishing Attacks
Federal prosecutors said the hacking campaign targeted tax preparation businesses in New York, Texas and other US states between 2019 and 2021.
The attackers used spearphishing emails to gain unauthorised access to company computers.
Spearphishing is a targeted form of phishing.
Instead of sending the same fraudulent message to thousands of people, attackers research a particular employee or organisation and craft an email designed to appear legitimate.
Once an employee opens a malicious attachment, follows a fraudulent link or provides credentials, attackers may gain access to internal systems.
In this case, prosecutors said the hackers stole tax records and personally identifiable information belonging to hundreds of customers.
That information could include details valuable for filing fraudulent tax returns in someone else’s name.
The conspirators sought around $8.4 million in fraudulent tax refunds, according to the Justice Department.
They successfully obtained approximately $2.5 million.
Stolen Identities Also Used for Disaster Loans
The fraud extended beyond tax refunds.
Prosecutors said stolen identities were also used to make fraudulent applications to the US Small Business Administration’s Economic Injury Disaster Loan programme.
The programme provided financial support to qualifying businesses affected by the COVID-19 pandemic.
Amachukwu and his co-conspirators obtained around $819,000 through fraudulent loan applications, according to the Justice Department.
Combined with the tax refunds, the schemes generated roughly $3.3 million from government programmes.
This is the source of the figure referenced in reports describing money stolen from US taxpayers.
The case demonstrates why breaches of tax firms can be especially damaging.
A compromised accounting or tax preparation business can hold identity information belonging to hundreds or thousands of customers.
One successful intrusion can therefore give criminals enough data to launch many separate fraud attempts.
Defendant Also Ran Separate $7 Million Investment Fraud
Amachukwu was also involved in an unrelated investment fraud targeting victims in the United States.
Prosecutors said he impersonated a wealthy overseas financier and offered victims supposed investments involving valuable standby letters of credit.
A standby letter of credit is a legitimate financial instrument generally used to guarantee payment if a party fails to meet an obligation.
But prosecutors said the investments offered in this case did not actually exist.
Amachukwu and his co-conspirators allegedly collected more than $7 million from victims through the scheme.
The investment fraud significantly increased the overall financial impact attributed to his criminal activity, although it was separate from the $3.3 million obtained through fraudulent tax refunds and government loans.
US District Judge Paul G. Gardephe sentenced Amachukwu to eight years in prison.
He will also serve one year of supervised release after completing the prison term.
The court ordered him to pay approximately $3.65 million in restitution and forfeit nearly $10.85 million.
Offshore Cybercrime Did Not Prevent Prosecution
Amachukwu operated outside the United States during much of the criminal activity.
He was extradited from France to the US in August 2025 before facing prosecution.
US Attorney Jamie McDonald said the defendant had believed he could safely operate offshore while targeting American victims.
The case illustrates the increasingly international nature of cyber-enabled financial fraud.
Attackers can compromise an organisation in one country, steal identities belonging to victims in several states and submit fraudulent financial claims remotely.
Law-enforcement agencies then have to combine digital evidence, bank records and international extradition procedures to bring suspects before a court.
The FBI investigated the case, while prosecutors from the Southern District of New York’s Complex Frauds and Cybercrime Unit handled the prosecution.
For businesses holding tax and identity information, the case is another reminder that phishing attacks are not merely an email-security problem.
A single compromised account can become the starting point for large-scale identity theft, tax fraud and misuse of government programmes.
What this means for you:
Tax firms and businesses holding sensitive customer records should treat targeted phishing emails as a major financial threat. Customers should also monitor tax filings and credit activity if a service provider reports a data breach.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
