Nigerian National Sentenced to 8 Years for Spearphishing Tax Preparation Firms
Chukwuemeka Victor Amachukwu, 40, a Nigerian national also known by the aliases "Chukwuemeka Victor Eletuo" and "So Kwan Leung," has been sentenced to 8 years in federal prison for his role in a multi-year spearphishing campaign against US tax preparation businesses. U.S. District Judge Paul G. Gardephe of the Southern District of New York (SDNY) handed down the sentence, which the U.S. Attorney's Office for SDNY announced on October 19, 2026. Amachukwu had pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud after being extradited from France. Starting around 2019, he and co-conspirators hacked into tax preparation firms in New York, Texas, and other states, stealing the tax and personally identifiable information (PII) of at least 800 customers and using it to file fraudulent refund claims and loan applications.
Case Details
| Attribute | Value |
|---|---|
| Defendant | Chukwuemeka Victor Amachukwu, 40 (aliases: Chukwuemeka Victor Eletuo, So Kwan Leung) |
| Nationality | Nigerian national |
| Co-conspirator | Kingsley Uchelue Utulu, plus other Nigeria-based conspirators |
| Charges | Conspiracy to commit computer intrusions; conspiracy to commit wire fraud |
| Plea | Guilty |
| Court | U.S. District Court, Southern District of New York |
| Sentencing Judge | U.S. District Judge Paul G. Gardephe |
| Sentence | 8 years in federal prison, 1 year supervised release |
| Restitution Ordered | $3,647,629.39 |
| Forfeiture Ordered | $10,846,634.39 |
| Extradition | From France to the United States |
| Scheme Period | Approximately 2019 – 2021 (tax fraud); investment fraud scheme separate and ongoing in parallel |
| Victims | At least 800 customers of hacked tax preparation businesses |
| Investigating Agency | Federal Bureau of Investigation (FBI), New York Field Office |
| Prosecuting Attorney | Assistant U.S. Attorney Daniel G. Nessim |
How It Worked
Spearphishing Tax Preparation Businesses
Beginning around 2019, Amachukwu, co-defendant Kingsley Uchelue Utulu, and other Nigeria-based conspirators sent targeted spearphishing emails to employees of tax preparation businesses in New York, Texas, and other U.S. states. The emails were crafted to trick staff into granting access to the firms' internal systems. Once inside, the conspirators harvested the tax records and personally identifiable information of at least 800 customers, including names, Social Security numbers, and prior filing data — exactly the data needed to impersonate victims with the IRS and state tax authorities.
Filing Fraudulent Tax Refunds
Using the stolen identity data, the conspirators filed fraudulent tax returns seeking refunds of approximately $8.4 million. Of that amount, they successfully obtained roughly $2.5 million before detection, routing the refunds to accounts and payment channels the conspirators controlled.
Exploiting Pandemic-Era SBA Loan Programs
The group separately used the same stolen identities to submit fraudulent applications to the U.S. Small Business Administration's (SBA) Economic Injury Disaster Loan (EIDL) program, a COVID-era relief channel with abbreviated verification designed for speed over scrutiny. These applications generated at least an additional $819,000 in fraudulent payouts.
A Parallel Investment Fraud Scheme
In a separate but concurrently prosecuted scheme, Amachukwu impersonated a wealthy foreign financier to pitch American victims on investments in standby letters of credit — financial instruments that did not actually exist. The fabricated investment pitch generated more than $7 million in fraudulent proceeds for Amachukwu and his co-conspirators, contributing to the nearly $15 million in combined restitution and forfeiture ordered at sentencing.
Impact Assessment
| Impact Area | Description |
|---|---|
| Victim Data Exposure | At least 800 tax preparation customers had tax records and PII stolen, exposing them to ongoing identity-theft and future fraudulent-filing risk |
| Financial Loss | Approximately $2.5 million in fraudulent tax refunds and $819,000 in fraudulent SBA EIDL payouts actually obtained, against $8.4 million sought |
| Public Program Abuse | Demonstrates continued exploitation of pandemic-era relief programs years after their original issuance window closed |
| Small Business Sector | Tax preparation firms — custodians of highly sensitive client financial data — remain a high-value target for credential-phishing campaigns |
| Cross-Border Enforcement | Extradition from France shows sustained international law enforcement cooperation against offshore-based cybercrime rings |
| Combined Penalty | Nearly $15 million in restitution and forfeiture ordered across the tax fraud and investment fraud schemes |
Recommendations
For Tax Preparation Businesses and Accounting Firms
- Enforce phishing-resistant multi-factor authentication (MFA) on all email and tax-software accounts; credential-only logins remain the single biggest point of failure in these campaigns.
- Run regular, mandatory spearphishing simulation training for staff who handle client PII, with particular focus on tax-season timing when attackers increase volume.
- Segment and encrypt stored client tax records so a single compromised mailbox or workstation cannot expose the entire customer database.
- Adopt the IRS Security Six and Written Information Security Plan (WISP) requirements for tax professionals, and report suspected breaches to the IRS Stakeholder Liaison immediately.
For Security Teams
- Monitor for anomalous bulk data exports or unusual after-hours access to tax-preparation software (e.g., Drake, UltraTax, Lacerte) as a leading indicator of an active intrusion.
- Flag email rules or forwarding changes created without IT approval — a common persistence technique in business email compromise following a successful spearphish.
- Share indicators of compromise with industry ISACs and the IRS's Identity Theft Tax Refund Fraud Information Sharing and Analysis Center (IDTTRF-ISAC).
For Individuals and Taxpayers
- Request an IRS Identity Protection PIN (IP PIN) to block fraudulent e-filing using your Social Security number.
- Monitor IRS transcripts and credit reports for unfamiliar filings or loan applications, especially if you used a tax preparer during the 2019–2021 window.
- Be skeptical of unsolicited investment pitches involving standby letters of credit or other exotic instruments promising high, guaranteed returns — these remain a recurring fraud pattern tied to the same offshore networks.
Key Takeaways
- Chukwuemeka Victor Amachukwu, 40, was sentenced to 8 years in federal prison for spearphishing US tax preparation businesses and running a parallel investment fraud scheme.
- The tax fraud conspiracy, running since 2019, stole the PII of at least 800 customers from firms in New York, Texas, and other states.
- Conspirators sought $8.4 million in fraudulent tax refunds and obtained about $2.5 million, plus $819,000 through fraudulent SBA EIDL loan applications.
- A separate standby-letter-of-credit investment scam run by Amachukwu generated more than $7 million in additional fraudulent proceeds.
- The court ordered $3.64 million in restitution and $10.85 million in forfeiture, for a combined penalty near $15 million.
- Amachukwu was extradited from France, underscoring that operating offshore does not place cybercrime defendants beyond the reach of U.S. prosecutors.