Eight-Year Prison Term for Hacker Who Used Phishing Emails to Raid Tax Firms

Chukwuemeka Amachukwu, a Nigerian national extradited from France last year, has been sentenced to eight years in federal prison after pleading guilty to fraud, hacking and identity theft charges. He must also serve one year of supervised release and pay more than $3.6 million in restitution. Prosecutors said he led a group that used spearphishing emails to breach tax preparation businesses, with activity dating back to 2019.

Court documents showed Amachukwu worked with Kingsley Uchelue Utulu and other Nigeria-based hackers to steal information on about 800 business customers. The group used it to file fraudulent state and federal tax returns, seeking about $8.4 million in refunds and obtaining $2.5 million. In one incident in May 2021, a phishing email sent to an employee of a Manhattan-based tax preparation business infected the company with malware. The group also used stolen data to claim about $819,000 from the Small Business Administration's Economic Injury Disaster Loan program.

Amachukwu also earned more than $7 million by impersonating wealthy overseas businessmen and offering fake standby letters of credit to US victims. His co-conspirator Utulu was sentenced to five years in prison in June after being arrested in the UK. The case shows how a single phishing email to one employee can lead to large scale identity theft and fraud.