Hacker Extradited to U.S. for Stealing $3.3 Million from Taxpayers

Hacker Extradited to U.S. for Stealing $3.3 Million from Taxpayers

Nigerian national Chukwuemeka Victor Amachukwu has been extradited from France to the United States to face charges of hacking, fraud, and identity theft for suspected spearphishing attacks on U.S. tax preparation businesses.

The attack were designed to steal personal data and file fraudulent tax and loan applications, allowing threat actors to steal over $3 million in total. Specifically, the Nigerian national allegedly obtained approximately $2,500,000 from fraudulent tax refunds (out of $8.4 million attempted), and another $819,000 from fraudulent SBA loan applications.

The Department of Justice (DOJ) says Amachukwu was running a separate scam involving fake investment opportunities. "Chukwuemeka Victor Amachukwu took part in a scheme to hack into U.S. tax businesses, trade in the stolen identifying information of victims, and defraud the IRS and other governmental bodies," stated U.S. Attorney Jay Clayton.

According to the indictment, Amachukwu launched spearphishing attacks between 2019 and 2021, along with co-defendant Kingsley Uchelue Utulu, and other co-conspirators in Nigeria, targeting U.S.-based entities.

The hackers used the phishing emails to gain unauthorized access to their targets' computers and steal tax and personally identifiable information (PII) of thousands of U.S. citizens.

They then used this information to file fraudulent IRS tax returns and SBA loan claims, causing damages of over $3.3 million to the U.S. state.

In parallel, Amachukwu ran a fake investment scheme involving non-existent standby letters of credit, where victims were convinced to invest millions of dollars in fictitious offerings.

In reality, all money went directly to Amachukwu, and no investments were made.

The extradited individual now faces charges corresponding to six counts, including hacking, fraud, and identity theft. Moreover, the U.S. seeks forfeiture of all fraud proceeds, including funds, property, or other valuables derived from the criminal schemes, or substitute assets of the same value.

Amachukwu was extradited from France on August 4, 2025, and appeared before a U.S. Magistrate Judge Robert W. Lehrburger for his initial court hearing the next day.

A trial date has not been scheduled yet.

Analyzing the Schemes

Chukwuemeka Victor Amachukwu's schemes involved multiple tactics, including spearphishing attacks and fake investment opportunities.

The U.S. Attorney's office described his actions as part of a larger scheme to defraud the IRS and other governmental bodies.

Defending Against Attacks

As the threat landscape continues to evolve, it is essential for individuals and organizations to be aware of common tactics used by attackers like Amachukwu.

Here are some steps you can take to defend against spearphishing attacks:

  • Be cautious with unsolicited emails or messages.
  • Verify the authenticity of emails or messages before responding.
  • Use strong passwords and enable two-factor authentication.
  • Regularly update your software and security patches.