The taxpayer never sees the email that starts it. The email goes to the firm that already holds the returns: a preparer, a small tax office, someone whose inbox is full of other people's Social Security numbers and bank details. One convincing message, one sign-in, and hundreds of clients become a pile of identities that can be filed again, this time towards an account the clients do not control.
That is the case a federal judge in New York sentenced in October 2026. The refund was not stolen by asking the taxpayer to click a link. It was stolen by getting into the office that already had the file.
How it works
- A plausible email reaches a tax-preparation business. It looks like a client, a software vendor, or a colleague. Spearphishing means the message was written for that inbox, not sprayed at random.
- Someone signs in. The mailbox, or a remote session on the office computer, is then used to copy tax records and identity details.
- Those details are filed again, as refund claims, directed to an account the conspirators control. The revenue agency sees a return. The client sees nothing until a notice arrives, or a refund they were owed never does.
- The same names are reused. In the New York case the identities also went into other government payouts, and there was a separate pitch: investments in standby letters of credit that did not exist. A letter of credit is supposed to be a bank's promise to pay. The ones in that pitch were paper.
Signs and red flags
A tax office is asked to "update the portal" or open a document from a mail it was not expecting. Clients receive refund notices, or debts, for years they did not file that way. A stranger offers a large, paperwork-heavy investment and wants the money sent before any registrar or bank confirms the instrument exists. The investment pitch and the false refund can share a name and still be two thefts. Pressure and secrecy travel with both.
For the client, the first sign is often a letter about a refund they did not claim, or a year the tax authority thinks was filed twice. For the preparer, it is a login they do not remember, or a queue of returns that went out overnight.
Cases and figures
On 19 October 2026 a federal judge in the Southern District of New York sentenced Chukwuemeka Victor Amachukwu to eight years, after a guilty plea to conspiracy to commit computer intrusions and conspiracy to commit wire fraud. A guilty plea and a sentence are a court result. They are not a description of every tax-office break-in.
Prosecutors said that from at least 2019 he and others spearphished US tax businesses, including firms in New York and Texas, and stole tax and identity details for at least about 800 customers of one of them. Eight hundred customer files is the quiet part. Each file is a person who thought their return lived at the accountant's office and nowhere else.
The group sought fraudulent refunds of at least about $8.4 million and obtained at least about $2.5 million. Sought and obtained are different. The larger number is what the false returns asked for. The smaller is what prosecutors said was paid. A further $819,000 came from false claims on the Small Business Administration's Economic Injury Disaster Loan programme, a loan meant for businesses hit by a disaster. A separate investment story, in which he posed as an overseas financier, took in more than $7 million. The court ordered restitution of $3,647,629.39 and forfeiture of $10,846,634.39, plus a year of supervised release. Restitution is what the court said is owed back. Forfeiture is what the court said can be taken. Neither figure means every client has already been paid.
What to do and where to report
Tax firms should treat an unexpected login request as hostile until it is confirmed on a known number, and should watch for a burst of returns filed outside the normal queue. If your identity was used, contact the tax authority through its own website, not a link in an email, and tell the preparer. In the United States, file at ic3.gov and with the FTC.
If money has already moved, start at Get help. Paid "tax fixers" who appear after the loss are a second approach; see Fake recovery.
This is general information, not legal or financial advice. The rules and the figures change. If money has already left, contact the bank and the authorities through the help pages.