Hacker gets 8 years for phishing tax preparers and stealing $3 million

A Nigerian man has been sentenced to eight years in prison for a phishing campaign aimed at US tax preparation businesses. Chukwuemeka Victor Amachukwu, 40, and his accomplices broke into the firms' computers, took client tax and personal data, and used it to file fraudulent tax and loan applications. Court documents say they stole more than $3 million.

How the scheme worked

The group used spearphishing. That means emails aimed at specific people or businesses, rather than sent to everyone. Between 2019 and 2021, the attacks hit tax preparers in New York, Texas and other states. The attackers gained access to the firms' computers and stole tax and personal information on at least 800 customers.

Amachukwu worked with co-defendant Kingsley Uchelue Utulu and other Nigerian co-conspirators. The material does not say what happened to Utulu.

Where the money came from

The stolen data was used to file fake applications with the Internal Revenue Service and state tax authorities. Amachukwu allegedly filed for $8.4 million in refunds and obtained about $2.5 million. He also got another $819,000 through fraudulent loan applications to the Small Business Administration's Economic Injury Disaster Loan program.

He was also involved in a separate fake investment scheme. Victims were offered what scammers called valuable standby letters of credit. Those investments did not exist, and the fraudsters took more than $7 million from multiple victims.

The sentence

Amachukwu pleaded guilty to conspiracy to commit computer intrusions and wire fraud. He was extradited from France to the United States in August 2025. Besides the eight years in prison, he received one year of supervised release. The court ordered him to pay $3.6 million in restitution and to forfeit nearly $11 million.

US Attorney Jamie McDonald said Amachukwu believed he was operating safely offshore. He said the crimes caused significant harm to victims and the public, so a significant sentence was appropriate.

What it means for businesses

The case shows how much one successful phishing email can cost. A tax preparer holds the kind of data criminals want most, and a single compromised computer gave the attackers access to hundreds of customers. Any business that stores client tax or identity records faces a similar risk.

• Treat unexpected emails with links or attachments as suspicious, even if they look routine.
• Tell staff to check with the sender by phone or another channel before opening anything odd.
• Keep client files to only what is needed, so one break-in exposes less.