Nigerian National Sentenced to 8 Years for Spearphishing Attacks on US Tax Preparers

Scheme netted over $3 million in fraudulent tax refunds and COVID-19 disaster loans

By LineZotpaper

Published20 October 2026

Read Time2 min

A Nigerian national has been sentenced to eight years in prison for orchestrating a series of spearphishing attacks against US tax preparation businesses, stealing more than $3 million from taxpayers through fraudulent tax refunds and loan applications.

Chukwuemeka Victor Amachukwu, a 40-year-old Nigerian national also known as Chukwuemeka Victor Eletuo and So Kwan Leung, was sentenced to eight years in prison after pleading guilty to conspiracy to commit computer intrusions and wire fraud. He was extradited from France to the United States in August 2025.

According to court documents and a press release from US Attorney Jamie McDonald, Amachukwu and co-conspirators, including Kingsley Uchelue Utulu, carried out spearphishing attacks between 2019 and 2021 against tax preparation businesses in New York, Texas, and other US states. They gained unauthorized access to computers and stole the tax and personally identifiable information of at least 800 customers.

Using the stolen data, Amachukwu filed fraudulent tax refund claims with the Internal Revenue Service totaling $8.4 million and obtained about $2.5 million. He also secured $819,000 through fraudulent loan applications with the Small Business Administration's Economic Injury Disaster Loan program. The total loss from the tax and loan fraud was over $3 million.

In addition, Amachukwu was involved in a fake investment scheme offering nonexistent standby letters of credit, which stole more than $7 million from multiple victims.

In addition to the prison term, the court sentenced Amachukwu to one year of supervised release, ordered him to pay $3.6 million in restitution, and to forfeit nearly $11 million.

McDonald said in the press release that Amachukwu "believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes."

McDonald also stated that Amachukwu "took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant."

Analysis

Why This Matters

The case demonstrates that international cybercriminals can be extradited and held accountable for tax fraud and identity theft, potentially deterring similar schemes.
The theft of taxpayer funds and personal information directly harms hundreds of victims and burdens public programs like IRS tax refunds and SBA disaster loans.
It underscores vulnerabilities in small businesses such as tax preparers, which hold sensitive data and can be entry points for broader fraud.

Background

Spearphishing remains a common tactic for cybercriminals seeking access to business networks. Tax preparation firms are attractive targets because they store extensive personal and financial information. The COVID-19 pandemic expanded government loan programs, which fraud rings quickly exploited. This case is part of a broader effort by US authorities to pursue international cyber fraudsters, with extraditions becoming a more frequent tool.

Key Perspectives

US Justice Department: Authorities view the sentence as a significant deterrent. US Attorney Jamie McDonald noted that Amachukwu believed he was safe operating offshore but has now been held accountable. Victims: Tax preparation businesses and their clients suffered direct financial losses and potential identity theft. The stolen personally identifiable information of at least 800 customers may lead to ongoing fraud risks. Defense: Amachukwu pleaded guilty, choosing not to contest the charges. No public statement from his legal team is available.

What to Watch

The status of co-defendant Kingsley Uchelue Utulu and any other alleged conspirators.
Enforcement of the restitution and forfeiture orders, including the nearly $11 million forfeiture.
Future extradition and prosecution trends for international cyber fraud rings targeting US government programs.

Sources

Hacker gets 8 years for stealing $3.3 million from taxpayers · BleepingComputer

Checked

12 claims in this story checked against 1 source: 8 supported.

Show each claim

SupportedA Nigerian national was sentenced to eight years for spearphishing attacks on US tax preparers.BleepingComputer: “A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019.”
Partly supportedThe scheme netted more than $3 million through fraudulent tax refunds and COVID-19 disaster loans.BleepingComputer: “According to court documents , Amachukwu and his accomplices stole more than $3 million after filing fraudulent tax and loan applications with the Internal Revenue Service and state tax authorities using their victims' stolen personal data.”
Partly supportedAmachukwu orchestrated a series of spearphishing attacks against US tax preparation businesses.BleepingComputer: “Together with co-defendant Kingsley Uchelue Utulu and other Nigerian co-conspirators, Amachukwu launched spearphishing attacks against tax preparation businesses in New York, Texas, and other US states between 2019 and 2021”
SupportedAmachukwu stole more than $3 million from taxpayers through fraudulent tax and loan applications.BleepingComputer: “Amachukwu and his accomplices stole more than $3 million after filing fraudulent tax and loan applications with the Internal Revenue Service and state tax authorities using their victims' stolen personal data.”
SupportedThe attacks took place between 2019 and 2021 and targeted businesses in New York, Texas and other US states.BleepingComputer: “Together with co-defendant Kingsley Uchelue Utulu and other Nigerian co-conspirators, Amachukwu launched spearphishing attacks against tax preparation businesses in New York, Texas, and other US states between 2019 and 2021”
SupportedAmachukwu stole tax and personally identifiable information from at least 800 customers.BleepingComputer: “gaining unauthorized access to their targets' computers and stealing the tax and personally identifiable information (PII) of at least 800 customers.”
Partly supportedHe filed for $8.4 million in tax refunds and obtained about $2.5 million.BleepingComputer: “In total, he allegedly obtained about $2.5 million in fraudulent tax refunds (after filing for $8.4 million in refunds)”
Partly supportedAmachukwu secured $819,000 through fraudulent SBA Economic Injury Disaster Loan applications.BleepingComputer: “and another $819,000 through fraudulent loan applications with the Small Business Administration's Economic Injury Disaster Loan program.”
SupportedAmachukwu and his co-conspirators stole more than $7 million in a fake investment scheme involving nonexistent standby letters of credit.BleepingComputer: “However, these investments did not exist, and the fraudsters stole more than $7 million from multiple victims.”
SupportedThe court ordered one year of supervised release, $3.6 million in restitution and forfeiture of nearly $11 million.BleepingComputer: “In addition to the prison term, the court sentenced Amachukwu to one year of supervised release and ordered him to pay $3.6 million in restitution and forfeit nearly $11 million.”
SupportedMcDonald said Amachukwu “believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes.”BleepingComputer: ““Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes,” said US Attorney Jamie McDonald in a Monday press release.”
SupportedMcDonald said Amachukwu “took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud.”BleepingComputer: ““Amachukwu took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant.””