He Stole $3.3 Million from Taxpayers. Here's What Got Him Caught.

Emily Davis · 2026-10-20

You know those emails that look like they're from someone you trust? The ones that say "urgent" and ask you to click a link? Well, one guy turned that trick into a $3.3 million payday. But now he's paying it back with eight years of his life. A Nigerian national was just sentenced to eight years in federal prison for a string of spearphishing attacks that targeted U.S. tax preparation businesses since 2019. And let me tell you, the details are wild. ### How He Pulled It Off This wasn't some sophisticated hacking operation. It was old-school deception, dressed up in a digital bow. He'd send emails that looked like they came from the IRS or a legitimate client. The emails would ask tax preparers to click a link or open an attachment. Once they did, he had their login credentials. From there, he'd file fake tax returns in other people's names and pocket the refunds. Over three years, he allegedly stole more than $3.3 million. But here's the thing: this kind of attack is becoming more common. And it's not just tax preparers who are targets. Anyone who handles sensitive data is fair game. ### The Red Flags You Might Be Missing So how do you spot a spearphishing email? It's not always obvious. These messages are designed to look real. But there are a few clues: - The sender's email address is slightly off (like support@irs-gov.com instead of support@irs.gov) - The email creates a sense of urgency ("Your account will be locked in 24 hours!") - There's a link that doesn't match the destination when you hover over it - The greeting is generic ("Dear Customer" instead of your name) Now, I'm not saying you should be paranoid. But a little skepticism goes a long way. ### Why This Matters for Your Business If you run a business that handles sensitive information—especially in tax prep, accounting, or finance—you're a prime target. And the consequences can be devastating. Think about it: a single successful phishing attack could give a criminal access to hundreds of client records. That's not just a financial loss; it's a trust issue. Once clients find out their data was compromised, they're gone. ### What Can You Do? First, train your team. Regularly. Phishing attacks evolve, and so should your training. Second, use two-factor authentication (2FA) everywhere. It's not foolproof, but it adds a layer of protection that can stop an attacker in their tracks. Third, consider using an antidetect browser for sensitive tasks. Wait, what? Let me explain. Antidetect browsers are designed to mask your digital fingerprint, making it harder for attackers to track your online activity. They're not a silver bullet, but they can help protect your identity when you're browsing or accessing client portals. And finally, keep your software up to date. Yes, it's annoying, but those updates often patch security holes that criminals exploit. ### The Bottom Line This hacker got eight years, but the damage he caused will last much longer for his victims. The lesson? Don't click on links in emails unless you're absolutely sure they're legit. And if something feels off, it probably is. Stay safe out there.