Hacker Indicted in Massive Tax, Mail, and Wire Fraud Scheme

PHOENIX—Federal law enforcement officials led by the Internal Revenue Service - Criminal Investigation (IRS-CI), unveiled a 74-count superseding indictment today alleging a self-described California-based hacker named Daniel David Rigmaiden led a complex tax fraud conspiracy that employed sophisticated computer intrusion techniques, identify theft, and wire and mail fraud, among other techniques, to attempt to bilk the government out of millions of dollars.

Senior law enforcement officials of the IRS-CI, FBI, and the U.S. Postal Inspection Service joined U.S. Attorney Dennis Burke at a press conference in Phoenix to announce the recently unsealed indictment - the result of a multi-year cat and mouse hunt by the agencies’ investigators across multiple states.

“While schemes become more sophisticated over time, fortunately so do our investigative techniques,” said Dawn Mertz, Special Agent in Charge of IRS-Criminal Investigation. “This investigation serves to remind us there is no such thing as free money and there are no awards or incentives for creativity when it comes to crime.”

The superseding indictment details a conspiracy charge, plus 35 counts of wire fraud, 35 counts of identify theft, one count of unauthorized access of a computer with the intent to defraud, and two counts of mail fraud. The indictment alleges that as early as 2005, Rigmaiden (a.k.a. Steven Travis Brawner), 29, of Santa Clara, CA, conspired with others, including Ransom Marion Carter, III, 43, of Phoenix, to obtain the names and social security numbers of living and deceased persons, and to use their identifies to electronically file fraudulent tax returns in order to obtain refunds.

“Daniel Rigmaiden led agents through a virtual labyrinth of twists and turns, but they never gave up,” said Dennis K. Burke, U.S. Attorney for the District of Arizona. “This investigation demonstrates how the United States is aggressively investigating persons who file fraudulent tax returns. We will seek to identify and vigorously prosecute those who participate in these schemes, no matter how sophisticated they are.”

“The nature of the crimes allegedly committed by Mr. Rigmaiden is particularly troubling,” said Pete Zegarac, Inspector in Charge of the U.S. Postal Inspection Service’s Phoenix Division. “Taking the identities of numerous deceased individuals to obtain financial gain is something not often seen to this magnitude.”

Court documents, including the superseding indictment, and search and seizure warrant affidavits and returns, contain the following additional allegations and evidence. In May 2007, IRS-CI identified a Compass Bank account in Phoenix, Arizona that was receiving fraudulently obtained tax refunds. From May 2007 through January 2008, the investigation was focused on Carter, who had opened the Compass Bank account under the name Carter Tax & Accounting, LLC. In January 2008, the investigation started to focus on an individual operating above Carter known only as the “Hacker” and another co-conspirator above Carter in the scheme. From January through April 15, 2008, an undercover operation was initiated which sought to identify and locate the Hacker and second co-conspirator. In the course of the operation, the investigators opened an undercover bank account in Arizona into which the Hacker unknowingly caused the deposit of numerous fraudulently obtained tax refunds. The fraudulent returns were filed via computers and IP addresses not directly traceable to the Hacker. During this period, three $9,000 shipments of the tax refunds were made to the second co-conspirator in Utah. On April 15, 2008, the second co-conspirator was arrested. The co-conspirator’s case is under seal.

From April through August 2008, investigators worked to identify and locate the Hacker. In May 2008, $68,000 in fraudulently obtained refunds were shipped to the Hacker, in the name of Patrick Stout, to Palo Alto, CA. The person who picked up the package was not apprehended. In July 2008, agents located the apartment in Santa Clara rented by the Hacker in the name of Steven Brawner. On July 23, 2008, a 50-count indictment was returned under seal against the Hacker (a.k.a Brawner and Stout). On August 3, 2008, the Hacker was arrested in Santa Clara after a foot and car chase. A key to the Hacker’s apartment was found in his pocket during his arrest. On August 3 and 4, 2008, search warrants were executed in the Hacker’s Santa Clara apartment and a storage unit in San Jose; investigators seized a laptop and multiple hard drives, $116,340 in cash, over $208,000 in gold coins, approximately $10,000 in silver coins, false identification documents, false identification manufacturing equipment, and surveillance equipment.

The case remained sealed pending the Hacker’s consideration of an offer to cooperate with the government. On August 6, 2008, the Hacker was identified via fingerprint analysis as Daniel David Rigmaiden. From late August 2008 through January 2009, seizure warrants were served upon eight financial institutions and $158,167 of fraudulently obtained tax refunds were seized.

The superseding indictment in Arizona alleges approximately 570 fraudulent tax returns were filed in the course of the conspiracy seeking the deposit of approximately $1,008,174 in refunds into Arizona bank accounts. Search and seizure warrant affidavits allege the filing of approximately 1,336 additional fraudulent tax returns seeking the deposit of approximately $3,117,193 of refunds into over 170 additional accounts.

On January 7, 2010, the Court granted Rigmaiden’s request to represent himself. On January 12, Rigmaiden advised the court he was not interested in the government’s cooperation offer and moved to unseal the case. On January 25, the government advised the court it had no objection to Rigmaiden’s motion to unseal the case. On January 27, a 74-count superseding indictment was returned against Rigmaiden and Carter. On March 26, the court unsealed the case. Rigmaiden has remained in federal custody since his arrest. Carter is a fugitive.

An indictment is simply the method by which a person is charged with criminal activity and search and seizure warrants are simply methods by which property and funds are searched for and seized, none of the pleadings raise inferences of guilt. An individual is presumed innocent until competent evidence is presented to a jury that establishes guilt beyond a reasonable doubt.

“The indictment of Daniel Rigmaiden is an excellent example of law enforcement cooperation between the IRS - Criminal Investigations, the U.S. Postal Inspection Service, and the FBI,” said Nathan Gray, Special Agent in Charge of the FBI-Phoenix Division. “The FBI is committed to working with our law enforcement partners and the U.S. Attorney’s Office to investigate and prosecute those individuals who choose to use computer technology in furtherance of their fraudulent schemes.”

The investigation preceding the indictment was conducted by the Internal Revenue Service - Criminal Investigation, Federal Bureau of Investigation, and U.S. Postal Inspection Service with assistance from the Santa Clara Police Department, U.S. Secret Service and U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives. The prosecution is being handled by Frederick A. Battista and Peter Sexton, Assistant U.S. Attorneys, District of Arizona, Phoenix.

CASE NUMBER: CR-08-814-PHX-DGC
RELEASE NUMBER: 2010-060(Rigmaiden, et al.)