Millions Stolen in US Tax Return Fraud

Luther Clay, Josephine Cowles and Glen Apling are three U.S. citizens who all died in 1983.  They and over 1,000 other deceased individuals managed to file tax returns in 2006.

Federal law enforcement officials led by the IRS, unveiled a 74-count indictment today alleging Daniel Rigmaiden led a complex tax fraud conspiracy that employed sophisticated computer intrusion techniques, identify theft, wire and mail fraud, and other techniques, to steal millions of taxpayer dollars.  Senior law enforcement officials of the IRS, FBI, and the U.S. Postal Inspection Service joined U.S. Attorney Dennis Burke at a press conference in Phoenix to announce the unsealed indictment – the result of a multi-year cat and mouse hunt by investigators across multiple states.

The indictment details a conspiracy charge, plus 35 counts of wire fraud, 35 counts of identify theft, one count of unauthorized access of a computer with the intent to defraud and two counts of mail fraud.  The indictment alleges that as early as 2005, Rigmaiden (a.k.a. Steven Travis Brawner), 29, of Santa Clara, CA, conspired with others, including Ransom Marion Carter, III, 43, of Phoenix, to obtain the names and social security numbers of living and deceased persons, and to use their identifies to electronically file fraudulent tax returns in order to obtain refunds.  This was allegedly accomplished by using 190 separate IP addresses from all over the country and 173 banks accounts, including numerous accounts that were just basically debit cards.  It was only a matter of time before federal agents noticed a common uplink from a Verizon broadband card in Santa Clara.  Agents tracked the communications to an apartment rented by Steven Travis Braunnen who, upon closer examination, was actually Rigmaiden.

Investigative Timline:

  • In May 2007, IRS-CI identified a Compass Bank account in Phoenix, Arizona that was receiving fraudulently obtained tax refunds. 
  • From May 2007 through January 2008, the investigation was focused on Carter, who had opened the Compass Bank account under the name Carter Tax & Accounting, LLC. 
  • In January 2008, the investigation started to focus on an individual operating above Carter known only as the “Hacker” and another co-conspirator above Carter in the scheme. 
  • From January through April 15, 2008, an undercover operation was initiated which sought to identify and locate the Hacker and second co-conspirator. In the course of the operation, the investigators opened an undercover bank account in Arizona into which the Hacker unknowingly caused the deposit of numerous fraudulently obtained tax refunds.  The fraudulent returns were filed via computers and IP addresses not directly traceable to the Hacker.  During this period, three $9,000 shipments of the tax refunds were made to the second co-conspirator in Utah. 
  • On April 15, 2008, the second co-conspirator was arrested.  The co-conspirator’s case is under seal.
  • From April through August 2008, investigators worked to identify and locate the Hacker.  In May 2008, $68,000 in fraudulently obtained refunds were shipped to the Hacker, in the name of Patrick Stout, to Palo Alto, CA.  The person who picked up the package was not apprehended. 
  • In July 2008, agents located the apartment in Santa Clara rented by the Hacker in the name of Steven Brawner. 
  • On July 23, 2008, a 50-count indictment was returned under seal against the Hacker (a.k.a Brawner and Stout). 
  • On August 3, 2008, the Hacker was arrested in Santa Clara after a foot and car chase.  A key to the Hacker’s apartment was found in his pocket during his arrest. 
  • On August 3 and 4, 2008, search warrants were executed in the Hacker’s Santa Clara apartment and a storage unit in San Jose; investigators seized a laptop and multiple hard drives, $116,340 in cash, over $208,000 in gold coins, approximately $10,000 in silver coins, false identification documents, false identification manufacturing equipment, and surveillance equipment.
  • The case remained sealed pending the Hacker’s consideration of an offer to cooperate with the government. 
  • On August 6, 2008, the Hacker was identified via fingerprint analysis as Daniel David Rigmaiden. 
  • From late August 2008 through January 2009, seizure warrants were served upon eight financial institutions and $158,167 of fraudulently obtained tax refunds were seized.
  • On January 7, 2010, the Court granted Rigmaiden’s request to represent himself. 
  • On January 12, Rigmaiden advised the court he was not interested in the government’s cooperation offer and moved to unseal the case. 
  • On January 25, the government advised the court it had no objection to Rigmaiden’s motion to unseal the case. 
  • On January 27, a 74-count superseding indictment was returned against Rigmaiden and Carter. 
  • On March 26, the court unsealed the case.  Rigmaiden has remained in federal custody since his arrest.  Carter is a fugitive. 

    Ransom Marion Carter III - FUGITIVE

    Ransom Marion Carter III - FUGITIVE

The superseding indictment in Arizona alleges approximately 570 fraudulent tax returns were filed in the course of the conspiracy seeking the deposit of approximately $1,008,174 in refunds into Arizona bank accounts.  Search and seizure warrant affidavits allege the filing of approximately 1,336 additional fraudulent tax returns seeking the deposit of approximately $3,117,193 of refunds into over 170 additional accounts.