AMENDED COMPLAINT as to Abidemi Rufai. (KEB) [3:21-mj-05101-DWC-BHS] — United States v. Rufai (Dkt. 3)

Record facts

U.S. District Court for the Western District of Washington · No. 3:21-cr-05186-BHS · Doc. 3 · 2021-05-14 · Docket on CourtListener

Full text

0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 1 of 15

FILED LovceD The Honorable David W. Christel

RECEIVED

May 14, 2021

CLERK U.S. DISTRICT COURT
WESTERN DISTRICT OF WASHINGTON AT TACOMA
BY DEPUTY

UNITED STATES DISTRICT COURT FOR THE
WESTERN DISTRICT OF WASHINGTON

AT TACOMA

UNITED STATES OF AMERICA, CASE NO. MJ21-5101

Plaintiff AMENDED COMPLAINT for

VIOLATIONS
v. Title 18 U.S.C. § 1343

ABIDEMI RUFAI
a/k/a Sandy Tang,

Defendant.

BEFORE, David W. Christel, United States Magistrate Judge, United States
Courthouse, Tacoma, Washington.

The undersigned complainant, being duly sworn, states:

COUNTS 1-5
(Wire Fraud)

A. Background

1. These charges involve ABIDEMI RUFAI’s participation in a scheme to
fraudulently collect unemployment benefits intended for American workers suffering
from the economic effects of the COVID-19 pandemic. RUFAI, a Nigerian national who

is not entitled to collect unemployment benefits in the United States, submitted dozens of

United States v. RUFAI UNITED STATES ATTORNEY
700 STEWART STREET
SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970

Complaint-1
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 2 of 15

claims to the Washington Employment Security Department and other state workforce
agencies using the stolen identities of residents of Washington and other states. In so
doing, RUFAI caused and attempted to cause the Employment Security Department to
pay out federal and other unemployment benefits in excess of $350,000, and caused other
states to pay out additional fraudulent benefit payments.

2. On March 27, 2020, the United States enacted into law the Coronavirus
Aid, Relief, and Economic Security (CARES) Act. The CARES Act authorized
approximately $2 trillion in aid to American workers, families, and businesses to mitigate
the economic consequences of the COVID-19 pandemic. The CARES Act funded and
authorized each state to administer new unemployment benefits. These benefits include:
(1) Federal Pandemic Unemployment Compensation (FPUC), which provided a benefit
of $600 per week per unemployed worker in addition to existing benefits; (2) Pandemic
Unemployment Assistance (PUA), which extends benefits to self-employed persons,
independent contractors, and others; and (3) Pandemic Emergency Unemployment
Assistance (PEUC), which extends benefits for an additional 13 weeks after regular
unemployment benefits are exhausted.

3. CARES Act unemployment benefits are funded by the United States
government through the Department of Labor and administered at the state level by state
agencies known as state workforce agencies (SWAs). The Washington Employment
Security Department (ESD) is the SWA for the of the State of Washington.

Applicants can apply online for ESD-administered benefits by accessing Washington’s
SecureAccess Washington (SAW) web identity validation portal and ESD’s
Unemployment Tax and Benefit (UTAB) online application system.

4. Before submitting an application to ESD, the applicant must establish a
SAW account. As part of this process, the applicant must provide the SAW system with
an email address. The SAW system then sends, by interstate wire communication
originating in Olympia, Washington, an activation link to the email address provided.

The user must then click on a link to activate his or her account. This process causes a
United States v. RUFAI UNITED STATES ATTORNEY
i 700 STEWART STREET
Complaint-2 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 3 of 15

series of wire transmissions originating at the user’s location and terminating in Olympia,
Washington.

5. After activating the SAW account, the user may proceed to ESD’s UTAB
application system. To file a claim, the applicant enters his or her personal identifying
information, to include name, date of birth, and Social Security number. If ESD confirms
that the information matches the personal identifying information of a person in ESD’s
records, ESD will pay out benefits via wire (ACH) transfer to a bank or financial account
identified by the applicant.

B. The Scheme to Defraud

6. Beginning at a time unknown, but no later than March 9, 2020, and
continuing through on or after October 3, 2020, at Olympia, within the Western District
of Washington, and elsewhere, ABIDEMI RUFAI, aka Sandy Tang, and others known
and unknown, with intent to defraud, knowingly devised a scheme and artifice to defraud
and to obtain money and property by means of materially false and fraudulent pretenses,
representations and promises, as further described below.

7. The essence of the scheme and artifice to defraud was to fraudulently
obtain federally-funded PUA and other unemployment benefits from the Washington
ESD and other state workforce agencies by submitting fraudulent claims using the stolen
personal identifying information of American workers.

C. Manner and Means

The following conduct was part of the scheme and artifice to defraud:

8. RUFAI unlawfully obtained and possessed the personal identifying
information (PII), to include names, dates of birth, and Social Security numbers, of
residents of Washington and other states. RUFAI accessed, using interstate and foreign

wire transmissions, ESD’s SAW portal, as well as similar portals of other SWAs.

United States v. RUFAI UNITED STATES ATTORNEY
700 STEWART STREET
SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970

Complaint-3
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 4 of 15

9. RUFAI created email accounts, including a Google-administered account
with the address “sandytangy58@gmail.com,” for the purpose of participating in
fraudulent transactions while obscuring his identity.

10. | RUFAI, using foreign and interstate wire transmissions, accessed ESD’s
SAW portal, as well as similar portals of other SWAs. RUFAI provided the
sandytangy58@gmail.com email address to ESD and other SWAs as the designated
email addresses to receive activation emails from the SWAs to activate fraudulent claims.

11. To prevent ESD and other SWAs from recognizing that the same email
account was being used to file multiple claims, RUFAI used dozens of variants of the
email addresses by placing periods at different locations within the email address for each
claim. For example, RUFAI opened SAW accounts and submitted claims using the

99 66

variants “san.dyta.ngy58@gmail.com,” “sa.ndty.a.ngyS8@gmail.com,” and
“san.d.y.t.an.gyS8@gmail.com.” This enabled RUFAI and his co-schemers to file
multiple claims using the same email account, without ESD and other SWAs detecting
that they were doing so.

12. When completing the applications, RUFAI directed that some of the
benefits be paid to online payment accounts, including Green Dot accounts. In some
cases, RUFAI directed that the fraudulent benefit payments be made to bank accounts
controlled by “money mules” under the control of RUFAI and his co-schemers. RUFAI
and his co-schemers then directed the money mules to send the proceeds to the residence

of RUFAI’s brother in Jamaica, New York.
D. Execution of the Scheme and Artifice to Defraud

13. Onor about the dates set forth below, in Olympia, within the Western
District of Washington and elsewhere, for the purpose of executing and attempting to
execute this scheme and artifice to defraud, ABIDEMI RUFAI, and others known and
unknown, aiding and abetting each other, did knowingly transmit and cause to be

transmitted by wire communication in interstate and foreign commerce, writings, signs,

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-4 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 5 of 15

signals, pictures and sounds, each transmission of which constitutes a separate count of

this Complaint:

Count Date Wire Transmission

1 4/27/2020 | Wire transmission from outside the state of Washington to the
State Data Center in Olympia, Washington to establish Secure
Access Washington account using the email address
san.dy.t.a.n.g.y.5.8@gmail.com

2 4/28/2020 | Wire transmission from outside the state of Washington to the
State Data Center in Olympia, Washington to establish Secure
Access Washington account using the email address
s.an.dyt.a.n.g.y.5.8@gmail.com

3 4/29/2020 | Wire transmission from outside the state of Washington to the
State Data Center in Olympia, Washington to establish Secure
Access Washington account using the email address
sa.n.d.yta.n.g.y.5.8@gmail.com

4 5/1/2020 | Wire transmission from outside the state of Washington to the
State Data Center in Olympia, Washington to establish Secure
Access Washington account using the email address
sandy.t.an.g.y.5.8@gmail.com

5 5/2/2020 | Wire transmission from outside the state of Washington to the
State Data Center in Olympia, Washington to establish Secure
Access Washington account using the email address
s.a.nd.ytangyS8@gmail.com

All in violation of Title 18, United States Code, Sections 1343 and Section 2.

And the complainant states that this Complaint is based on the following
information:
I, Special Agent Andrea Desanto, being first duly sworn on oath, depose and say:

AFFIANT BACKGROUND AND SCOPE OF AFFIDAVIT

1. I am a Special Agent with the Federal Bureau of Investigation (“FBI”), and
have been since 2006. I am currently assigned to the Seattle Field Office. My primary
duties include investigating violations of federal law, including but not limited to, Title
18, United States Code, Sections 1343 (wire fraud), 1028A (aggravated identity theft),

1956 (money laundering), 1957 (transactional money laundering), and conspiracy to

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-5 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 6 of 15

commit these offenses. I previously worked on the Cyber squad, where I primarily
investigated computer intrusions and other cybercrimes. My experience as an FBI agent
includes the investigation of cases involving the use of computers and the Internet to
commit crimes. In addition to my experience with cybercrime investigations, I also have
experience with financial investigations. I have received formal training on tracing the
financial proceeds of crimes. I have applied that training in the context of numerous
investigations in which I have reviewed records from financial institutions both in the
United States and in foreign jurisdictions, in order to identify the proceeds of criminal
offenses under investigation.

2. Based on my training and experience, I am familiar with the ways in which
individuals involved in fraud schemes use shell e-mail accounts, computers, cellular
telephones, Internet Protocol (IP) addresses, bank accounts, synthetic identities, and
counterfeit documents to facilitate fraudulent activity. I have learned that individuals
perpetrating computer intrusions and identity theft-related bank fraud and wire fraud
schemes employ a number of techniques, either alone or in combination, to further their
illegal activities and to avoid detection by law enforcement. These techniques include:
utilizing web-based email accounts and other electronic messaging accounts to send,
receive, store, and obtain personal identifying information, such as dates of birth and
bank and credit card account numbers and related information; and the use of cloud-
based accounts to communicate and store information and tools related to the fraud. I
know that individuals involved in fraud schemes often establish shell e-mail accounts and
e-mail addresses in fictitious names and/or in the names of third parties in an effort to
conceal their identities and illicit activities from law enforcement. I know that
individuals involved in fraud often use virtual private network (““VPN”’) accounts and
Internet hosting services to conceal their true identities and geographical locations from
law enforcement or other entities.

3. The purpose of the Affidavit is to describe the evidence relevant to the

question of whether probable cause exists to believe that ABIDEMI RUFAI committed

United States v. RUFAI UNITED STATES ATTORNEY
i 700 STEWART STREET
Complaint-6 Sutre 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 7 of 15

the offenses set forth above. As a result, the information in this Affidavit is limited to
that relevant to the existence of probable cause. This Affidavit does not set forth all facts
known to me that are relevant to this investigation.

EVIDENCE OF THE CRIMINAL OFFENSES
A. The CARES Act

4. Based on publicly-available information, I know that on March 27, 2020,
the United States enacted into law the Coronavirus Aid, Relief, and Economic Security
(CARES) Act. The CARES Act authorized approximately $2 trillion in aid to American
workers, families, and businesses to mitigate the economic consequences of the COVID-
19 pandemic. The CARES Act funded and authorized each state to administer new
unemployment benefits. These benefits include (1) Federal Pandemic Unemployment
Compensation (FPUC), which provides an additional benefit of $600 per week per
unemployed worker; (2) Pandemic Unemployment Assistance (PUA), which extends
benefits to self-employed persons, independent contractors, and others; and (3) Pandemic
Emergency Unemployment Assistance (PEUC), which extends benefits for an additional
13 weeks after regular unemployment benefits are exhausted. All of these programs will
be referenced herein as “CARES Act benefits.” The CARES Act allows an unemployed
worker to obtain back benefits retroactive to the date on which the applicant was affected
by COVID 19, which, under program rules, may be as early as February 2, 2020.

5. CARES Act unemployment benefits are funded by the United States
government through the Department of Labor and administered at the state level by state
agencies known as state workforce agencies (SWAs). The Washington Employment
Security Department (ESD), the component of the State of Washington responsible for
administering unemployment benefits, is the SWA for the State of Washington.
Applicants apply for ESD-administered benefits using Washington’s SecureAccess
Washington (SAW) web portal and an ESD-administered site known as the
Unemployment Tax and Benefit (UTAB) system.

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-7 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 8 of 15

6. Based on interviews with ESD personnel, I know that, to apply for ESD
benefits online, a claimant must first open an account with the SAW system. The SAW
system is a website hosted at the State Data Center in Olympia, Washington that verifies
the identities of users. To open a SAW account, the applicant must access the SAW
website, which causes a wire communication to the servers at the State Data Center. The
applicant must provide SAW with basic identifying and contact information, to include
an email account. The SAW system sends an activation link to the provided email
account. The claimant must then access the email account and click the activation link to
complete the SAW account setup process. Once that process is complete, the applicant
may use his or her SAW account to access UTAB and submit a claim for ESD benefits.

7. To submit an ESD claim through UTAB, the applicant must enter his or her
personal identifying information (including name, date of birth, and Social Security
number). ESD checks this information against its database of Washington residents. If
ESD confirms that the information matches the personal identifying information of a
person in ESD’s records, ESD will pay out benefits via wire (ACH) transfer to an account
identified by the applicant.

B. Overview of Investigation

8. I know from my contact with other law enforcement officers that,
beginning on around April 20, 2020, officials began receiving complaints from
employers about potentially fraudulent unemployment claims. The employers reported
that they had received notices from ESD indicating that persons still under their employ
had filed unemployment claims. For example, on or about April 20, 2020, the Seattle
Fire Department (SFD) notified the U.S. Attorney’s Office for the Western District of
Washington that claims had been filed in the names of multiple firefighters who were
actively employed by SFD. SFD reported that it had interviewed the firefighters, who

had denied any involvement in the claims. Other employers, including Microsoft

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-8 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 9 of 15

Corporation, the City of Bellingham, Zulily, and Seattle Yacht Club submitted similar
complaints.

9. Roughly around that same time, numerous other agencies, including the
Federal Bureau of Investigation, the Social Security Administration Office of Inspector
General, the United States Secret Service, the Department of Labor Office of the
Inspector General, the United States Postal Inspection Service, and Internal Revenue
Service Criminal Investigation, joined the investigation. Agents from these agencies,
including myself, have reviewed voluminous financial records and databases reflecting
the fraudulent transactions and have conducted dozens of interviews.

10. The investigation has developed evidence that hundreds of millions of
dollars’ worth of fraudulent claims were filed with ESD using the stolen personal
identifying information of Washington residents. The FBI investigation has determined
that many of the fraudulent claims were filed using IP addresses that resolve to Nigeria.
While the actual amount of loss is unknown, the Washington State Auditor has issued a
report finding that ESD paid out at least $642,954,417 in fraudulent imposter claims, of
which $369,789,082 has been recovered.

C. Role of Gmail Accounts in the Fraud

11. ESD provided the government with data identifying the email accounts
associated with claims submitted over the period of the fraud. The data indicate that
thousands of different email accounts, including accounts operated by Google, were used
in connection with the filing of the fraudulent claims. For many of these Google email
accounts, perpetrators took advantage of a particular feature of Google email accounts
that allowed them to submit multiple fraudulent claims from a single Google email
account, without ESD detecting that a single email address was being used repeatedly.
Specfically, in routing emails to an email box, Google disregards periods in the email
address, meaning that the email address “john.doe@gmail.com” and

“johndoe@gmail.com” will resolve to the same Google email account, even though ESD

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-9 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 10 of 15

identifies them as two different accounts. Two email addresses like these that are
distinguished only by periods are known as “Google variants” or “dot variants.” I know
from my training and experience that criminals sometimes take advantage of this feature
to make it appear that emails are originating from multiple accounts, when in fact they
originate from the same account. This reduces the number of email accounts that a
criminal must open and monitor while perpetrating a fraud, while avoiding fraud alerts
that may be triggered when multiple claims originate from the same account.

D. Use of the SandytangyS8@gmail.com Account

12. Investigators analyzed ESD’s database to identify Gmail accounts that were
used to submit multiple claims using the Google dot variant method discussed above.
Among these accounts was an account with the address sandytangy58@gmail.com.

13. According to a Department of Labor Office of Inspector General’s Office
analysis of ESD’s claims database, dot variants of sandytangyS8@gmail.com (such as
san.dyta.ngyS58@gmail.com, sa.ndyt.a.ngyS8@gmail.com, and
san.d.y.t.an.gy58@gmail.com.) were used to submit approximately 102 claims for ESD
benefits exceeding $350,000. The Department of Labor’s analysis also indicates the
account was used to submit one or more claims to the SWAs for Hawaii, Maine,
Michigan, Missouri, Montana, New York, Ohio, Pennsylvania, Wisconsin, and
Wyoming.

E. Investigation of the Sandytangy58 SMS Number and Identification of
Abidemi Rufai.

14. On June 19, 2020, the government applied for, and the Honorable Paula L.
McCandlis issued, an order pursuant to 18 U.S.C. § 2703(d) directing Google to produce
non-content material associated with the sandytangy58@gmail.com account.

15. The 2703(d) order required Google to identify, inter alia, the recovery SMS
number for the account. Based on my experience and open source research, I know that

Google uses recovery SMS numbers as an alternate means to communicate with the

United States v. RUFAI UNITED STATES ATTORNEY
700 STEWART STREET
SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970

Complaint-10
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 11 of 15

account holder, including for purposes of two-step authentication and password recovery
if the account holder forgets his or her password. I know from my training and
experience that email account users ordinarily provide their own cell phone number as an
SMS recovery number so that they can easily validate their account.

16. Google’s response indicated that the recovery SMS number associated with
sandytangy58@gmail.com was the Nigeria-based number 234-909-874-2695 (the
“Sandytangy58 SMS Number’). Investigators conducted research into the Sandytangy58
SMS Number. They determined that this number was listed on a 2019 visa application of
a Nigerian man named ABIDEMI RUFAI. International travel records show that RUFAI
entered the United States on February 19, 2020, and left the country on August 9, 2020,
and was therefore apparently present in the United States during the period of the fraud.
When RUFAI arrived in the United States, he reported to the U.S. government that he
would be staying at his brother’s apartment on Guy R. Brewer Boulevard in Jamaica,
New York.

17. [have reviewed financial reporting showing that, between March 3, 2020
and August 2, 2020, a Citibank checking account in RUFAI’s name received a total of
$288,825 in deposits. $236,701 was transferred out of the account over the same period.

18. I have reviewed information from a financial institution reporting that on
May 19, 2020, a Richland, Missouri resident with the initials C.S. received an ACH
transfer of unemployment benefits from ESD in the amount of $9,920. ESD records
indicated that this payment was based on a claim submitted to ESD on May 18, 2020, in
the name of a Washington resident with the initials M.S. using the email address
s.a.n.dy.t.an.gyS8@gmail.com. Also on May 19, 2020, C.S.’s account received two ACH
transfers totaling $8,650 from the Maine Department of Labor. When questioned by her
credit union about the transfers, C.S. stated that she had withdrawn $11,000 of the funds
and sent them to an address on Guy R. Brewer Boulevard in Jamaica, New York. The

address C.S. provided is RUFAI’s brother’s apartment. On May 10, 2021, MLS. told

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-11 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 12 of 15

investigators he had never filed an unemployment claim or given anyone permission to
do so on his behalf.
F. Contents of the SandytangyS8@gmail Account

19. On January 29, 2021, the Honorable Michelle L. Peterson issued a search
warrant to Google for the sandytangy58@gmail.com account. Google responded to the
search warrant on approximately February 5, 2021.

20. Evidence of Fraud in the Account: The contents of the
sandytangy58@gmail.com account included over 1,000 emails from ESD, including the
automated activation emails that the SAW system sends when new user sets up an
account. The account also contained approximately 100 emails from the SWAs for
Hawaii, Wyoming, Massachusetts, Montana, New York, and Pennsylvania. The account
also contained numerous emails from Green Dot, which is a payment system that I know
was used to collect and transfer a large share of the claims that were filed with ESD using
the sandytangyS8@gmail.com account. In addition, the sandytangy58@gmail.com
account contained numerous emails from other online payment and cryptocurrency
services.

21.  Inaddition, the sandytangyS8@gmail.com account contained substantial
evidence that the user was actively engaged in stealing and retaining the personal
identifying information of American citizens. The account contained large volumes of
emails and file attachments with thousands of bank and credit card numbers, personal
identifying information such as dates of birth and U.S. addresses associated with first and
last names, and images of what appear to be driver licenses from various states, including
New York. The account also contained a very large volume of tax returns of United
States taxpayers. In many of the emails, the user appears to pose as an accountant,
signing the email “Sandy Tang CPA.”

22. The sandytangyS8@gmail.com account also contained emails indicating

that the user had submitted other types of fraudulent claims to the United States

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-12 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 13 of 15

government. For example, the account contained numerous emails from the Federal
Emergency Management Agency (FEMA) from September 2017, which appears to
indicate that the user had filed multiple claims for disaster relief during this period. The
account also contained emails from an online tax filing service indicating that the user
had filed tax returns in the United States.

23. Additional Evidence Linking Account to RUFAIT;: In response to the
January 2021 search warrant, Google also provided the contents of the Google Drive
account associated with the sandytangy58@gmail.com account. Google Drive allows
users to store documents, files, and other content online so that they can be remotely
accessed from anywhere. The Google Drive documents associated with the
sandytangy58@gmail.com account included four images of an individual who matches
the physical appearance of RUFAI in his 2019 visa application photo and secondary
inspection photos taken by U.S. Customs and Border Patrol on and January 19, 2017, and
February 18, 2020. In addition, the contact list for the sandytangy58@gmail.com
account included the email address bidemi.rufai@yahoo.co.uk, a variation of the email
address listed on RUFAI’s visa application (bidemi_rufai@yahoo.co.uk).

24. The sandytangy58@gmail.com account also included three confirmation
emails from online purchases that list RUFAI’s brother’s address on Guy R. Brewer
Boulevard in Jamaica, New York, as the billing address. For example, the account
contains a January 26, 2017 email string in which the user of the
sandytangy58@gmail.com account purchased a license to use Sigma Tax Pro software.
The billing information on the invoice is “Thuy Le, Sandy S Tang CPA,” and lists
RUFAI’s brother’s address on Guy R. Brewer Boulevard as the billing address.
Similarly, the sandytangyS8@gmail.com account was used to purchase a Verizon
wireless refill on February 14, 2017. The billing address for the order is “James Andrus”
at the Guy R. Brewer address. Of note, U.S. Customs and Border Patrol records show
that RUFAI arrived in New York on January 19, 2017 and remained in this country until

May 4, 2017, and therefore was in the country for the period of these transactions.
United States v. RUFAI UNITED STATES ATTORNEY
700 STEWART STREET
SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970

Complaint-13
0 DOAN KH Wn fF W NO

NO NO WN NO HN HN HN HN KN He He Ke KF KF Rr OR OF FS oe
oN DWN nN BP WN KF OD Oo wWOonNI DB Wn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 14 of 15

G. Evidence Relevant to Charged Wire Transmissions and Uses of Stolen
Identities.

25. As discussed above, the sandytangy58@gmail.com account contains emails
from the Washington SAW system. Some of these emails contain activation links sent by
the SAW system. I know from my interviews with ESD personnel that SAW sends these
activation emails at the time the user creates a SAW account. Therefore, each email
containing an activation link was immediately proceeded by the user accessing the SAW
system by a wire transmission terminating in Olympia, Washington. Because RUFAI
was staying in New York between February 19, 2020 and August 9, 2020, each of these
wire transmissions travelled from outside of Washington to Olympia, Washington. The
table below sets out five examples of these emails, including the date and the dot variant

used in the SAW submissions.

Date Address Reflected “To” Line of Email
4/27/2020 | san.dy.t.a.n.g.y.5.8@gmail.com
4/28/2020 | s.an.dyt.a.n.g.y.5.8@gmail.com
4/29/2020 | sa.n.d.yta.n.g.y.5.8@gmail.com

5/1/2020 | sandy.t.an.g.y.5.8@gmail.com
5/2/2020 | s.a.nd.ytangyS8@gmail.com

26. The evidence discussed above establishes probable cause to believe that:
(1) the sandytangy58@gmail.com account was used to submit fraudulent claims to ESD
and other states; (2) ABIDEMI RUFAI is the operator of the sandytangyS8@gmail.com
account; and (3) some of the proceeds of claims filed using the account were mailed to

the New York address where RUFAI was staying during the period of the fraud. Based
//

//

United States v. RUFAI UNITED STATES ATTORNEY
700 STEWART STREET
SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970

Complaint-14
Oo AN NHN Wn FP W NY

DO NO WN WN HN KH HN HN KN HR Re Re Fe RF FF Re Ree
oN DON MN BR WN KF OD OO WON WD Nn BPW NY KF CO

Case 3:21-cr-05186-BHS Document3 Filed 05/14/21 Page 15 of 15

on all of this evidence, there is probable cause to believe that ABIDEMI RUFAI

committed the offenses alleged above.

s/ Andrea L. Desanto
ANDREA L. DESANTO
Complainant

Special Agent, FBI

The above-named agent provided a sworn statement attesting to the truth of the
contents of the foregoing affidavit by telephone on this 14th day of May, 2021. The Court

hereby finds that there is probable cause to believe the Defendant committed the offense

Dy Cats

THE HONORABLE DAVID W. CHRISTEL
United States Magistrate Judge

set forth in the Complaint.

United States v. RUFAI UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-15 Summ S00
SEATTLE, WASHINGTON 98101
(206) 553-7970

File and source

File

gov.uscourts.wawd.299847.3.0.pdf

Size

8,192,569 bytes

SHA-256

06fd21783730813b475e24a473c89facc19f1665aa45b6c36fd3ff15f8e60f84

Our copy

gov.uscourts.wawd.299847.3.0.pdf

Original

PACER (login required)