Complaint — United States v. Chukwuemeka Onyegbula, Case No. MJ21-5117 (Western District of Washington)

Summary

This June 2021 complaint in the Western District of Washington, Case No. MJ21-5117, charges Chukwuemeka Onyegbula, also known as Phillip Carter, with five counts of wire fraud under 18 U.S.C. § 1343. FBI Special Agent Heidi Hawkins states that Onyegbula, a Nigerian national not entitled to unemployment benefits in the United States, used stolen personal identifying information to submit at least 253 unemployment claims to the Washington Employment Security Department and other state workforce agencies. The complaint says Onyegbula also used stolen identities to apply to the SBA for Economic Injury Disaster Loans, sometimes using the same identity for both. It cites a Washington State Auditor finding that ESD paid at least $642,954,417 in fraudulent imposter claims, of which $369,789,082 has been recovered. Chief Magistrate Judge J. Richard Creatura found probable cause.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Text recognized from a scanned document; may contain errors.

Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 1 of 19

FILED LODGED

Jun 07, 2021

CLERK U.S. DISTRICT COURT

WESTERN DISTRICT OF WASHINGTON AT TACOMA
BY DEPUTY

The Honorable J. Richard Creatura

UNITED STATES DISTRICT COURT FOR THE
WESTERN DISTRICT OF WASHINGTON
AT TACOMA

UNITED STATES OF AMERICA,
Plaintiff

V.

CHUKWUEMEKA ONYEGBULA
a/k/a Phillip Carter,
Defendant.

CASE NO. MJ21-5117
COMPLAINT for VIOLATIONS

Title 18 U.S.C. § 1343

BEFORE, J. Richard Creatura, Chief United States Magistrate Judge, United

States Courthouse, Tacoma, Washington.

The undersigned complainant, being duly sworn, states:

A. Background

COUNTS 1-5

(Wire Fraud)

1. These charges involve CHUKWUEMEKA ONYEGBULA’s use of

Americans’ stolen personal identifying information (PII) to submit fraudulent claims for

benefits intended for American workers and businesses suffering from the economic

effects of the COVID-19 pandemic. As described herein, ONYEGBULA, a Nigerian

United States v. Onyegbula
Complaint-1

UNITED STATES ATTORNEY
700 STEWART STREET
SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 2 of 19

national who is not entitled to collect unemployment benefits in the United States,
submitted at least 253 unemployment claims to the Washington Employment Security
Department and other state workforce agencies using the stolen identities of residents of
Washington and other states. Similarly, ONYEGBULA used stolen PII to submit
fraudulent applications to the United States Small Business Administration (SBA) to
benefit from the Economic Injury Disaster Loan program. In multiple instances, the
same stolen PII was used to submit both unemployment claims and SBA applications.

2. CARES Act Unemployment Benefits: On March 27, 2020, the United
States enacted into law the Coronavirus Aid, Relief, and Economic Security (CARES)
Act. The CARES Act authorized approximately $2 trillion in aid to American workers,
families, and businesses to mitigate the economic consequences of the COVID-19
pandemic. The CARES Act funded and authorized each state to administer new
unemployment benefits. These benefits include: (1) Federal Pandemic Unemployment
Compensation (FPUC), which provided a benefit of $600 per week per unemployed
worker in addition to existing benefits; (2) Pandemic Unemployment Assistance (PUA),
which extends benefits to self-employed persons, independent contractors, and others;
and (3) Pandemic Emergency Unemployment Assistance (PEUC), which extends benefits
for an additional 13 weeks after regular unemployment benefits are exhausted.

3. CARES Act unemployment benefits are funded by the United States
government through the Department of Labor and administered at the state level by state
agencies known as state workforce agencies (SWAs). The Washington Employment
Security Department (ESD) is the SWA for the State of Washington.

Applicants can apply online for ESD-administered benefits by accessing Washington’s
SecureAccess Washington (SAW) web identity validation portal and ESD’s
Unemployment Tax and Benefit (UTAB) online application system.

4. Before submitting an application to ESD, the applicant must establish a

SAW account. As part of this process, the applicant must provide the SAW system with

an email address. The SAW system then sends, by interstate wire communication
United States v. Onyegbula UNITED STATES ATTORNEY
: 700 STEWART STREET
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 3 of 19

originating in Olympia, Washington, an activation link to the email address provided.
The user must then click on a link to activate his or her account. This process causes a
series of wire transmissions originating at the user’s location and terminating in Olympia,
Washington.

5. After activating the SAW account, the user may proceed to ESD’s UTAB
application system. To file a claim, the applicant enters his or her PII, to include name,
date of birth, and Social Security number. If ESD confirms that the information matches
the PII of a person in ESD’s records, ESD will pay out benefits via wire (ACH) transfer
to a bank or financial account identified by the applicant. Other SWAs accept and
process claims following similar procedures.

6. The Economic Injury Disaster Relief Program: The Economic Injury
Disaster Loan (EIDL) program is a U.S. Small Business Administration (SBA) program
that provides low-interest financing to small businesses, renters, and homeowners in
regions affected by declared disasters.

7. The CARES Act also authorized the SBA to provide EIDLs of up to $2
million to eligible small businesses experiencing substantial financial disruption due to the
COVID-19 pandemic. In addition, the CARES Act authorized the SBA to issue advances
of up to $10,000 to small businesses within three days of applying for an EIDL. The
amount of the advance is determined by the number of employees the applicant certifies
having. The advances do not have to be repaid.

8. In order to obtain an EIDL and advance, a qualifying business must submit
an application to the SBA and provide information about its operations, such as the number
of employees, gross revenues for the 12-month period preceding the disaster, and cost of
goods sold in the 12-month period preceding the disaster. In the case of EIDLs for COVID-
19 relief, the 12-month period was that preceding January 31, 2020. The applicant must
also certify that all of the information in the application is true and correct to the best of

the applicant’s knowledge.

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-3 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 4 of 19

9. EIDL applications are submitted directly to the SBA and processed by the
agency with support from a government contractor, Rapid Finance. The amount of the
loan, if the application is approved, is determined based, in part, on the information
provided by the application about employment, revenue, and cost of goods, as described
above. SBA directly disburses advances and any other funds issued under an EIDL.
EIDL funds can be used for payroll expenses, sick leave, production costs, and business
obligations, such as debts, rent, and mortgage payments.

10. Disaster Declarations: CARES Act unemployment benefits and EIDLs
related to COVID-19 relief are authorized, transferred, disbursed, and paid in connection
with a nationwide emergency declared by Presidential Proclamation 9994 (effective as of
March 1, 2020) and a Presidential declaration of a major disaster for the State of
Washington concerning the COVID-19 pandemic that was issued on March 22, 2020.

B. The Scheme to Defraud

11. Beginning at a time unknown, but no later than April 20, 2020, and
continuing through at least February 21, 2021 at Olympia, within the Western District of
Washington, and elsewhere, CHUKWUEMEKA ONYEGBULA, aka Phillip Carter, and
others known and unknown to the Grand Jury, with intent to defraud, knowingly devised
a scheme and artifice to defraud and to obtain money and property by means of
materially false and fraudulent pretenses, representations and promises, as further
described below.

12. | The essence of the scheme and artifice to defraud was to use the stolen PI
of residents of the United States to fraudulently obtain federally-funded benefits,
including pandemic-related unemployment benefits administered by SWAs, including
ESD, as well as EIDLs administered by the SBA.

C. Manner and Means

The following conduct was part of the scheme and artifice to defraud:

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-4 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 5 of 19

13. ONYEGBULA unlawfully obtained and possessed the stolen PII, to include
names, dates of birth, and Social Security numbers, of residents of Washington and other
States.

14. ONYEGBULA created email accounts, including a Google-administered
account with the address “phillipcarterO0O2@gmail.com,” for the purpose of participating
in fraudulent transactions while obscuring his identity.

15. ONYEGBULA, using foreign and interstate wire transmissions, accessed
ESD’s SAW portal, as well as similar portals of other SWAs, including the SWAs for the
states of Arizona, California, Colorado, Illinois, Indiana, Kansas, Massachusetts,
Michigan, Minnesota, Missouri, Montana, Ohio, Nevada, Rhode Island, Texas, and
Wisconsin.

16. To establish SAW accounts, ONYEGBULA provided the
phillipcarterO02@gmail.com email address to ESD and other SWAs as the designated
email addresses to receive activation emails from the SWAs to activate fraudulent claims.
Each time ONYEGBULA input this email address into the SAW system, an activation
email was sent to the phillipcarterO0O2@gmail.com email account. Each of these emails
was sent via an interstate wire transmission originating from the State Data Center in
Olympia, Washington and passing through a Google data center outside the state of
Washington.

17. To prevent ESD and other SWAs from recognizing that the same email
account was being used to file multiple claims, ONYEGBULA used dozens of variants of
the email addresses by placing periods at different locations within the email address for
each claim. For example, ONYEGBULA opened SAW accounts and submitted claims
using the variants phil.lip.carterO02@gmail.com, p.hillip.carterOO2@gmail.com, and
phillip.carterO0O2@gmail.com. This enabled ONYEGBULA to file multiple claims using
the same email account, without ESD and other SWAs detecting that they were doing so.

18. After establishing SAW accounts, ONYEGBULA used the SAW accounts
to access ESD’s UTAB website. ONYEGBULA then filed fraudulent claims for CARES

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-5 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 6 of 19

Act unemployment benefits using the stolen PII of Washington residents.
ONYEGBULA similarly used the stolen PII of residents of other states to submit claims
to the SWAs for those respective states using those states’ online application systems.
19. ONYEGBULA accessed the COVID-19 Economic Injury Disaster page on
SBA’s website and submitted applications for EIDLs. ONYEGBULA provided variants
of the phillipcarterO02@gmail.com account as the contact email address for the claims.

ONYEGBULA filed the claims using the stolen PII of residents of Washington and other

states.

20.

ONYEGBULA directed that the benefits be paid to bank or other financial

accounts under his control or the control of co-conspirators. ONYEGBULA and others

then directed that the funds be withdrawn and ultimately transferred to ONYEGBULA

and/or his co-conspirators.

D. Execution of the Scheme and Artifice to Defraud

21.

On or about the dates and times set forth below, in Olympia, within the

Western District of Washington and elsewhere, for the purpose of executing and

attempting to execute this scheme and artifice to defraud, CHUKWUEMEKA
ONYEGBULA, and others known and unknown, aiding and abetting each other, did

knowingly transmit and cause to be transmitted by wire communication in interstate and

foreign commerce, writings, signs, signals, pictures and sounds, each transmission of

which constitutes a separate count of this Complaint:

United States v. Onyegbula

Complaint-6

UNITED STATES ATTORNEY

SEATTLE, WASHINGTON 98101

Count | Date and Wire Transmission
Time
(PDT)
1 5/11/2020 | Account activation email from the State Data Center in Olympia,
at 09:26:14 | Washington to the email account philllipcarterO02@gmail.com via
a Google server outside of Washington
2 5/12/2020 | Account activation email from the State Data Center in Olympia,
at 14:14:48 | Washington to the email account philllipcarterO02@gmail.com via
a Google server outside of Washington

700 STEWART STREET
SUITE 5220

(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 7 of 19

3 5/16/2020 | Account activation email from the State Data Center in Olympia,
at 14:55:45 | Washington to the email account philllipcarterO02@gmail.com via
a Google server outside of Washington
4 5/16/2020 | Account activation email from the State Data Center in Olympia,
at 15:57:32 | Washington to the email account philllipcarterO0O2@gmail.com via
a Google server outside of Washington
5 5/17/2020 | Account activation email from the State Data Center in Olympia,
at 00:17:58 | Washington to the email account philllipcarterO0O2@gmail.com via
a Google server outside of Washington

All in violation of Title 18, United States Code, Sections 1343 and Section 2.

And the complainant states that this Complaint is based on the following

information:

I, Special Agent Heidi Hawkins, being first duly sworn on oath, depose and say:
AFFIANT BACKGROUND AND SCOPE OF AFFIDAVIT

I am a Special Agent with the Federal Bureau of Investigation (“FBI”), and

have been since 2019. I am currently assigned to the Seattle Field Office. My primary

duties include investigating violations of federal law, including but not limited to, Title

18, United States Code, Sections 1343 (Wire Fraud), 1028A (Aggravated Identity Theft),

1956 (Money Laundering), 1957 (Transactional Money Laundering), and conspiracy to

commit these offenses. I attended and graduated from the Basic Field Training Course at

the FBI Academy in Quantico, Virginia. At the FBI Academy, part of the training

involved learning about the investigative value of the Internet, as well as ways the

Internet can be criminally exploited to defraud others.

2.

Based on my training and experience, I am familiar with the ways in which

individuals involved in fraud schemes use shell e-mail accounts, computers, cellular

telephones, Internet Protocol (IP) addresses, bank accounts, synthetic identities, and

counterfeit documents to facilitate fraudulent activity. I have learned that individuals

perpetrating computer intrusions and identity theft-related bank fraud and wire fraud

schemes employ a number of techniques, either alone or in combination, to further their

United States v. Onyegbula

Complaint-7

UNITED STATES ATTORNEY
700 STEWART STREET
SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 8 of 19

illegal activities and to avoid detection by law enforcement. These techniques include:
utilizing web-based email accounts and other electronic messaging accounts to send,
receive, store, and obtain personal identifying information (PII), such as dates of birth
and bank and credit card account numbers and related information; and the use of cloud-
based accounts to communicate and store information and tools related to the fraud. I
know that individuals involved in fraud schemes often establish shell e-mail accounts and
e-mail addresses in fictitious names and/or in the names of third parties in an effort to
conceal their identities and illicit activities from law enforcement. I know that
individuals involved in fraud often use virtual private network (VPN) accounts and
Internet hosting services to conceal their true identities and geographical locations from
law enforcement or other entities.

3. The purpose of the Affidavit is to describe the evidence relevant to the
existence of probable cause to believe that CHUKWUEMEKA ONYEGBULA
committed the offenses set forth above. As a result, the information in this Affidavit is
limited to that relevant to the existence of probable cause. This Affidavit does not set
forth all facts known to me that are relevant to this investigation.

EVIDENCE OF THE CRIMINAL OFFENSES
A. The CARES Act

i. CARES Act Unemployment Benefits

4. Based on publicly-available information, I know that on March 27, 2020,
the United States enacted into law the Coronavirus Aid, Relief, and Economic Security
(CARES) Act. The CARES Act authorized approximately $2 trillion in aid to American
workers, families, and businesses to mitigate the economic consequences of the COVID-
19 pandemic. The CARES Act funded and authorized each state to administer, new
unemployment benefits. These benefits include (1) Federal Pandemic Unemployment
Compensation (FPUC), which provides an additional benefit of $600 per week per

unemployed worker; (2) Pandemic Unemployment Assistance (PUA), which extends

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-8 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 9 of 19

benefits to self-employed persons, independent contractors, and others; and (3) Pandemic
Emergency Unemployment Assistance (PEUC), which extends benefits for an additional
13 weeks after regular unemployment benefits are exhausted. The CARES Act allows an
unemployed worker to obtain back benefits retroactive to the date on which the applicant
was affected by COVID-19, which, under program rules, may be as early as February 2,
2020.

5. CARES Act unemployment benefits are funded by the United States
government through the Department of Labor and administered at the state level by state
agencies known as state workforce agencies (SWAs). The Washington Employment
Security Department (ESD), the component of the State of Washington responsible for
administering unemployment benefits, is the SWA for the State of Washington.
Applicants apply for ESD-administered benefits using Washington’s SecureAccess
Washington (SAW) web portal and an ESD-administered site known as the
Unemployment Tax and Benefit (UTAB) system.

6. Based on interviews with ESD personnel, I know that, to apply for ESD
benefits online, a claimant must first open an account with the SAW system. The SAW
system is a website hosted at the State Data Center in Olympia, Washington that verifies
the identities of users. To open a SAW account, the applicant must access the SAW
website, which causes a wire communication to the servers at the State Data Center. The
applicant must provide SAW with basic identifying and contact information, to include
an email account. The SAW system sends an activation link to the provided email
account. The claimant must then access the email account and click the activation link to
complete the SAW account setup process. Once that process is complete, the applicant
may use his or her SAW account to access UTAB and submit a claim for ESD benefits.

7. To submit an ESD claim through UTAB, the applicant must enter his or her
PII (including name, date of birth, and Social Security number). ESD checks this

information against its database of Washington residents. If ESD confirms that the

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-9 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 10 of 19

information matches the PII of a person in ESD’s records, ESD will pay out benefits via
wire (ACH) transfer to an account identified by the applicant.

ii. The Economic Injury Disaster Loan Program

8. I know from communications with other federal agents that the Economic
Injury Disaster Loan (EIDL) program is a U.S. Small Business Administration (SBA)
program that provides low-interest financing to small businesses, renters, and
homeowners in regions affected by declared disasters.

9. The CARES Act also authorized the SBA to provide EIDLs of up to $2
million to eligible small businesses experiencing substantial financial disruption due to the
COVID-19 pandemic. In addition, the CARES Act authorized the SBA to issue advances
of up to $10,000 to small businesses within three days of applying for an EIDL. The
amount of the advance is determined by the number of employees the applicant certifies
having. The advances do not have to be repaid.

10. ‘In order to obtain an EIDL and advance, a qualifying business must submit
an application to the SBA and provide information about its operations, such as the number
of employees, gross revenues for the 12-month period preceding the disaster, and cost of
goods sold in the 12-month period preceding the disaster. In the case of EIDLs for COVID-
19 relief, the 12-month period was that preceding January 31, 2020. The applicant must
also certify that all of the information in the application is true and correct to the best of
the applicant’s knowledge.

11. EIDL applications are submitted directly to the SBA and processed by the
agency with support from a government contractor, Rapid Finance. The amount of the
loan, if the application is approved, is determined based, in part, on the information
provided by the application about employment, revenue, and cost of goods, as described
above. SBA directly disburses advances or any other funds issued under an EIDL. EIDL
funds can be used for payroll expenses, sick leave, production costs, and business

obligations, such as debts, rent, and mortgage payments.

United States v. Onyegbula UNITED STATES ATTORNEY
. 700 STEWART STREET
Complaint-10 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 11 of 19

B. Overview of Investigation

12. I know from my contact with other law enforcement officers that,
beginning on around April 20, 2020, officials began receiving complaints from
employers about potentially fraudulent unemployment claims. The employers reported
that they had received notices from ESD indicating that persons still under their employ
had filed unemployment claims. For example, on or about April 20, 2020, the Seattle
Fire Department (SFD) notified the U.S. Attorney’s Office for the Western District of
Washington that claims had been filed in the names of multiple firefighters who were
actively employed by SFD. SFD reported that it had interviewed the firefighters, who
had denied any involvement in the claims. Other employers, including Microsoft
Corporation, the City of Bellingham, Zulily, and Seattle Yacht Club submitted similar
complaints.

13. Roughly around that same time, numerous investigative agencies, including
the Federal Bureau of Investigation, the Social Security Administration Office of
Inspector General, the United States Secret Service, the Department of Labor Office of
the Inspector General, the United States Postal Inspection Service, and Internal Revenue
Service Criminal Investigation, joined the investigation. Agents from these agencies,
including myself, have reviewed voluminous financial records and databases reflecting
the fraudulent transactions and have conducted dozens of interviews.

14. The investigation has developed evidence that hundreds of millions of
dollars’ worth of fraudulent claims were filed with ESD using the stolen PII of
Washington residents. The FBI investigation has determined that many of the fraudulent
claims were filed using IP addresses that resolve to Nigeria. While the actual amount of
loss is unknown, the Washington State Auditor has issued a report finding that ESD paid
out at least $642,954,417 in fraudulent imposter claims, of which $369,789,082 has been

recovered.

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-11 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 12 of 19

C. Role of Gmail Accounts in the Fraud

15. | ESD provided the government with data identifying the email accounts
associated with claims submitted over the period of the fraud. The data indicate that
thousands of different email accounts, including accounts operated by Google, were used
in connection with the filing of the fraudulent claims.

16. For many of these Google email accounts, perpetrators took advantage of a
particular feature of Google email accounts that allowed them to submit multiple
fraudulent claims from a single Google email account, while concealing from ESD the
fact that a single email address was being used repeatedly. Specifically, in routing emails
to an email box, Google disregards periods in the email address, meaning that the email
address “john.doe@gmail.com” and “johndoe@gmail.com” will resolve to the same
Google email account, even though ESD identifies them as two different accounts. Two
email addresses like these that are distinguished only by periods are known as “Google
variants” or “dot variants.” I know from my training and experience that criminals
sometimes take advantage of this feature to make it appear that emails are originating
from multiple accounts, when in fact they originate from the same account. This reduces
the number of email accounts that a criminal must open and monitor while perpetrating a
fraud, while avoiding fraud alerts that may be triggered when multiple claims originate
from the same account.

D. Use of the phillipcarter002@gmail.com Account

17. Investigators analyzed ESD’s database to identify Gmail accounts that were
used to submit multiple claims using the Google dot variant method discussed above.
Among these accounts was an account with the address phillipcarterO02@gmail.com.
Unemployment claims were submitted using different variants of this account. For
example, claims were submitted in the names of different Washington residents using the

email addresses p.hi.1.1.ip.carterO0O2@gmail.com, p.h.illip.carterO0O2@gmail.com, and

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-12 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 13 of 19

p-hil.Lip.carterO0O2@gmail.com. For the reasons explained above, each of these addresses
resolves to the same account.

18. Ananalysis of SWA claims data by the United States Department of Labor,
Office of the Inspector General, indicates that variants of phillipcarterO02@gmail.com
was used to submit at least 253 claims for unemployment benefits to the SWAs for the
states of Arizona, California, Colorado, Illinois, Indiana, Kansas, Massachusetts,
Michigan, Minnesota, Missouri, Montana, Ohio, Nevada, Rhode Island, Texas, and
Wisconsin. The analysis further shows that at least $289,604 was paid out on those
claims. In addition, data provided by SBA indicates that the email account was used to
submit at least 63 applications for EIDL, and that at least $53,900 was paid out on those
applications.

E. The Contents of the phillipcarter002@gmail.com Email Account
i. Evidence the Account Was Used for Fraud

19. On August 21, 2020, the Honorable Mary Alice Theiler authorized a search
warrant for phillipcarterO0O2@gmail.com. The material produced by Google in response
to the search warrant confirmed that phillipcarterO02@gmail.com and its variants were
used to register multiple SAW accounts, which were then used to submit fraudulent
claims. For example, the phillipcarterO0O2@gmail.com account contains activation and
subsequent emails from ESD indicating that new SAW accounts had been activated.

20. The account also contains similar emails from many other SWAs, including
the Colorado Department of Labor and Employment, the Michigan Department of Labor
and Economic Opportunity, and the Massachusetts Department of Unemployment
Assistance. In addition, the account contains many emails from the SBA indicating that
the account was used to file applications to participate in the EIDL program.

21. |The account also contains dozens of tax returns of U.S residents, as well as
a host of emails confirming the submission of tax returns, indicating that the account may

have been used to seek fraudulent tax refunds. Finally, the account contains lists of PII

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-13 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 14 of 19

and email account login information, suggesting that the account may have been used in

connection with business email compromise frauds.

ii. Evidence Tying the Account to CHUKWUEMEKA ONYEGBULA

22. Other evidence within Google’s search warrant return suggests that the
phillipcarterO02@gmail.com account is operated by a resident of Nigeria named
CHUKWUEMEKA ONYEGBULA. For example, in a March 9, 2016, email string, the
user of the phillipcarterO02@gmail.com account was asked for his bank account
information. The user responded by providing a Guaranty Trust bank account number
0015949393 and the name “ONYEGBULA Chukwuemeka.” The email account also
contains a U.S. visa application receipt with passport number A04701733 in the name
“Chukwuemeka Onyegbula” and two of his family members. In addition, the Google
Drive account contains a document that appears to be homework completed by a student
with the initials “A.O.”, ONYEGBULA identified this person as his child on his U.S.
visa application dated August 23, 2017. This homework document was attached to an
email from the phillipcarterO02@gmail.com account sent to c.onyegbula@yahoo.com.

23. The search warrant return contained contacts for the
phillipcarterO02@gmail.com account. The account’s contacts included the email address
c.onyegbula@yahoo.com and an account with the similar address of
c.onyegbula@poocng.com. Based on internet research, I have determined that the
domain “poocng.com” belongs to a Nigerian petroleum company called Pan Ocean Oil
Corporation Nigeria Limited. I have reviewed the 2017 visa application submitted by
CHUKWUEMEKA ONYEGBULA in which he lists his occupation as an engineer with
Pan Ocean Oil Corporation Nigeria Limited. In the visa application, CHUKWUEMEKA
ONYEGBULA also lists his email address as c.onyegbula@yahoo.com.

24. — The phillipcarterO02@gmail account has several other connections to the
c.onyegbula@yahoo.com account. For example, on October 10, 2015,

phillipcarterO02@gmail.com sent an email to c.onyegbula@yahoo.com with no message

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-14 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 15 of 19

but three text file attachments. Each of the text files contains a list of PII, such as social
security numbers, dates of birth, email addresses, passwords, and answers to challenge
questions. Similarly, on August 29, 2016, the phillipcarterO0O2@gmail.com account
forwarded an email to c.onyegbula@yahoo.com with no message but with what appears
to be a Dropbox (a cloud storage service) file share link. I know from my training and
experience that criminals operating multiple email accounts sometimes forward emails
from one account to the other as a way of moving information between accounts.

25. I obtained Yahoo subscriber records for the c.onyegbula@yahoo.com
account. The records indicated that the subscriber’s name on the
c.onyegbula@yahoo.com account is CHUKWUEMEKA ONYEGBULA, and that the
account was established on November 23, 2007 and remains active. The phone number
associated with the c.onyegbula.@yahoo.com is the Nigerian number (234) 8035376640
and the recovery email associated to the account is c.onyegbula@poocng.com, both of
which ONYEGBULA provided on his 2017 visa application.

26. | Yahoo also provided a list of IP addresses from which the
c.onyegbula@yahoo.com was accessed. I noted that one particular IP address—
102.67.0.75—was used to access the c.onyegbula@yahoo.com 19 times between July 1,
2020 and January 14, 2021. I then compared that IP address to IP information provided
by Google for phillipcarterOO2@gmail.com. Google reported IP information for nine
different sessions between July 7, 2020 and August 4, 2020. For six of those nine
sessions, the phillipcarterO02@gmail.com account was accessed from IP address
102.67.0.75— the same IP address used to access the c.onyegbula@yahoo.com account.
The fact that the two accounts were repeatedly accessed from the same IP address over
approximately the same period of time indicates that the operators of the accounts are the
same person, or at least closely related.

27. On February 23, 2021, the government obtained a pen register and trap and
trace device (PRTT) for the WhatsApp account associated with the phone number (234)

8035376640 (the phone number associated with the c.onyegbula@yahoo.com account
United States v. Onyegbula UNITED STATES ATTORNEY
. 700 STEWART STREET
Complaint-15 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 16 of 19

and listed on ONYEGBULA’S visa application). Data produced by the PRTT indicate
that, over the period between March 4, 2021 and April 9, 2021, the user of this phone
number repeatedly accessed the account from the IP address 102.67.0.75—the same IP
address used to access the phillipcarterO0O2@gmail.com account and the
c.onyegbula@yahoo.com account.

F. Contents of the c.onyegbula@yahoo.com Account

28. On April 15, 2021, the Honorable Michelle Peterson authorized a search
warrant for the c.onyegbula@yahoo.com account. The material produced by Yahoo in
response to the search warrant confirmed that c.onyegbula@yahoo.com is owned by
ONYEGBULA and is closely connected to the phillipcarterO02@gmail.com account.

29. Among the items found in the c.onyegbula@yahoo.com account are at least
two images of an individual who matches the physical appearance of ONYEGBULA in
his 2017 visa application photo.

30. The search warrant return also contained contacts for the
c.onyegbula@yahoo.com account. These contacts included email address
c.onyegbula@poocng.com—the same email address that was a contact for the
phillipcarterO02@gmail.com account and that ONYEGBULA listed on his 2017 visa
application.

31. The c.onyegbula@yahoo.com search warrant return also included multiple
statements of accounts from Polaris bank addressed to “Mr. CHUKWUEMEKA
ONYEGBULA’” reflecting his salary from Pan Ocean Oil Corporation. Pan Ocean Oil
Corporation is the company ONYEGBULA listed as his employer on his 2017 visa
application. It is also the company that resolves to ONYEGBULA’s
c.onyegbulaWpoocng.com email account.

32. The c.onyegbula@yahoo.com account also contained an email with subject
“Paycheck Direct Deposit” from an individual to c.onyegbulaWpoocng.com,

c.onyegbula@yahoo.com, phillipcarterOO2@gmail.com, and

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-16 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 17 of 19

Chukwuemeka.onyegbula@newcross.com. All four email accounts were listed in the
“To” line of the email header and are associated to ONYEGBULA. Therefore, based on
my training and experience, ONYEGBULA was very clearly the intended recipient of the
email.

33. In addition, as referenced above, the phillipcarterO0O2@gmail.com account
contained an email reflecting ONYEGBULA’s Guaranty Trust (GT) Bank account
number 0015949393. Within the c.onyegbula@yahoo.com account, there are also
numerous GT Bank statements in the name of “ONYEGBULA, CHUKWUEMEKA”
with savings account number 0015949393. This account number is the same account
referenced within both email accounts.

34. The c.onyegbula@yahoo.com account also includes an image of a Nigerian
Passport for a child with initials A.O. and passport number A08403026, which is the
same child listed as ONYEGBULA’s dependent on his 2017 visa application. This is
same visa application associated with the visa application receipt found in the
phillipcarterO02@gmail.com account. That receipt also referenced A.O. as a dependent
of ONYEGBULA’s with passport number A08403026. The passport number and
dependent information are the same within both email accounts.

35. Further, the c.onyegbula@yahoo.com account includes emails from what
appears to be an educational program in which A.O. is frequently referenced as a child of
ONYEGBULA. Payments to this same educational program are deducted from
ONYEGBULA’s GT Bank account number 0015949393. The
phillipcarterO02@gmail.com account also references the same GT Bank account.

G. Interviews of Washington State Victims

36. I have interviewed three Washington state residents whose PII was used to
file claims with SAW accounts activated by phillipcarterO02@gmail.com. Each person
confirmed that (1) he or she did not file an ESD claim; (2) the PII used in the claim was
his or her PII; and (3) the email address phillipcarterO02@gmail.com was not his or her

email address.
United States v. Onyegbula UNITED STATES ATTORNEY
: 700 STEWART STREET
Complaint-17 SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 18 of 19

H. Evidence Relevant to Charged Wire Transmissions and Uses of Stolen
Identities.

37. As discussed above, the phillipcarterO0O2@gmail.com account contains
emails from the SAW system. Some of these emails contain activation links sent by the
SAW system. I know from my interviews with ESD personnel that SAW sends these
activation emails from the State Data Center in Olympia, Washington. I also know from
my training and experience that any email sent to a Gmail account must be routed to a
Google data center. I have reviewed a map produced by Google identifying all of its data
centers. None of the data centers are located in the State of Washington. Accordingly,
each activation email necessarily travelled from the State Data Center in Olympia, over
interstate wires, to a Google data center in another state.

38. The following is a list of some of the activation emails I found in the

phillipcarterO02@gmail.com account:

Date and_ | Interstate Wire Transmission
Time
(PDT)

5/11/2020 at | Account activation email from the State Data Center in Olympia,
09:26:14 | Washington to the email account philllipcarterO02@gmail.com
via a Google server outside of Washington

5/12/2020 at | Account activation email from the State Data Center in Olympia,
14:14:48 | Washington to the email account philllipcarterO02@gmail.com
via a Google server outside of Washington

5/16/2020 at | Account activation email from the State Data Center in Olympia,
14:55:45 | Washington to the email account philllipcarterO02@gmail.com
via a Google server outside of Washington

5/16/2020 at | Account activation email from the State Data Center in Olympia,
15:57:32 | Washington to the email account philllipcarterO02@gmail.com
via a Google server outside of Washington

5/17/2020 at | Account activation email from the State Data Center in Olympia,
00:17:58 | Washington to the email account philllipcarterO02@gmail.com
via a Google server outside of Washington

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-18 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970
Case 3:21-cr-05214-BHS Document1 Filed 06/07/21 Page 19 of 19

39. The evidence discussed above establishes probable cause to believe that
CHUKWUEMEKA ONYEGBULA used the phillipcarterO02@gmail.com account to
submit fraudulent unemployment claims to ESD and other states, and to submit
fraudulent applications to the SBA for EIDLs. Based on all of this evidence, there is
probable cause to believe that CHUKWUEMEKA ONYEGBULA committed the

offenses alleged above.

HEIDI HAWKINS
Complainant
Special Agent, FBI

The above-named agent provided a sworn statement attesting to the truth of the
contents of the foregoing affidavit by telephone on this 6" day of June, 2021. The Court

hereby finds that there is probable cause to believe the Defendant committed the offenses

THE HONORABLE J. RICHARD CREATURA
Chief United States Magistrate Judge

set forth in the Complaint.

United States v. Onyegbula UNITED STATES ATTORNEY
Complaint-19 700 STEWART STREET

SUITE 5220
SEATTLE, WASHINGTON 98101
(206) 553-7970


File and source

File

dl_9ea2bb2e193b62c6.pdf

Size

344,630 bytes

SHA-256

7e11957c45004e09a4cb08a86f72c9551778ae0399def11a26ebce68255e2f24

Our copy

dl_9ea2bb2e193b62c6.pdf

Original

www.justice.gov