Nigerian Hacker Matthew Akande Sentenced to 8 Years for $8.1M Tax Refund Fraud

A Nigerian national received eight years in federal prison for hacking Massachusetts tax firms and stealing $1.3 million in fraudulent refunds. Matthew Abiodun Akande, 37, targeted CPA firms from 2016 to 2021. He filed over 1,000 fake returns seeking $8.1 million using stolen client PII. U.S. District Judge Indira Talwani also ordered $1.4 million restitution and three years supervised release.

Akande bought Warzone RAT licenses and crypters to evade antivirus. He phished four firms impersonating a CEO from a Massachusetts engineering company. Emails included real 2019 W-2/1099 forms for credibility. Dropbox links delivered malware disguised as prior-year tax files. Firm owners clicked and infected networks.

Once inside, Warzone stole Social Security numbers and tax history. Co-conspirators cashed refunds at U.S. banks. Funds flowed to Mexico accounts under Akande’s direction. Authorities arrested him at Heathrow Airport in October 2024. Extradition followed in March 2025 after 2022 indictment.

Attack Timeline Table

Period	Activity	Impact
June 2016-Jun 2021	Hacked 4 MA tax firms	1,000+ fake returns filed
2022	Federal grand jury indictment	Charges unsealed
Oct 2024	Arrest at Heathrow Airport	Extradition to US begins
Mar 2025	Extradited from UK	Trial proceedings start
Feb 2026	8-year sentence, $1.4M restitution	Case closed

Five-year crime spree ended.

Phishing Lure Details

Akande crafted convincing attacks:

• Spoofed CEO email from engineering firm.
• Attached legitimate 2019 W-2, 1099 forms.
• Dropbox link promised prior-year taxes.
• Executable disguised as tax documents.

Tax pros clicked without suspicion.

Malware Arsenal

Tools enabled mass theft:

• Warzone RAT: Remote access and data exfiltration.
• Crypter: Antivirus evasion for payload delivery.
• Phishing infrastructure: CEO domain/email spoofing.

FBI seized Warzone C2 servers in 2024.

Refund Laundering Flow

Stolen PII funded scheme:

1. File fraudulent returns with victim SSNs.
2. Direct refunds to U.S. accomplice accounts.
3. Cash withdrawals and bank transfers.
4. Funds wired to Mexico associates.
5. Akande received criminal profits.

$1.3M successfully stolen.

Victim Impact Analysis

Tax firms suffered severely:

• Client PII exposed (SSNs, tax history).
• Reputational damage from breach.
• IRS audits and compliance costs.
• Years of remediation efforts.

Over 1,000 identities compromised.

Legal Consequences

Charge Category	Penalty Applied
Computer Intrusion	Part of 8-year sentence
Wire Fraud	Part of 8-year sentence
Aggravated Identity Theft	Mandatory 2-year consecutive
Restitution	$1.39 million ordered
Supervised Release	3 years post-incarceration

Maximum penalties exceeded.

Law Enforcement Actions

Multi-agency effort succeeded:

• FBI investigated technical aspects.
• IRS-Criminal Investigation tracked refunds.
• UK authorities executed Heathrow arrest.
• U.S. Marshals handled extradition.

International cooperation key.

Prevention Lessons

Tax firms strengthen defenses:

• Train staff on CEO fraud phishing.
• Verify unexpected document requests.
• Block Dropbox downloads from clients.
• Deploy EDR for RAT detection.
• Encrypt client PII databases.

Related Warzone RAT Takedown

FBI disrupted infrastructure:

• Seized C2 servers February 2024.
• Arrested malware vendor.
• Sanktum crypter also neutralized.

Akande used early versions.

FAQ