‘Hacker’ Indicted In Massive Tax, Mail and Wire Fraud Scheme – US Attorney

PHOENIX – Federal law enforcement officials led by the Internal Revenue Service – Criminal Investigation (IRS-CI), unveiled a 74-count superseding indictment today alleging a self-described
California-based “Hacker” named Daniel David Rigmaiden led a complex tax fraud conspiracy that employed sophisticated computer intrusion techniques, identify theft, and wire and mail fraud, among
other techniques, to attempt to bilk the government out of millions of dollars.

Senior law enforcement officials of the IRS-CI, FBI, and the U.S. Postal Inspection Service joined U.S. Attorney Dennis Burke at a press conference in Phoenix to announce the recently unsealed
indictment – the result of a multi-year cat and mouse hunt by the agencies’ investigators across multiple

“While schemes become more sophisticated over time, fortunately so do our investigative techniques,” said Dawn Mertz, Special Agent in Charge of IRS-Criminal Investigation. “This investigation serves to remind us there is no such thing as free money and there are no awards or incentives for creativity when it comes to crime.”

The superseding indictment details a conspiracy charge, plus 35 counts of wire fraud, 35 counts of identify theft, one count of unauthorized access of a computer with the intent to defraud and two
counts of mail fraud. (See the attached Chart for a detailed summary of the charges and penalties.) The indictment alleges that as early as 2005, Rigmaiden (a.k.a. Steven Travis Brawner), 29, of Santa Clara,
CA, conspired with others, including Ransom Marion Carter, III, 43, of Phoenix, to obtain the names and social security numbers of living and deceased persons, and to use their identifies to electronically file
fraudulent tax returns in order to obtain refunds.

“Daniel Rigmaiden led agents through a virtual labyrinth of twists and turns, but they never gave up,” said Dennis K. Burke, U.S. Attorney for the District of Arizona. “This investigation demonstrates
how the United States is aggressively investigating persons who file fraudulent tax returns. We will seek to identify and vigorously prosecute those who participate in these schemes, no matter how sophisticated they are.”

“The nature of the crimes allegedly committed by Mr. Rigmaiden is particularly troubling,” said Pete Zegarac, Inspector in Charge of the U.S. Postal Inspection Service’s Phoenix Division. “Taking
the identities of numerous deceased individuals to obtain financial gain is something not often seen to this magnitude.”

Court documents, including the superseding indictment, and search and seizure warrant affidavits and returns, contain the following additional allegations and evidence. In May 2007, IRS-CI identified
a Compass Bank account in Phoenix, Arizona that was receiving fraudulently obtained tax refunds.

From May 2007 through January 2008, the investigation was focused on Carter, who had opened the Compass
Bank account under the name Carter Tax & Accounting, LLC. In January 2008, the investigation started
to focus on an individual operating above Carter known only as the “Hacker” and another co-conspirator
above Carter in the scheme. From January through April 15, 2008, an undercover operation was initiated
which sought to identify and locate the Hacker and second co-conspirator. In the course of the operation,
the investigators opened an undercover bank account in Arizona into which the Hacker unknowingly
caused the deposit of numerous fraudulently obtained tax refunds. The fraudulent returns were filed via
computers and IP addresses not directly traceable to the Hacker. During this period, three $9,000
shipments of the tax refunds were made to the second co-conspirator in Utah. On April 15, 2008, the
second co-conspirator was arrested. The co-conspirator’s case is under seal.
From April through August 2008, investigators worked to identify and locate the Hacker. In May
2008, $68,000 in fraudulently obtained refunds were shipped to the Hacker, in the name of Patrick Stout,
to Palo Alto, CA. The person who picked up the package was not apprehended. In July 2008, agents
located the apartment in Santa Clara rented by the Hacker in the name of Steven Brawner. On July 23,
2008, a 50-count indictment was returned under seal against the Hacker (a.k.a Brawner and Stout). On
August 3, 2008, the Hacker was arrested in Santa Clara after a foot and car chase. A key to the Hacker’s
apartment was found in his pocket during his arrest. On August 3 and 4, 2008, search warrants were
executed in the Hacker’s Santa Clara apartment and a storage unit in San Jose; investigators seized a
laptop and multiple hard drives, $116,340 in cash, over $208,000 in gold coins, approximately $10,000
in silver coins, false identification documents, false identification manufacturing equipment, and
surveillance equipment.

The case remained sealed pending the Hacker’s consideration of an offer to cooperate with the government. On August 6, 2008, the Hacker was identified via fingerprint analysis as Daniel David Rigmaiden. From late August 2008 through January 2009, seizure warrants were served upon eight financial institutions and $158,167 of fraudulently obtained tax refunds were seized.

The superseding indictment in Arizona alleges approximately 570 fraudulent tax returns were filed in the course of the conspiracy seeking the deposit of approximately $1,008,174 in refunds into
Arizona bank accounts. Search and seizure warrant affidavits allege the filing of approximately 1,336
additional fraudulent tax returns seeking the deposit of approximately $3,117,193 of refunds into over
170 additional accounts.

On January 7, 2010, the Court granted Rigmaiden’s request to represent himself. On January 12, Rigmaiden advised the court he was not interested in the government’s cooperation offer and moved to
unseal the case. On January 25, the government advised the court it had no objection to Rigmaiden’s motion to unseal the case.

On January 27, a 74-count superseding indictment was returned against
Rigmaiden and Carter. On March 26, the court unsealed the case. Rigmaiden has remained in federal
custody since his arrest. Carter is a fugitive. (See attached wanted poster.) An indictment is simply the method by which a person is charged with criminal activity and search and seizure warrants are simply methods by which property and funds are searched for and seized,
none of the pleadings raise inferences of guilt. An individual is presumed innocent until competent
evidence is presented to a jury that establishes guilt beyond a reasonable doubt.

“The indictment of Daniel Rigmaiden is an excellent example of law enforcement cooperation
between the IRS – Criminal Investigations, the U.S. Postal Inspection Service, and the FBI,” said Nathan
Gray, Special Agent in Charge of the FBI-Phoenix Division. “The FBI is committed to working with
our law enforcement partners and the U.S. Attorney’s Office to investigate and prosecute those
individuals who choose to use computer technology in furtherance of their fraudulent schemes.”
The investigation preceding the indictment was conducted by the Internal Revenue Service –
Criminal Investigation, Federal Bureau of Investigation, and U.S. Postal Inspection Service with
assistance from the Santa Clara Police Department, U.S. Secret Service and U.S. Bureau of Alcohol,
Tobacco, Firearms and Explosives. The prosecution is being handled by Frederick A. Battista and Peter
Sexton, Assistant U.S. Attorneys, District of Arizona, Phoenix.
RELEASE NUMBER: 2010-060(Rigmaiden, et al.)
# # #
For more information on the U.S. Attorney’s Office, District of Arizona, visit http://www.usdoj.gov/usao/az/

Scroll to Top