Another Nigerian, Charles Onus arrested by FBI for nearly $1 million payroll funds theft

The Federal Bureau of Investigation (FBI) and the United States Department of Justice has today announced the arrest of another Nigerian, Charles Onus, over his alleged involvement in the fraudulent diversion of over $800,000 in payroll funds to prepaid debit cards under his control.

This is coming a few weeks after an aide to the Ogun State Governor, Abidemi Rufai, was arrested over fraudulent transactions in the United States.

This disclosure is contained in a statement issued by the United States Department of Justice, which noted that Onus was previously arrested on April 14, 2021, in San Francisco and detained before being presented today, Wednesday, June 3, 2021, in Manhattan federal court before Magistrate Judge Sarah L. Cave. The case is assigned to U.S. District Judge Paul G. Gardephe.

READ: US says social media influencer, Hushpuppi, laundered funds for North Korean hackers

What the New York Attorney is saying

Manhattan U.S. Attorney Audrey Strauss said, “Charles Onus allegedly participated in a scheme that stole nearly $1 million by hacking into a payroll processing company’s system to access user accounts and divert payroll to prepaid debit cards he controlled.  As alleged, Onus did this as effectively as someone who commits bank burglary but with no need for a blowtorch or bolt-cutters.  Thanks to the FBI and IRS-CI, Onus is in custody and facing serious federal charges.”

What the FBI is saying

FBI Assistant Director William F. Sweeney Jr. said, “Cyber intrusions ripple through everything our society relies upon – this one impacted people’s paycheck.  The FBI’s goal is to prevent cybercriminals from causing harm and holding them accountable, but we can’t do it alone.  Companies need to continuously improve their cyber hygiene and awareness.  Taking steps like training the workforce to protect and frequently change passwords, and to use different login credentials across platforms, can have an impact.  Each one of us, from the individual citizen to the biggest corporation, plays a critical role in defending the nation from cyberattacks.”

READ: Co-founder of Floyd Mayweather-backed crypto sentenced to prison for fraud

What the IRS official is saying

IRS-CI Special Agent in Charge Jonathan D. Larsen said, “IRS Criminal Investigation will always work with our law enforcement partners to track down those who try to breach our country’s tax and financial infrastructure.  We will continually endeavour to bring to justice criminals who think they can comfortably steal from victims in America while hiding behind their computer screens.”

Charges against Charles Onus

With these incidents occurring around July 2017 to about 2018, Onus was alleged to have been involved in a scheme to conduct cyber intrusions of multiple user accounts maintained by a company that provides human resources and payroll services to employers across the United States, in order to steal payroll deposits processed by the Company.

He was said to have gained unauthorized access to over 5,500 Company user accounts through a cyber-intrusion technique referred to as “credential stuffing.”

READ: How Sergey Brin and Larry Page raised money for Google

From around July 2017 through at least about 2018, at least approximately 5,500 Company user accounts were compromised and approximately $800,000 in payroll funds were fraudulently diverted to prepaid debit cards, including those under the control of ONUS.  The compromised Company user accounts were associated with employers whose payroll was processed by the Company, including employers located in the Southern District of New York.

Onus, 34, a resident and national of the Federal Republic of Nigeria, was charged with one count of computer fraud for causing damage to a protected computer, which carries a maximum sentence of 10 years in prison, one count of computer fraud for unauthorized access to a protected computer to further intended fraud, and one count of receipt of stolen money, each of which carries a maximum sentence of five years in prison.

Others are one count of wire fraud, which carries a maximum sentence of 20 years in prison; and one count of aggravated identity theft, which carries a mandatory sentence of two years in prison to be served consecutively to any other sentence imposed.

Ms Strauss praised the outstanding investigative work of the FBI and IRS-CI.  Ms Strauss also thanked the New York City Police Department, the FBI New York Cyber Task Force, U.S. Customs and Border Protection, and the FBI Field Office in San Francisco for their assistance in the investigation of this case.

The prosecution of this case is being handled by the Office’s Complex Frauds and Cybercrime Unit.  Assistant United States Attorney Sagar K. Ravi is in charge of the prosecution.