CEDAR FALLS — A Georgia resident linked to the University of Northern Iowa data breach has been charged as part of a tax refund scheme in Iowa.
More than 100 UNI employees reported receiving rejection letters from the IRS when they filed their taxes in 2014. That was because someone had already filed taxes on their behalf and collected their refunds.
On Friday, officials with the U.S. Attorney’s Office for the Northern District of Iowa filed an information charging 45-year-old Bernard Ogie Oretekor with theft of government property and aggravated identity theft.
Details about the charges weren’t immediately available, but court records allege he used the identity of a victim identified by the initials “R.A.” to steal R.A.’s 2013 tax refund of $9,850. He allegedly filed the tax return in January 2014 and received the money in February 2014.
The Iowa charges don’t mention UNI, but court records obtained by The Courier show personal information from multiple UNI employees was discovered on a computer linked to Oretekor during a wire fraud and money laundering investigation in California. In March 2015, UNI police pursued a forensic examination of Oretekor’s computers in connection with the university’s data breach investigation.
Oretekor is in custody in Santa Clara County, Calif., awaiting the outcome of charges there.
Oretekor, also known as Emmanuel Libs and William Demorris, is a Nigerian citizen who applied for United States citizenship. He had been living in Ellenwood, Ga., and operated a company called Shekinah Global Automotive when he came to the attention of authorities investigating the theft of $312,115 from a Redwood City, Calif., couple’s brokerage account through an email takeover scheme.
The couple, identified by the pseudonym “the Smiths” in court records, apparently clicked on an email purporting to be from Yahoo to revalidate their account and reenter their password. The message was apparently part of the scam.
Investigators believe a suspect obtained their password and used their email account to access financial information and ask their investment adviser to move the money to another company’s bank account. The adviser emailed authorization forms, received them back signed and then transferred the funds.
Then in 2013, agents investigated a similar crime where someone accessed the Yahoo email account of another victim, identified in court records as “Mr. Jones,” and requested a $89,234 transfer from his Bank of Hawaii account. The crime was stopped when a bank worker telephoned Jones to confirm the request. The suspect had set up a filter in Jones’s email to cover his tracks by routing correspondence from the bank into the trash folder.
Investigators determined both schemes started with a message from the same email account, court records state.
The email in the Hawaii bank case requested the funds be sent to a Bank of America account belonging to a rental business in Hobbs, N.M. The rental account also received a fraudulent transfer for $98,231 from a Lexington, Ky., business after its owner had his Yahoo account breached.
The New Mexico rental account that was supposed to receive the money belonged to a man and his father who told investigators they had been dealing with a South African diplomat named Emmanuel Libs. Investigators believe the men were the victims of an advance-fee fraud scheme in which they paid Libs about $200,000 to settle alleged taxes and expenses in connection with “consignment box” containing $19 million tied up in customs.
Libs told the New Mexico men they would get a cut of the $19 million once all costs were taken care of. After three years without results they ran out of money, and Libs came up with another offer, again using the consignment box promise as bait. He told them he would take out a loan to pay the fees, but the loan would have to be routed through the men’s bank accounts. The two received wire transfers set up by Libs, who instructed them to funnel the funds to overseas banks, Western Union transfers and MoneyPak debit cards. The $98,231 their account received from the Lexington phishing scam in 2013 went to a bank in Singapore and into the cards, court records state.
During the investigation, an undercover agent posed as a cousin of the New Mexico men who was seeking to become involved in the $19 million consignment box deal. The agent proposed meeting Libs in person in San Jose, Calif., to hand over $30,000 for fees on the box. Instead, Oretekor’s girlfriend, Chantale Petit-Frere, was sent to the meeting place claiming to be an employee of the South African embassy. The agent didn’t show up for the meeting, and other investigators followed Petit-Frere when she left and went to a homeless shelter in Redwood City.
Secret Service agents tracked the phone associated with Libs to Oretekor’s home in Ellenwood.
In October 2014, agents with the IRS and Secret Service searched his home, his business in McDonough, Ga., and a storage locker and found three computers and 180 prepaid debit cards. A study of the computers found names, Social Security numbers and birthdays of a number of UNI employees, court records state.