US arrests Lagos real estate guru, Abidemi Rufai ‘Ruffy’ over $350,000 fraud

A Lagos-based real estate merchant and former House of Representatives aspirant on the platform of the All Progressives Congress (APC), Mr Abidemi Rufai, popularly known as ‘Ruffy’ has been arrested in the United State for his scheme to steal over $350,000 in unemployment benefits from the Washington State Employment Security Department.

Rufai was arrested Friday at New York’s John F. Kennedy International Airport by federal agents as he allegedly attempted to leave the country.

According to the United States Department of Justice, Rufai, appeared in federal court Saturday on charges that he used the identities of more than 100 Washington residents to steal more than $350,000 in unemployment benefits from the Washington State Employment Security Department (ESD) during the COVID-19 pandemic last year.

“This is the first, but will not be the last, significant arrest in our ongoing investigation of ESD fraud,” said Tessa Gorman, acting U.S. Attorney for the Western District of Washington, in a statement Monday.

The federal complaint also provides a detailed glimpse into the scale of the pandemic-related fraud as well as the methods — some of them surprisingly unsophisticated — fraudsters used to pilfer unemployment systems in Washington and other states.

Rufai, 42, was arrested by FBI agents Friday evening and is scheduled for a detention hearing Wednesday. The case will be prosecuted in federal court in Tacoma.

“I want to thank our partners in law enforcement for their continued efforts to hold criminals accountable for their attacks on our unemployment insurance system,” said ESD Acting Commissioner Cami Feek in a statement.

A report by Seattle Times says Rufai was represented by an assistant federal public defender at Saturday’s hearing.

Rufai’s arrest comes almost a year to the day after ESD officials announced they were temporarily suspending unemployment benefits payments after discovering that criminals had used stolen Social Security numbers and other personal information to file bogus claims for federal and state unemployment benefits.

Within days, ESD officials disclosed that “hundreds of millions of dollars” had likely been stolen in a fraud scheme that law enforcement officials and cybercrime experts said was partly based in Nigeria, involving a criminal ring nicknamed “Scattered Canary.”

Washington was among the first states to be hit by a wave of fraud that would eventually strike dozens of states and siphon off billions of dollars in federal aid meant for pandemic victims.

Rufai, who used the alias Sandy Tang, is also suspected of defrauding unemployment programs in Hawaii, Maine, Michigan, Missouri, Montana, New York, Ohio, Pennsylvania, Wisconsin, and Wyoming. Investigators also found a massive cache of tax returns and other personal data and evidence that Rufai was allegedly involved in numerous other fraud schemes.

Federal officials acknowledged that Rufai’s presence in the United States probably was unusual in the unemployment fraud scheme. Many of the fraudulent claims that hit the ESD were likely filed from outside the United States, according to the complaint.

The federal complaint also offers a detailed explanation of how Rufai — and presumably others — allegedly bypassed security systems at ESD using a simple feature of Google’s free Gmail service.

Federal investigators initially identified Rufai through a single Gmail account he used to file 102 claims for pandemic-related unemployment benefits from ESD, as well as claims at programs in other states, according to the complaint.

Thanks to a feature of Gmail, account holders can create dozens of additional email addresses simply by adding one or more periods to the original address.

Because the Gmail system doesn’t recognize periods, any emails sent to those so-called dot variant addresses are delivered to the inbox of the original Gmail address.

In Rufai’s case, his original email address — Sandytangy58@gmail.com — was expanded to include dot variants such as san.dyta.ngy58@gmail.com and sa.ndyt.a.ngy58@gmail.com, according to the federal complaint.

Rufai used the dot variant addresses to create multiple accounts in the Washington state system that authenticates users of government services, the complaint alleges. Rufai then filed for unemployment benefits with ESD, the complaint said, using stolen personal identities of real Washington residents.

Because emails sent by the agency to the dot variants all went to Rufai’s Gmail account, Rufai could easily monitor all ESD correspondence regarding each claim, according to the complaint.

In January, a federal judge issued a warrant to Google, which operates Gmail, allowing investigators to search Rufai’s Gmail account, according to the complaint. Investigators found more than 1,000 emails from ESD, including emails the agency sends to new claimants allowing them to activate their accounts with the state authentication system.

Investigators also found around 100 emails from unemployment systems in other states, according to the complaint. The account also contained emails from Green Dot, an online payment system that fraud experts and ESD officials have said was widely used for stolen unemployment benefits.

Rufai’s alleged schemes extended well beyond unemployment fraud, according to the complaint. Investigators found “substantial evidence” in Rufai’s Gmail account “that the user was actively engaged in stealing and retaining the personal identifying information of American citizens,” the complaint alleges.

Investigators found numerous emails with file attachments containing thousands of bank and credit card numbers, birth dates and other personal identifying information, images of driver licenses, and “a very large volume” of tax returns of U.S. taxpayers, the complaint alleges.

But Rufai appears to have let his own security lapse.

Google allows users to add a “recovery” cellphone number to their accounts in case they forget their password or have other issues. Although Rufai’s Gmail account used his alias name, Rufai’s recovery number was a Nigerian-based cellphone number that was also listed on Rufai’s 2019 U.S. visa application, according to the complaint.

A Google Drive account associated with the Gmail account included images of “an individual who matches the physical appearance of Rufai in his 2019 visa application photo” and other government documents, the complaint said.

It also contained purchase confirmation emails for products that listed Rufai’s brother’s address in Jamaica, New York, as the billing address, the complaint alleges.

Investigators determined that Rufai arrived in the United States on Feb. 19, 2020, and left on Aug. 9, 2020, “and was therefore apparently present in the United States during the period of the fraud,” according to the complaint.

Bank records show that between March 3, 2020, and August 2, 2020, $288,825 was deposited into a Citibank checking account in Rufai’s name, according to the complaint. The funds were deposited from multiple sources, including Green Dot, an online payment service that federal officials said.

Additional funds were transferred by the ESD to the account of a second individual, identified in the complaint as C.S., who reportedly filed unemployment claims using Rufai’s Gmail account. That individual also filed claims for unemployment benefits in other states.

According to federal officials, Rufai had reportedly returned to the United States at some point after his August departure. Federal officials became aware that Rufai intended to leave the United States via JFK Airport in New York on Friday evening and were able to get a warrant for his arrest.

According to the U.S. Attorney in Seattle, the case involves wire fraud, which is punishable by up to 30 years in prison in crimes involving benefits “paid in connection to a presidentially declared disaster or emergency, such as the COVID-19 pandemic.”

Credit: Seattle Times/Justice.Gov