Abidemi Rufai, suspended Senior Special Assistant on Housing to Ogun State Governor, Dapo Abiodun, who is accused participating in U.S. Washington State’s $560 million unemployment fraud last year is appearing in court Wednesday morning for a detention hearing.
The case will be prosecuted in Federal court in Tacoma.
Rufai was arrested Friday evening by federal agents at New York’s John F. Kennedy airport as he allegedly attempted to leave the U.S.
Already, Rufai, 42, has been suspended from his government position in Ogun State.
Rufai,had appeared in Federal court Saturday on charges that he used the identities of more than 100 Washington residents to steal more than $350,000 in unemployment benefits from the Washington State Employment Security Department (ESD) during the COVID-19 pandemic last year.
“This is the first, but will not be the last, significant arrest in our ongoing investigation of ESD fraud,” said Tessa Gorman, acting U.S. Attorney for the Western District of Washington, in a statement Monday.
The Federal complaint also provides a detailed glimpse into the scale of the pandemic-related fraud as well as the methods — some of them surprisingly unsophisticated — fraudsters used to pilfer from unemployment systems in Washington and other states.
“I want to thank our partners in law enforcement for their continued efforts to hold criminals accountable for their attacks on our unemployment-insurance system,” said ESD Acting Commissioner Cami Feek in a statement Monday.
Rufai was represented by an Assistant Federal Public Defender at Saturday’s hearing.
Rufai’s arrest comes almost a year to the day after ESD officials announced they were temporarily suspending unemployment benefit payments after discovering that criminals had used stolen Social Security numbers and other personal information to file bogus claims for federal and state unemployment benefits.
Within days, ESD officials disclosed that “hundreds of millions of dollars” had likely been stolen in a fraud scheme that law enforcement officials and cybercrime experts said was partly based in Nigeria, involving a criminal ring nicknamed “Scattered Canary.”
Washington was among the first states to be hit by a wave of fraud that would eventually strike dozens of states and siphon off billions of dollars in federal aid meant for pandemic victims.
Rufai, who used the alias Sandy Tang, is also suspected of defrauding unemployment programs in Hawaii, Maine, Michigan, Missouri, Montana, New York, Ohio, Pennsylvania, Wisconsin and Wyoming.
Federal officials acknowledged that Rufai’s presence in the United States probably was unusual in the unemployment fraud scheme. Many of the fraudulent claims that hit the ESD were likely filed from outside the United States, according to the complaint.
The Federal complaint also offers a detailed explanation of how Rufai — and presumably others — allegedly bypassed security systems at the ESD using a simple feature of Google’s free Gmail service.
Federal investigators initially identified Rufai through a single Gmail account he used to file 102 claims for pandemic-related unemployment benefits from the ESD, as well as claims at programs in other states, according to the complaint.
Thanks to a feature of Gmail, account holders can create dozens of additional email addresses simply adding one or more periods to the original address. Because the Gmail system doesn’t recognize periods, any emails sent to those so-called dot variant addresses are all routed to the inbox of the original Gmail address.
In Rufai’s case, his original email address — Sandytangy58@gmail.com — was expanded to include dot variants such as san.dyta.ngy58@gmail.com and sa.ndyt.a.ngy58@gmail.com, according to the federal complaint.
Rufai used the dot variant addresses to create multiple accounts in the Washington state system that authenticates online users of government services, the complaint alleges. Rufai was then able to file for unemployment benefits with the ESD using stolen personal identities of real Washington residents, the complaint said.
Because emails sent by the agency to the dot variants all went to Rufai’s Gmail account, Rufai could easily monitor all ESD correspondence regarding each claim, according to the complaint.
In January, a federal judge issued a warrant to Google, which operates Gmail, allowing investigators to search Rufai’s Gmail account, according to the complaint. Investigators found more than 1,000 emails from the ESD, including emails the agency sent allowing new claimants to activate their accounts.
Investigators also found around 100 emails from other States’ unemployment systems and from Green Dot, an online payment system reportedly used for stolen unemployment benefits, the complaint said.
The email and banking tactics allegedly used by Rufai appear to link him with the Nigerian crime organization known as Scattered Canary, according to an expert who has studied the group.
“The details are a dead ringer to the early Scattered Canary activity we saw in the early part of the unemployment fraud epidemic,” said Crane Hassold, senior director of threat research for Agari, a cybersecurity firm.
Federal investigators analyzed ESD’s claims database to identify Gmail accounts that used dot variant addresses to file multiple claims, among them the Sandytangy58@gmail.com account, according to the complaint.
It’s unclear whether the ESD or other State unemployment agencies were aware that Gmail addresses were being used to file multiple claims or had security systems in place to flag claims filed using a single Gmail account.