The Internal Revenue Service's Processing Center routinely searched filed tax returns for fraud using various detection methods. The IRS processors had seen countless variations of tax scams, but they knew that fraudsters constantly thought up new schemes to try to cheat Uncle Sam. It became apparent through daily scans conducted by the Electronic Fraud Detection System that in one particular case, a vast number of tax returns were linked together by similar names, addresses, wages, withholding, refund amounts, IP addresses and bank routing numbers. Through the initial investigative inquiries, the processors determined that most of the tax returns had the commonality of claiming only Schedule C income with no expenses, dead dependents and the Earned Income Tax Credit (EITC). Schedule Cs are filed by small-business owners or self-employed individuals. Some of the other reviewed tax returns were filed with false W-2s that reflected inflated wages and withholdings. Many of the filers in the scheme turned out to be deceased with similar last names to the dependents listed on the returns; however, the Social Security Administration showed that none of them were related by blood or marriage.

The case was forwarded to the IRS's Criminal Investigation Division, and I was assigned as the lead investigator. After putting together an investigation team, including a computer forensics specialist, I went to the immediate task of identifying the perpetrator. I followed the money trail to find the bank accounts where the tax refunds were directly deposited. There were hundreds of them at financial institutions across the United States and they were in the names of many different people. But one name seemed to come up more frequently than any other — James Snyder.

The most significant connections that my investigation team discovered were the IP addresses from which the majority of the falsified income tax returns were filed. A summons was issued to the Internet service providers (ISP) that maintained the IP addresses. We learned that many of the returns were filed at a computer lab at the Charlotte employment services agency. I called them for more information and was sent a copy of a sign-in sheet they kept for people using the computer lab. The log showed the date and time that each individual used the computer. James's name was on the list for the dates and times the questionable returns were electronically filed.

Under Internal Revenue Code Section 32(a), the Earned Income Tax Credit is determined as an amount equal to the credit percentage of the taxpayer's earned income for the taxable year. The code further defines earned income as wages, salaries, tips and other employee compensation, plus the taxpayer's net earnings from self-employment for the taxable year. Snyder used false W-2s when he first started the scheme, but stopped quickly because he realized they could be verified. Instead, Snyder began claiming self-employment income, which he figured could not be confirmed by the IRS. By reporting only self-employment income on a Schedule C form with no expenses, Snyder was able to raise his claimed income to the limit that allowed him the maximum Earned Income Tax Credit, approximately $4,500 per tax return. We had yet to determine how many returns he filed, so we didn't know how much he netted.

Before filing the returns, James needed to open bank accounts into which the money would be directly deposited. Oddly, though, we discovered many returns that were deposited to accounts in other people's names. My team filed a summons for bank records and, after further investigation, I determined that most of the account holders were his family members. Many of them were located in Chicago, where James grew up and where his children from his previous marriage still lived.

It became apparent that James was filing fraudulent returns even after we started the investigation, so I began conducting weekly "trash runs" to look for active evidence. Trash runs involved going to James's house and discreetly picking up the garbage left on the curb. I would then take it to a facility where I could carefully search it for evidence. After a few weeks, my dirty work paid off. I discovered lists of names, Social Security numbers and bank account numbers that he used on the tax returns. These lists, combined with the other evidence my team had already obtained, was enough probable cause to get a search warrant on James's house signed by a judge.

When we executed the search warrant at James Snyder's home, he voluntarily opened the door and invited us in when we arrived — search warrant in hand — at 7:00 in the morning. After I identified myself as a special agent with the IRS, his response was, "I was waiting for you to come."

While the other special agents did a thorough search of the residence, I interviewed James. I informed him of his right to remain silent and said that he could choose to not answer questions until he had consulted an attorney. But James insisted he was ready to talk and confessed to filing the falsified tax returns. He did not try to cover up or make excuses for his behavior. Instead, he said he knew he was playing a game with the IRS and it was just a matter of time until we caught him.

When I asked James why he filed the fraudulent tax returns, he said he did it because it was easy. He started the scam by filing false returns for himself and his children by using fake W-2s. He picked up blank W-2 forms at the employment agency he worked with and filled them in himself. He obtained valid Employer Identification Numbers (EINs) from the W-2s of friends and relatives who had legitimate employment.

James then learned that if he added dependents to his fake returns, he could qualify for a bigger refund with the EITC. He told me that after a few failed brainstorming attempts, he hit on a way to find dependent information — searching the Internet for Social Security numbers of deceased individuals. He would look for deceased people with his last name, for example Patty Snyder, in hopes that the IRS processor would not question the legitimacy of dependents if they shared his surname. He assumed the fact that they were dead would slip by unnoticed. Nonetheless, he told me he was pleasantly surprised when the first returns with dependents were processed without a hitch and he received the tax refunds. I could not believe how easy it was for James to find Social Security numbers online, but he showed me that the information was readily available on Web sites that helped people who were looking for their ancestors.

Because he had no trouble obtaining refunds using Social Security numbers of deceased "dependents," James started using their identities as the primary and secondary taxpayers on returns as well.

James only used names that were similar to his or his friends and relatives so he could set up bank accounts in their names. He used many relatives, including his own children, parents, mother-in-law, cousins and ex-wife. He would have his fraudulent refunds deposited into the accounts, and then he could withdraw the money at his leisure. For example, James had a cousin named Jean Dudley. He asked her if he could help her open a bank account, and in return she provided him with the account information. Then he went to www.roots.com or www.ancestry.com and found the Social Security number of a deceased woman by the name of Jeanetta Dudley. Snyder used this information to file a fraudulent W-2 and claimed two dependency exemptions using other deceased Dudleys he found online. It did not matter that none of these individuals were related or alive. The refund for Jeanetta Dudley was electronically deposited into the bank account of Jean Dudley, and because of the similarities between the names, the bank was not suspicious.

James explained to me that his scheme primarily involved the use of the Internet. Almost everything he needed to perform his crime was at his disposal while sitting in front of a computer. He prepared the false tax returns online and filed them electronically. His final step was to enter the bank account information at the bottom of the tax return, because James used the direct-deposit option on each of his false tax returns. The IRS only allowed five tax refunds into one bank account; that was why he set up multiple bank accounts using relatives and friends.

James stated in the interview that the relatives and friends who held the bank accounts had no knowledge of the Internet scheme, and he primarily used relatives under the age of 18. He told them that he wanted to help them build credit and would drive them to the bank and guide them through the process of setting up a checking account. Once he had the account information, he took over from there.

Snyder's relatives in Chicago were interviewed, including his children, who said they rarely saw their father but that he came to Chicago several times to help them set up bank accounts. We showed the children copies of tax returns filed in their names and they said they had no knowledge of them. This was in line with what James had told me in his interview. His only contact with his relatives was helping set up their bank accounts.

Once James had his family's bank account information, he was able to control the money flow. He used ATMs and debit cards to spend the money. It was not readily apparent how he squandered his ill-gotten gain, but through our search of his home and interviews of friends and family, we ascertained that James spent a considerable amount of time at local casinos.

James also set up accounts in his mother's name; numerous refunds were deposited into them. When I visited her house in Chicago to conduct an interview, she refused to answer my questions. We were not able to gather enough evidence to prove her culpability.

Another bank account holder was a mentally disabled woman who lived on the same street in Charlotte as Snyder. He set up several accounts in her name by driving her to various local banks and showing her how to fill out the necessary paperwork, which clearly demonstrated a lack of due diligence on the banks' part. We identified another account holder in Seattle, Washington, so I made the trip out to meet her; she readily gave me information in the interview. She had been his girlfriend years ago and told me James had asked her for her bank account information so he could deposit money into it. When I asked her why he wanted to give her money, she said she "met his needs." I asked if she knew the source of the funds James deposited into her bank account, and she said she did not, so I showed her copies of the tax returns. They had the names of deceased individuals, but the account number used for the direct deposit was hers. I also showed her corresponding bank statements that listed a number of tax refunds directly deposited into her account by the IRS. I asked her why she didn't notice that the deposits were from the IRS and not James. Her answer was that she stopped looking at her bank statements years ago. She also told me that she only received part of the money, because James had access to her account and took out some. She did not know what he did with his portion.

The more relevant evidence obtained with the search warrant included personal computers, to which James had saved the results of his searches for deceased individuals' names, Social Security numbers and dates of birth. Our computer forensic specialist searched the computers and gave us the cookie file list from each. The lists showed Snyder's visits to Web sites such as www.ancestralfindings.com, www.MyTrees.com, www.ancestry.com and www.RootsWeb.com. I conducted a few searches of my own on these Web sites and was astonished at how easy it was to uncover identifying information for real, deceased people.

The computer forensic specialist was also able to show James pulling facts from Web sites and entering the exact same information on fraudulent tax returns. Moreover, evidence was uncovered of bank accounts used in the filing of the false claims, including enrollment for online banking.

We seized various handwritten documents, the most compelling of which was a purple spiral notebook. In it we found lists of the identities used on fraudulent returns, their dependency exemptions, birth dates, routing transit number (RTN) and bank account number where the refund was to be deposited — written in James's handwriting. A handwriting exemplar showed the handwriting in the seized notebook had "excellent similarities" to the handwriting taken in a sample James provided.

James filed the fraudulent tax returns electronically, and many were traced to the IP addresses of his two home computers. Most of the other fraudulent tax returns were linked to IP addresses owned by local public libraries. Evidence of Internet use sign-in sheets tied James to the libraries' computers at the time the false claims were electronically filed.

Because James had a fairly common name, it was not difficult to find matches of deceased individuals with his name. He filed many tax returns using the name of "James Snyder" or "Jim Snyder." He used the matching Social Security number and date of birth for the name, both of which he obtained on public Web sites. The returns quickly went through, and he was pleased to have found another easy way to get fast cash.

We could not determine the exact number of returns prepared by James because we estimated that the IRS only intercepted a small percentage of his false claims and we probably did not locate each bank account he used. However, we did discover hundreds of false returns totaling more than $500,000. James also filed fraudulent state tax returns.

Although most of the victims of his fraud were dead, his crimes did have an effect on living victims. I met one woman who went through emotional turmoil after receiving a letter from the IRS regarding the tax return her deceased husband supposedly filed. The letter requested that her husband submit an amended return because there was an error on his. The woman's husband had passed away years ago, and she was understandably disturbed by the letter. I reviewed the return and saw that James had used the woman's husband as the primary taxpayer on a falsified return. He also added other deceased identities as a secondary taxpayer and dependency exemptions.

During my investigation I also met Lana Smith, a taxpayer in Oregon who went into the local Taxpayer Service Help Desk to find out why her daughter — who had died five months earlier — was being claimed as a dependent on a stranger's return. Ms. Smith was entitled to claim her daughter as a dependent for the prior year, but the IRS denied it because another person had already claimed her. The return was referred to the IRS's Fraud Detection Center, where it was linked to the Internet refund scheme I had been investigating. We discovered it was filed using the same IP address as many of James's other filings.

Although Snyder was the only person prosecuted in this case, we presumed that many of the adult relatives and other individuals who held bank accounts were aware of the fraud, at least to some degree. In particular, we thought one of his daughters was involved because a large percentage of refunds were deposited into her bank accounts. She had four accounts set up in her name, and each one had multiple refunds electronically deposited into it. She withdrew and spent the money herself. When I interviewed her, she firmly denied knowledge of the false claims. When I asked where she thought the money came from, her response was "My father put the money there for me." Despite our strong suspicions about her, the evidence against James was more convincing and as part of his plea bargain his daughter was not charged.

James was charged with false claims and identity fraud under Title 18, U.S.C., Sections 287 and 1028, respectively. He entered a guilty plea to the charge of false claims and was sentenced to prison for three years. The Assistant U.S. Attorney (AUSA) prosecuting the case told me that he had not seen a more complicated case of tax fraud using the Internet. The AUSA thought someone else must have helped James devise his plan because it was so complex, but I disagreed. Although he lacked education and was a seemingly inexperienced man with few notable skills, I believed he acted on his own and was able to find the resources he needed through the Internet.

Gay Stebbins, CFE, is a retired special agent of the Internal Revenue Service's Criminal Investigation Division.