AO 91 (Rev. 11/11) Criminal Complaint AUSA Saurish Appleby-Bhattacharjee (312) 469-6045

AUSA Paige Nutini (312) 697-4071

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

UNITED STATES OF AMERICA

v.

SAMUEL UCHENNA ANIUKWU, 

also known as “Uchenna Samuel 

Aniukwu” and “Sammy Maxwell”; 

ANTHONY EMEKA IBEKIE, 

also known as “Emeka Toni Ibe”; and 

JENNIFER GOSHA

CASE NUMBER: 

UNDER SEAL

CRIMINAL COMPLAINT 

I, the complainant in this case, state that the following is true to the best of my knowledge and belief. 

From in or around 2016 to on or about June 18, 2020, at Oak Park, Illinois, in the Northern District of 

Illinois, Eastern Division, and elsewhere, the defendant(s) violated:

Code Section Offense Description

Title 18, United States Code, Sections 

1343 and 1349

conspired with each other, and others known and 

unknown, to commit a wire-fraud scheme

This criminal complaint is based upon these facts:

 X Continued on the attached sheet.

SIXTO J. LUCIANO

Special Agent, Homeland Security Investigations

Pursuant to Fed. R. Crim. P. 4.1, this complaint is presented by reliable electronic means. The above-named 

agent provided a sworn statement attesting to the truth of the foregoing affidavit by telephone.

Date: July 10, 2020

Judge’s signature

City and state: Chicago, Illinois SHEILA M. FINNEGAN, U.S. Magistrate Judge

Printed name and title

20CR352

FILED 7/10/2020

THOMAS G. BRUTON CLERK, U.S. DISTRICT COURT

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 1 of 231 PageID #:9
UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF ILLINOIS

AFFIDAVIT

I, SIXTO J. LUCIANO, being duly sworn, state as follows:

I. INTRODUCTION AND AFFIANT BACKGROUND

1. I am a Special Agent with the U.S. Department of Homeland Security, 

Immigration and Customs Enforcement, Homeland Security Investigations (“HSI”) 

and have been so employed since 2008. As part of my duties as a Special Agent, I 

investigate criminal violations relating to white-collar crime, including mail, wire, 

and bank fraud, as well as other financial and cyber-crimes. Before my employment 

with HSI, I worked as a Postal Inspector with the U.S. Postal Inspection Service from 

about April 2008 through August 2008, and as a Special Agent with the Internal 

Revenue Service, Criminal Investigation from about January 2001 through April 

2008. In my capacity as an investigator with these agencies, I have participated in 

the execution of multiple federal search warrants and arrest warrants.

2. This affidavit is submitted in support of a criminal complaint alleging 

that Samuel Uchenna Aniukwu, also known as “Uchenna Samuel Aniukwu” and 

“Sammy Maxwell” (“ANIUKWU”), Anthony Emeka Ibekie, also known as “Emeka 

Toni Ibe” (“IBEKIE”), and Jennifer Gosha (“GOSHA”) have violated Title 18, United 

States Code, Sections 1343 and 1349. 

3. The statements in this affidavit are based on my personal knowledge, 

and on information I have received from other law-enforcement personnel and from 

persons with knowledge regarding relevant facts. Because this affidavit is being 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 2 of 231 PageID #:10
2

submitted for the limited purpose of establishing probable cause in support of a 

criminal complaint charging ANIUKWU, IBEKIE, and GOSHA with conspiracy to 

commit wire fraud, I have not included each and every fact known to me concerning 

this investigation. I have set forth only the facts that I believe are necessary to 

establish probable cause to believe that the defendants committed the offense alleged 

in the complaint.

4. This affidavit also describes portions of written and recorded 

conversations, which I have summarized. These summaries do not necessarily refer 

to all of the topics covered during each conversation. In addition, these summaries do 

not include every conversation made by every writer/author or speaker on the topic 

being described. Portions of the conversations that are quoted are preliminary 

transcriptions, which may be subject to modification upon further review. For some 

conversations, I have offered my understandings and/or interpretations of the 

conversation, which are based upon my experience and knowledge of the 

investigation to date, the content and context of the conversations, the experience of 

other investigators with whom I have consulted, as well as my professional training 

and experience as a law-enforcement agent.

II. FACTS SUPPORTING PROBABLE CAUSE THAT ANIUKWU, IBEKIE, 

AND GOSHA HAVE CONSPIRED TO COMMIT WIRE FRAUD

A. INVESTIGATIVE BACKGROUND

5. This complaint application stems from an ongoing investigation into 

individuals in the Northern District of Illinois, and elsewhere, who are suspected of 

facilitating, or laundering the proceeds of, various online fraud schemes. As detailed 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 3 of 231 PageID #:11
3

further below, this investigation has recently involved the use of an undercover agent 

to communicate with suspected co-conspirators, which, when coupled with other 

information obtained over the course of the investigation, has generated probable 

cause to believe that ANIUKWU, IBEKIE, and GOSHA, with others known and 

unknown, have conspired to commit wire fraud.

6. To date, this investigation has identified several individuals who have 

conducted overt and affirmative acts in the Northern District of Illinois in furtherance 

of various online schemes and artifices. Such overt and affirmative acts include the 

incorporation of business entities and the opening of bank accounts at financial 

institutions—including those that are federally insured—to facilitate the receipt of 

funds fraudulently induced from victims through false pretenses, representations, 

promises, and concealment of material facts, and the subsequent transfer of these 

funds to accounts maintained abroad. 

7. The co-conspirators, known and unknown, have used various means—

some of which involve interstate wire communications—to conduct the above overt 

acts, including the use of telephones, computers, vehicles, correspondence, and the 

United States Postal Service.

8. In summary, and as explained in more detail herein, the individuals and 

entities at issue in this investigation were involved in opening accounts at financial 

institutions in the Northern District of Illinois, and elsewhere, to facilitate the receipt 

and subsequent transfer of proceeds fraudulently obtained from victims of the 

following three categories of schemes:

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 4 of 231 PageID #:12
4

a. Business Email Compromise: a scheme targeting businesses that 

perform wire transfers. The scheme is typically carried out by: (1) compromising 

legitimate business e-mail accounts through social engineering or computer-intrusion 

techniques to gain unauthorized access to the business-email account; (2) blocking or 

redirecting communications to or from the email account; and then (3) using the 

compromised email account or a separate fraudulent email account to communicate 

with personnel from a victim company, attempting to induce the victim company into 

making a wire transfer under fraudulent pretenses.

b. Romance Fraud: a scheme to defraud a victim on the Internet, 

whereby a co-conspirator contacts a victim online and builds trust through an online 

romance. At some point, the co-conspirator will convince a victim to send money to a 

predetermined recipient under the false pretense that the victim will either get paid 

back in the future or that the money being sent is part of a business transaction. 

Romance scams typically target persons looking for romantic partners or friendship 

on dating websites and other social-media platforms. The scammers may create 

profiles using fictitious or fake names, locations, images, and personas, allowing the 

scammers to cultivate relationships with prospective romance-scam victims. Victims 

may be convinced to provide money or gifts to the scammers, or may be asked to 

conduct transactions on behalf of the scammers.

c. Inheritance-Fraud Scheme: a variation of an online-investmentfraud scheme, in which a victim is tricked into sending money from his/her bank 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 5 of 231 PageID #:13
5

account under the false pretense that the victim is about to receive a substantial 

inheritance.

B. SUMMARY OF EVIDENCE ESTABLISHING THAT ANIUKWU, IBEKIE,

AND GOSHA ENGAGED IN A CONSPIRACY TO COMMIT WIRE FRAUD

9. Since in or around 2016, Samuel ANIUKWU (a Nigerian citizen or 

national with extensive foreign ties), has incorporated or registered several business 

entities in the Northern District of Illinois with Anthony IBEKIE (also a Nigerian 

citizen or national with extensive foreign ties), and other known and unknown coconspirators. ANIUKWU and IBEKIE have created bank accounts for these entities 

in the Northern District of Illinois together, and with other co-conspirators including

Jennifer GOSHA. 

10. These bank accounts have collectively received hundreds of thousands 

of dollars in funds fraudulently obtained from various victims through the use of 

business-email-compromise, romance-fraud, and inheritance-fraud schemes. Upon 

their receipt, these fraudulently obtained funds have been disposed by ANIUKWU, 

IBEKIE, GOSHA, and others through: (1) cash withdrawals in amounts deliberately 

designed to avoid bank-reporting requirements; (2) interbank transfers used as a 

means of concealing the original source of the funds; and (3) wire transfers to foreign 

bank accounts, including those in IBEKIE’s name.

11. Emails sent or received by ANIUKWU, as well as account-subscriber 

information, implicate him in past and ongoing inheritance-fraud schemes bearing 

characteristics, and involving the use of methods, that are nearly identical to those 

discovered in the course of an undercover operation. Likewise, emails sent or received 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 6 of 231 PageID #:14
6

by IBEKIE, as well as account-subscriber information and the results of a forensic 

fingerprint examination, implicate him in the same inheritance-fraud schemes as 

ANIUKWU, including the one discovered in the course of the undercover operation. 

12. The foregoing undercover operation culminated in a controlled delivery 

of fraudulently obtained funds to GOSHA, at her residence, around June 18, 2020. At 

the direction of co-conspirators, an undercover agent was directed to mail these funds 

to a business entity bearing GOSHA’s residence as its mailing address. (That entity, 

believed to be a fictional business, was registered by a co-conspirator connected to 

IBEKIE and ANIUKWU through email communications, further described herein.) 

During the controlled delivery, GOSHA answered the door at her residence, 

confirmed that the delivery address and recipient were correct, and then attempted 

to justify receiving mail addressed to a business entity by saying that she was 

working from home. (In truth, GOSHA is believed to be an employee of the U.S. Postal 

Service.) GOSHA also indicated that she had been waiting for delivery of the 

fraudulently obtained funds, which she expected to arrive earlier that same day.

13. Like ANIUKWU and IBEKIE, GOSHA is the registered agent of—or 

authorized signer for bank accounts associated with—fictional business entities that 

have received funds fraudulently obtained from various victims. For at least one such 

account, which has itself received tens of thousands of dollars in fraudulent funds, 

GOSHA is an authorized co-signer with IBEKIE.

14. As further detailed herein, ANIUKWU, IBEKIE, and GOSHA, together 

and with others known and unknown, agreed to participate in a scheme to defraud in 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 7 of 231 PageID #:15
7

which it was reasonably foreseeable that an interstate-wire facility would be used in 

furtherance of the scheme. Probable cause therefore exists to charge each of these 

defendants with conspiracy to commit a wire-fraud scheme, in violation of Title 18, 

United States Code, Sections 1343 and 1349.

C. PRIOR WARRANTS

15. On or about April 20, 2020, the Honorable Virginia M. Kendall, United 

States District Judge, issued a warrant in Case No. 20 M 215 (the “Gmail Warrant”), 

authorizing the search of two Gmail accounts associated with ANIUKWU. My 

application and affidavit in support of the Gmail Warrant (the “April 2020 Luciano 

Affidavit”), attached as Exhibit 1 and incorporated by reference, details relevant 

findings of the investigation, including, in pertinent part:

a. Providing background information regarding the co-conspirators 

that law enforcement has identified, to date, as being involved in the fraudulent 

schemes mentioned herein, including ANIUKWU and IBEKIE;

b. Summarizing various business entities suspected of being used to 

facilitate the fraudulent schemes at issue in the investigation, including the corporate 

formation of those entities, as well as each entity’s receipt of fraudulently obtained 

funds from a victim individual or victim business; and

c. Detailing evidence of international outgoing wire transfers of 

funds suspected to have been generated through the fraudulent schemes as well as 

interactions between Customs and Border Protection (“CBP”) officials, IBEKIE, and 

ANIUKWU, including evidence of suspected fraud obtained during a border search of 

digital devices in ANIUKWU’s possession.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 8 of 231 PageID #:16
8

16. On or about July 8, 2020, the Honorable Sheila Finnegan, United States 

Magistrate Judge, issued warrants in Case Nos. 20 M 364, 20 M 365, and 20 M 366

(collectively, the “Premises Warrant”), authorizing the search of three residential 

premises associated with ANIUKWU, IBEKIE, and GOSHA (namely, the “Oxbow 

Premises,” “Weber Premises,” and “Harlem Premises,” as further defined therein). 

The application and affidavit of Internal Revenue Service Criminal Investigation 

(“IRS-CI”) Special Agent Amy C. Mansker in support of the Premises Warrant (the 

“Mansker Affidavit”), attached as Exhibit 2 and incorporated by reference, details 

additional findings of the investigation to date, including, in pertinent part, an 

undercover operation resulting in sufficient probable cause to search the Oxbow, 

Weber, and Harlem Premises for evidence, fruits, and instrumentalities of fraud.

D. BACKGROUND REGARDING INTERSTATE-WIRE COMMUNICATIONS

17. Throughout this affidavit, reference is made to email communications 

exchanged via accounts serviced by AOL, Yahoo, and Google, among others, including 

email communications originating from or received by computers or digital devices in 

Illinois and Michigan. Based on my training and experience, and my conversations 

with agents familiar with investigations involving electronic communications, I know 

the following:

a. Email and other similar electronic-wire communications travel 

through the Internet, a global hierarchical network of computers. The backbone of 

the Internet is made up of physically connected communication cables, switches, and 

routers that are owned and operated by commercial, government, academic, and 

other high-capacity network centers.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 9 of 231 PageID #:17
9

b. Typically, when an individual (in this context, a “client”) attempts 

to access a commercial-email service (e.g., those provided by Google, Yahoo, or AOL) 

to send an email, the client’s computer must first connect to a Domain Name Server 

(“DNS”). The DNS, in turn, acts as a phonebook for the Internet. For example, when 

www.google.com is entered into an Internet browser, the DNS will look up the IP 

address for Google and forward the browser onto the relevant IP address. During a 

typical DNS query, approximately four different servers (DNS Resolver, Root Server, 

Top Level Domain Server, and Authoritative Name Server) are accessed before the 

webpage is finally resolved. The aforementioned DNS servers are located in disparate 

geographic locations, both within and outside of the United States, and virtually 

always cross state lines.

c. Similarly, when the DNS resolves the IP Address of a commercialemail provider, such as Yahoo! Mail, the IP address provided will not be for the email 

service itself, but rather the IP address of a Yahoo.com edge server. In the case of 

Yahoo.com, the edge server—located in New York—is responsible for forwarding the 

client computer to the IP address of one of Yahoo’s multiple mail servers, which are 

located throughout the world. The edge server will connect the client to the closest, 

best-performing mail server accounting for the amount of network activity the email 

provider is experiencing at any given time. This process allows the email provider to 

distribute connection activity evenly across its network and is commonly referred to 

as “load balancing.”

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 10 of 231 PageID #:18
10

d. Thus, any email communications discussed in this affidavit, the 

April 2020 Luciano Affidavit, and the Mansker Affidavit, which were sent or received 

from domains serviced by AOL, Yahoo, and Google, are either: (1) actual interstatewire communications; or (2) communications for which the use of an interstate-wire 

facility is reasonably foreseeable.

18. Additionally, throughout this affidavit, reference is made to domestic 

wire transfers of funds, in addition to international wire transfers. Domestic wire 

transfers conducted within the United States are cleared through the Fedwire fundstransfer system, an electronic interbank system operated by the Federal Reserve. 

Based on my training and experience, and other agents’ interviews of Federal Reserve 

employees in prior investigations, I know that Fedwire does not process wire 

transfers in Illinois but rather in New Jersey and/or Texas. Thus, any Fedwire 

transfers received by financial institutions in Illinois, as discussed throughout this 

affidavit, the April 2020 Luciano Affidavit, and the Mansker Affidavit are interstatewire transactions.

E. HISTORICAL EVIDENCE TYING ANIUKWU, IBEKIE, AND GOSHA TO 

FICTITIOUS BUSINESSES RECEIVING FRAUDULENT PROCEEDS

19. As detailed further in Section III.B of the April 2020 Luciano Affidavit

and Section II.C of the Mansker Affidavit, ANIUKWU, IBEKIE, and GOSHA—

among others—have incorporated or registered several business entities with the 

Illinois Secretary of State (“ILSOS”), and also created individual bank accounts for 

each entity. In the course of this investigation, agents have tied bank accounts for the 

entities to the receipt of fraudulently obtained funds from various victim individuals 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 11 of 231 PageID #:19
11

and victim businesses. These funds were obtained, variously, through the use of 

business-email-compromise, romance-fraud, and inheritance-fraud schemes. These 

include, in pertinent part, the following entities and transactions:

a. As detailed further in Section III.B.2 of the April 2020 Luciano 

Affidavit, EMPERORCHILLS was incorporated with the ILSOS in or around June 

2017, with IBEKIE as its registered agent and ANIUKWU as its director and 

incorporator. In or around June 2017, multiple accounts were opened in 

EMPERORCHILLS’s name at federally-insured banks, with ANIUKWU as the 

authorized signer. In or around September 2017, one of these accounts received 

approximately $119,938 in funds fraudulently obtained through a business-email 

compromise scheme targeting Victim Business B.E.F. The same day as those funds 

were received by EMPERORCHILLS, approximately four checks made payable to 

“Aniukwu Samuel” were drawn from the account, each in the amount of between 

$9,300 and $9,600. Photos obtained from bank-security cameras appear to show 

ANIUKWU and IBEKIE at a teller counter during the timeframe that two of these 

checks were deposited at a bank in Naperville, Illinois.

i. Based on my training and experience, I know that financial 

institutions are required by law to file a currency transaction report (“CTR”) with the 

Financial Crimes Enforcement Network (“FinCEN”) for a cash deposit, withdrawal, 

or exchange of currency exceeding $10,000. I also know, based on my training and 

experience, that criminal enterprises routinely limit the amount of any individual 

deposit or withdrawal of unlawfully obtained currency, in an effort to prevent the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 12 of 231 PageID #:20
12

filing of a CTR and thereby avoid detection by law enforcement. This practice—known 

as “structuring”—is prohibited under federal law, namely, Title 31, United States 

Code, Section 5324. Here, as noted above, the checks made payable to “Aniukwu 

Samuel” from the EMPERORCHILLS account were between $400 and $700 below 

the CTR threshold for FinCEN.

b. As detailed further in Section III.B.3 of the April 2020 Luciano 

Affidavit, MEKAS Construction Inc. was incorporated with the ILSOS in or around 

July 2017, with IBEKIE as its registered agent and ANIUKWU and IBEKIE as its 

directors. In or around September and October 2017, multiple accounts were opened 

in MEKAS’s name at federally-insured banks, with Co-Conspirator 1, Co-Conspirator 

2, or IBEKIE as the authorized signers. In or around October and November 2017, 

more than one of these accounts collectively received approximately $17,055 in funds 

fraudulently obtained through business-email compromise, inheritance-fraud, and 

romance-fraud schemes targeting Victim Business M.W., Victim Individual J.B., and 

Victim Individual D.J.

i. The inheritance-fraud scheme—in particular—involved a 

payment to MEKAS’s bank account to retain Pierre Delouis (“Delouis”), a putative 

attorney supposedly employed by the law firm Hall and Hall Chamber in Toronto, 

Canada. As noted further in Section II.F.2, below, this is the same putative attorney 

that an undercover agent was directed to retain in connection with a nearly-identical 

inheritance-fraud scheme in which ANIUKWU, IBEKIE, and GOSHA are implicated.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 13 of 231 PageID #:21
13

c. As detailed further in Section III.B.4 of the April 2020 Luciano 

Affidavit, SAMTONI Medical Equipment was incorporated with the ILSOS in or 

around November 2017, with ANIUKWU as its registered agent. In or around 

November 2017, multiple accounts were opened in SAMTONI’s name at federallyinsured banks, with ANIUKWU or IBEKIE (sometimes using variants of their 

names) as the authorized signers. In or around December 2017, one of these accounts 

received approximately $45,000 in funds fraudulently obtained through a romancefraud scheme targeting Victim Individual C.B.

d. As detailed further in Section III.B.5 of the April 2020 Luciano 

Affidavit, INNOCORD Inc. was incorporated with the ILSOS in or around November 

2017, with ANIUKWU as its registered agent and incorporator. Between in or around 

December 2017 and February 2018, multiple accounts were opened in INNOCORD’s 

name at federally-insured banks, with ANIUKWU (using a variant of his name) as 

the authorized signer. In or around March 2018, one of these accounts received 

approximately $36,850 in funds fraudulently obtained through a business-email 

compromise scheme targeting Victim Business F.M. Over an approximately five-day 

period after the fraudulent funds were received, numerous cash withdrawals of 

between $159.99 and $9,700—each falling below FinCEN’s reporting threshold for 

CTRs, but together amounting to approximately $42,609.99 in withdrawals—were 

made from the same account. Withdrawal tickets received to date for these 

transactions all appear, upon lay inspection, to reflect ANIUKWU’s signature as seen 

in bank records and other documents obtained over the course of the investigation.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 14 of 231 PageID #:22
14

e. As detailed further in Section III.B.6 of the April 2020 Luciano 

Affidavit, GREEN HOUSE For Food Industry Inc. was incorporated with the ILSOS 

in or around December 2017, with ANIUKWU (using a variant of his name) as its 

registered agent and incorporator. Within days of its incorporation, multiple accounts 

were opened in GREEN HOUSE’s name at federally-insured banks, with ANIUKWU 

(sometimes using a variant of his name) as the authorized signer. Between in or 

around February 2018 and April 2019, more than one of these accounts collectively 

received approximately $48,980.75 in funds fraudulently obtained through 

inheritance-fraud and business-email compromise schemes targeting Victim 

Individual C.H. and Victim Business F.M.

i. The inheritance-fraud scheme—in particular—involved 

Victim Individual C.H.’s payment to GREEN HOUSE’s bank account of a retainer fee 

for putative attorney Delouis, the same person appearing in several other 

inheritance-fraud schemes discussed herein, including in the undercover operation 

noted in Section II.F.2, below.

f. As detailed further in Section III.B.8 of the April 2020 Luciano 

Affidavit, GODMEKS Inc. was incorporated with the ILSOS in or around April 2018, 

with ANIUKWU (using a variant of his name) as its registered agent and 

incorporator. In or around May 2018, multiple accounts were opened in GODMEKS’s 

name at federally-insured banks, with ANIUKWU (using variants of his name) as the 

authorized signer. In or around August 2019, one of these accounts received 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 15 of 231 PageID #:23
15

approximately $45,925.75 in funds fraudulently obtained through an inheritancefraud scheme targeting Victim Individual D.P.

i. This inheritance-fraud scheme involved Victim Individual 

D.P.’s payment to GODMEKS’s bank account of a retainer fee for putative attorney 

Delouis, the same person appearing in several other inheritance-fraud schemes 

discussed herein, including in the undercover operation noted in Section II.F.2, below.

g. As detailed further in Section III.B.11 of the April 2020 Luciano 

Affidavit, SAMCHINA Trucking Inc. was incorporated with the ILSOS in or around 

July 2018, with ANIUKWU and Co-Conspirator 3 as its incorporators. Between in or 

around August 2018 and July 2019, multiple accounts were opened in SAMCHINA’s 

name at federally-insured banks, with ANIUKWU as the authorized signer. In or 

around June 2019, a cashier’s check for approximately $31,000 was deposited into 

one of these accounts, consisting of funds fraudulently obtained through a romancefraud scheme targeting Victim Individual M.S. After the check was deposited, the 

account made an attempted wire transfer to Nigeria for approximately $23,000, for 

“cleaning containers.” Security photos obtained from bank-security cameras appear 

to show ANIUKWU at a teller counter during the timeframe that these transactions 

occurred at the subject bank.

h. As detailed further in Section III.B.7 of the April 2020 Luciano 

Affidavit and Section II.C.1 of the Mansker Affidavit, HALL & HALL Global Inc. was 

incorporated with the ILSOS in or around April 2018, with Co-Conspirator 1 as its 

registered agent and ANIUKWU (using a variant of his name) as its incorporator. 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 16 of 231 PageID #:24
16

Within days of its incorporation, multiple accounts were opened in HALL & HALL’s 

name at federally-insured banks, with Co-Conspirator 1 as the authorized signer. In 

or around April and May 2018, more than one of these accounts collectively received

approximately $204,367.75 in funds fraudulently obtained through business-email 

compromise and inheritance-fraud schemes targeting Victim Business G.F.E., as well 

as Victim Business V.M.C. and its principals, Victim Individual V.M. and his/her 

spouse, Victim Individual R.U. Within days of receiving these funds, withdrawals of 

several thousands of dollars (including cash withdrawals falling below FinCEN’s 

reporting threshold for CTRs) were made from these accounts by Co-Conspirator 1, 

as confirmed by a review of withdrawal tickets. Tens of thousands of dollars in funds 

were also transferred among accounts in Co-Conspirator 1’s or HALL & HALL’s name 

at different banks, and at least one wire transfer of approximately $23,000 was made

from Co-Conspirator 1’s bank account to a Nigerian bank account in IBEKIE’s name.

i. The inheritance-fraud scheme—in particular—involved 

Victim Individual R.U.’s payment to HALL & HALL’s bank account of a retainer fee 

for putative attorney Delouis, the same person appearing in several other 

inheritance-fraud schemes discussed herein, including in the undercover operation 

noted in Section II.F.2, below.

i. As detailed further in Section II.C.2 of the Mansker Affidavit, 

JENANT Inc. was incorporated with the ILSOS in or around December 2018, with 

GOSHA as its registered agent, and SETRACO Services, Inc. was incorporated with 

the ILSOS in or around March 2019 with “Sammy Maxwell” as its registered agent. 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 17 of 231 PageID #:25
17

In or around January 2019, an account was opened in JENANT’s name at a federallyinsured bank, with GOSHA as the authorized signer. In or around March 2019, an 

account was opened in SETRACO’s name at the same bank, with “Sammy Maxwell” 

as the authorized signer. Further, in or around March 2019, these accounts for 

JENANT and SETRACO collectively received approximately $206,867.75 in funds 

fraudulently obtained through an inheritance-fraud scheme targeting Victim 

Individual C.L. Within days of receiving these funds, withdrawals of several 

thousands of dollars (including cash withdrawals falling below FinCEN’s reporting 

threshold for CTRs) were made from these accounts by GOSHA or ANIUKWU (who 

was using the alias “Sammy Maxwell”), as confirmed by a review of withdrawal 

tickets and bank-security footage. Between in or around March and September 2019, 

tens of thousands of dollars in funds were also transferred among accounts in 

SETRACO’s name at different banks, and at least one wire transfer of approximately 

$25,000 was made from a SETRACO bank account to a Nigerian bank account in 

IBEKIE’s name.

i. This inheritance-fraud scheme involved Victim Individual 

C.L.’s payment to either JENANT’s or SETRACO’s bank account of a retainer fee for 

putative attorney Delouis, the same person appearing in several other inheritancefraud schemes discussed herein, including in the undercover operation noted in 

Section II.F.2, below.

j. As detailed further in Section III.B.9 of the April 2020 Luciano 

Affidavit and Section II.C.3 of the Mansker Affidavit, SAMCORD Inc. was 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 18 of 231 PageID #:26
18

incorporated with the ILSOS in or around June 2018, with IBEKIE (using a variant 

of his name) as its registered agent and incorporator. Several days later, an account 

was opened in SAMCORD’s name at a federally-insured bank, with IBEKIE and 

GOSHA as authorized signers. In or around July 2018, this same account received 

approximately $25,000 in funds fraudulently obtained through a romance-fraud 

scheme targeting Victim Individual A.W. (who later told agents that s/he estimated 

that s/he lost over $267,000 as a result of the scheme). Within days of receiving these 

funds, withdrawals of several thousands of dollars (including cash withdrawals

falling below FinCEN’s reporting threshold for CTRs) were made from these 

accounts, including one by IBEKIE, as confirmed by a review of withdrawal tickets.

20. Based on my training and experience, knowledge of this investigation, 

and conversations with other investigators, I know the following:

a. Criminal enterprises involved in fraud routinely attempt to 

conceal the origins of illegally obtained money, including through transfers of funds 

between accounts belonging to fictional business entities, or wire transfers to foreign 

banks. Here, as demonstrated above, accounts in the name of numerous fictional 

business entities associated with IBEKIE, ANIUKWU, and their co-conspirators 

received hundreds of thousands of dollars in fraudulently obtained funds between 

2017 and 2019, frequently via wire transfers. Within days of receipt, tens of 

thousands of dollars were withdrawn from these accounts as checks, or in cash 

withdrawals falling below FinCEN’s reporting threshold for CTRs. 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 19 of 231 PageID #:27
19

b. The withdrawals were, in turn, re-deposited into other accounts 

in the name of fictional business entities associated with IBEKIE, ANIUKWU, and 

their co-conspirators at other banks. Further, tens of thousands of dollars from 

accounts in the name of fictional business entities associated with IBEKIE, 

ANIUKWU, and their co-conspirators were wire-transferred to foreign accounts in 

IBEKIE’s name. This sort of financial activity is consistent with a money-laundering 

scheme designed to hide the origins of fraudulently obtained funds.

F. EVIDENCE OF ANIUKWU’S, IBEKIE’S, AND GOSHA’S PERSONAL 

INVOLVEMENT IN INHERITANCE-FRAUD SCHEMES

1. TRASH PULL AT LINCOLN PREMISES & FINGERPRINT ANALYSIS

OF FORM LETTERS USED IN INHERITANCE-FRAUD SCHEME

21. As noted in Section III.A.1, III.A.2, and III.A.7 of the April 2020 Luciano 

Affidavit, ANIUKWU and IBEKIE formerly resided at 5206 Lincoln Avenue, in Lisle, 

Illinois (the “Lincoln Premises”), as confirmed through physical surveillance, driver’s 

license information, telephone subscriber and toll records, and declarations made by 

these individuals to immigration officials, among other sources of information. 

ANIUKWU and IBEKIE appear to have vacated the Lincoln Premises, however, in 

or around April or May 2019. According to ILSOS records, between in or around June 

2015 and April 2019, approximately fourteen entities were incorporated with the 

ILSOS bearing the Lincoln Premises as their address, including EMPERORCHILLS, 

MEKAS, SAMTONI, GREEN HOUSE, GODMEKS, HALL & HALL, ESIJEMINE, 

and SAMCHINA.

22. On or about May 1, 2019, agents obtained the trash abandoned outside 

the curtilage of the Lincoln Premises, as described further in Section III.D of the April 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 20 of 231 PageID #:28
20

2020 Luciano Affidavit and Section II.D of the Mansker Affidavit. In the trash, agents 

found what appeared to be form letters addressed to various individuals from the 

same person, “John Delon,” informing each addressee that Delon was interested in 

representing him/her in obtaining an approximately $9.2 million inheritance left 

behind by a putative deceased relative. (The same individual, Delon, was involved in 

the inheritance-fraud scheme targeting Victim Individual C.L., as noted above and in 

Section III.C.2.b of the Mansker Affidavit.) Agents also recovered handwritten notes

from the trash, including one bearing username “JohnJeanDelon Gmail Account,” 

password “JohnJean5206.”

a. “5206,” as noted previously, is the numerical street address for 

the Lincoln Premises, the location where the above-mentioned trash pull occurred.

23. As described further in Section II.D of the Mansker Affidavit, in or 

around February and March 2020, three similar letters as those recovered during the 

Lincoln Premises trash pull were returned to 503 North County Farm Road, 

Wheaton, Illinois, which is the address for the DuPage County State’s Attorney 

Office. (Based on the investigation to date, agents have not yet determined why form 

letters used in furtherance of the schemes under investigation bore this particular 

return address.) The subject mailings also appeared to be form letters addressed to 

various individuals from the same person, “Peter Pfizer,” informing each addressee 

that Pfizer was interested in representing him/her in obtaining an approximately 

$11.6 million inheritance left behind by a putative deceased relative, and requesting 

that the addressee contact Pfizer at Ppfizer456@aol.com. (The same individual, 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 21 of 231 PageID #:29
21

Pfizer, exchanged communications with an undercover agent, as noted below and in 

Section III.D.3 of the Mansker Affidavit.) Agents submitted two of the letters for 

fingerprint analysis to the IRS-CI National Forensic Laboratory, which concluded 

that one latent print located on one of the envelopes was made by IBEKIE.

2. SUMMARY OF UNDERCOVER OPERATION AND CONTROLLED DELIVERY 

OF FUNDS OBTAINED THROUGH USE OF INHERITANCE-FRAUD SCHEME

24. On or about May 1, 2020, an IRS-CI Special Agent operating in an 

undercover capacity (the “UCA”) sent an email to Ppfizer456@aol.com in response to 

one of the letters received by the DuPage County State’s Attorney Office purporting 

to be a relative of one of the addressees, Victim Individual W.B. The UCA informed 

Peter Pfizer that s/he handles the affairs of Victim Individual W.B. and would like to 

proceed with the transaction on behalf of Victim Individual W.B. At all relevant times 

during the undercover operation, the UCA was physically located in Michigan.

25. As described further in Section III.D.3 of the Mansker Affidavit:

a. The UCA received a response from Pfizer the same day, on or 

about May 1, 2020. What followed over the next several days were a series of 

communications wherein Pfizer directed the UCA to fill out certain forms to lay claim 

to a putative deceased relative’s bank account with Standard Chartered Bank (the 

“Inheritance Account”). The UCA was later directed to contact Standard Chartered’s 

affiliate bank, TD Canada Trust, using the email address ued@tdcanadagroup.com. 

Several victims cited in the April 2020 Luciano Affidavit (see Sections III.B.3.c, 

III.B.6.b, and III.B.7.b, therein) corresponded with ued@tdcanadagroup.com.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 22 of 231 PageID #:30
22

b. In late-May, 2020, the UCA was directed by both a representative 

of TD Canada Trust and Pfizer to retain the services of Pierre Delouis, a putative 

attorney with the firm HALL & HALL (the same individual appearing in inheritancefraud schemes targeting multiple other victims, as noted herein). On or about June 

5, 2020, the UCA signed a retainer agreement with Delouis and requested bankaccount information related to the payment of certain associated fees. That same day, 

the UCA had a recorded call with Pfizer, who was using an unknown number. Pfizer 

instructed the UCA regarding what to say to bank personnel when the UCA wired

money to pay the fees due to Delouis, emphasizing that the UCA should tell the bank 

that s/he was wiring money to purchase goods or merchandise. Further, that same 

day, Delouis contacted the UCA via email and instructed the UCA to pay the pending 

fees through a wire transfer to a Chase Bank account in the name of EMETECH

Solutions Inc., with an address of the Oxbow Premises (which, as noted below and in 

the Mansker Affidavit, is IBEKIE’s current residence).

i. A search of ILSOS online databases disclosed EMETECH 

was incorporated on or about March 6, 2020, with IBEKIE as its registered agent.

Further, on or about March 10, 2020, a checking account was opened in the name of 

EMETECH at JP Morgan Chase Bank. The signature card for this account lists CoConspirator 4 as the authorized signer and President of EMETECH. The signature 

card also lists the Oxbow Premises as the address for EMETECH.

c. On or about June 9, 2020, Delouis sent an email to the UCA with 

revised payment instructions, directing the UCA to send a cashier’s check, made 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 23 of 231 PageID #:31
23

payable GLOBAYO LLC, to 1419 N. Harlem Avenue, Suite B, Oak Park, Illinois 

60302 (i.e., the Harlem Premises). As set forth in Section II.E.2 of the Mansker 

Affidavit, GOSHA resides at the Harlem Premises.

i. A search of ILSOS online databases disclosed GLOBAYO 

was incorporated on or about June 1, 2017, with Co-Conspirator 5 as its registered 

agent. Pertinent communications exchanged via email among Co-Conspirator 5, 

ANIUKWU, and IBEKIE are described further below.

d. On or about June 15, 2020, the UCA obtained a cashier’s check 

for $1,100 made payable to GLOBAYO (the “UCA Check”). The next day, with the 

assistance of the U.S. Postal Inspection Service (“USPIS”), agents prepared a U.S.

Postal Service Express Mail parcel (the “Express Parcel”). Then, before they placed 

the UCA Check inside the Express Parcel, agents added a handwritten notation to

its face stating: “For Pierre Delouis – Legal Fees.” The Express Parcel was addressed 

to “Globayo LLC” at the Harlem Premises.

e. On or about June 18, 2020, after a BMW SUV currently registered 

to GOSHA arrived at the Harlem Premises, a Postal Inspector posing as a mail carrier

conducted a controlled delivery of the Express Parcel containing the UCA Check to 

the Harlem Premises. GOSHA answered the door.1 When asked about the Express 

Parcel being addressed to a business entity at a residential address, GOSHA looked 

at the label on the Express Parcel and confirmed that its delivery address was correct. 

 

1 As detailed in the Mansker Affidavit, GOSHA was identified based on agents’ review of an 

audio-video recording of the controlled delivery, and their general familiarity with GOSHA’s 

appearance from photographs and driver’s license records in law-enforcement databases.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 24 of 231 PageID #:32
24

GOSHA further said that she had been working from home, an apparent explanation 

for receiving mail addressed to a business entity at her residence. (From information 

obtained in the investigation to date, agents believe that GOSHA actually works for 

the U.S. Postal Service.) Further, GOSHA complained that the Express Parcel should 

have arrived that morning instead of in the afternoon, indicating her knowledge of 

the Express Parcel and anticipation of its arrival. Then, GOSHA signed for the parcel

as “JGosha.”

26. USPIS obtained a list of all IP addresses that were used to track the 

Express Parcel delivered to the Harlem Premises. One IP address used to track the 

Express Parcel around June 17, 2020 was 2600:1700:1cb0:2d80:fc85:e5c4:3128:1fae. 

Subscriber records obtained from AT&T showed that this IP address is registered to 

ANIUKWU at the Oxbow Premises (which, as noted below and in the Mansker 

Affidavit, is IBEKIE’s current residence).2 Further, IP addresses associated, between 

February and April 2020, with online activity for ued@standardgroupservices.com

and Ppfizer456@aol.com—two email addresses used to communicate with the UCA, 

as noted further in Section II.F of the Mansker Affidavit—are also registered to 

ANIUKWU at the Oxbow Premises.

 

2 As detailed in the Mansker Affidavit, IBEKIE or vehicles known to be used by him have 

been seen at the Oxbow Premises on over a dozen occasions between January and June 2020. 

During these instances, IBEKIE was identified based on agents’ general familiarity with his

appearance from photographs and driver’s license records in law-enforcement databases.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 25 of 231 PageID #:33
25

3. PERTINENT EMAIL COMMUNICATIONS EXCHANGED AMONG 

ANIUKWU, IBEKIE, AND THEIR CO-CONSPIRATORS

i. Evidence Tying IBEKIE to Use of Specific Gmail

Accounts

27. Information obtained from Google showed that the subscribers for two 

email accounts, aibekie@gmail.com and aristoblake@gmail.com, are “Anthony Ibekie” 

and “Aristo Blake,” respectively. Both accounts have the same recovery email 

address, however, of emekarn@yahoo.com. Further, data obtained pursuant to pentrap orders issued by the Honorable Rebecca R. Pallmeyer, Chief United States 

District Judge, on or about June 15, 2020, in Case No. 19 GJ 060 (collectively, the 

“Pen/Trap”), show that the IP address 104.185.26.48 was used to access the account

aibekie@gmail.com on or about June 17, 2020. 

28. Subscriber records obtained from AT&T show this same IP address is 

registered to ANIUKWU at the Oxbow Premises (though ANIUKWU resides at the 

Weber Premises, as detailed further in Section II.G of the Mansker Affidavit).

Information obtained from Continental Properties, the management company for the 

Oxbow Premises and Weber Premises, shows that IBEKIE applied to be added as a 

tenant of the Oxbow Premises on or about April 29, 2020. Moreover, surveillance and 

other information obtained over the course of the investigation, as detailed further in 

Section II.F of the Mansker Affidavit, establishes that the Oxbow Premises—the 

same address where the account aibekie@gmail.com was accessed on or about June 

17, 2020, according to IP address records—is IBEKIE’s current residence (and a 

location where ANIUKWU has not been seen on multiple instances of surveillance). 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 26 of 231 PageID #:34
26

29. Information obtained from Continental Properties additionally shows 

that ANIUKWU is the current tenant at the Weber Premises, with a lease term 

through November 14, 2020.3 A lease application dated on or about November 14, 

2019, which was submitted by ANIUKWU, listed IBEKIE as ANIUKWU’s emergency 

contact and prior landlord. Contact information listed for IBEKIE on this application 

included the email address aristoblake@gmail.com. Further, communications from 

aristoblake@gmail.com to other email accounts, discussed further below, are signed 

by “Tony” (a common abbreviation for IBEKIE’s first name, Anthony).

30. Based on my training and experience, knowledge of this investigation, 

review of the foregoing subscriber records and other information, as well as the 

contents of email communications detailed below and in the Mansker Affidavit, I 

believe that the accounts aibekie@gmail.com and aristoblake@gmail.com are used by 

IBEKIE.

ii. Evidence Tying ANIUKWU to Use of Specific Gmail

Accounts

31. On or about November 8, 2019, ANIUKWU was subjected to a border 

inspection by Customs and Border Patrol (“CBP”) officers, upon his return to O’Hare 

International Airport from a trip abroad. The information obtained from that border 

inspection is described more fully in Section III.F of the April 2020 Luciano Affidavit. 

 

3 As detailed in the Mansker Affidavit, ANIUKWU has been seen at the Weber Premises on 

multiple occasions since April 2020, and as recently as July 7, 2020. During these instances, 

ANIUKWU was identified based on agents’ general familiarity with his appearance from

photographs and driver’s license records in law-enforcement databases. ANIUKWU was not, 

however, seen at the Oxbow Premises during any instances of physical surveillance 

conducted by agents there (though multiple IP addresses associated with relevant account 

activity are subscribed to ANIUKWU at the Oxbow Premises).

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 27 of 231 PageID #:35
27

During a border search of a MacBook Pro laptop in ANIUKWU’s possession, agents 

saw an email application had data related to the accounts saniukwu1@gmail.com (the 

“ANIUKWU Gmail Account”), and constantconsultant200@gmail.com (the “Constant 

Gmail Account”).

32. Information obtained from Google showed that the subscriber for the 

ANIUKWU Gmail Account is ANIUKWU, and that the subscriber for the Constant 

Gmail Account is “Opia Samuel,” with the same recovery-email address as used for 

the ANIUKWU Gmail Account.

33. Based on my training and experience, knowledge of this investigation, 

review of the foregoing subscriber records and other information, as well as the 

contents of email communications detailed below and in the Mansker Affidavit, I 

believe that the ANIUKWU Gmail Account and Constant Gmail Account are used by 

ANIUKWU.

34. On or about April 21, 2020, agents executed the Gmail Warrant, which 

authorized the search of the ANIUKWU Gmail Account and Constant Gmail Account. 

The results of that search are detailed further in Sections II.G.1 and II.G.2 of the 

Mansker Affidavit. What follows below are examples of pertinent data recovered from

the ANIUKWU and Constant Gmail Accounts, including communications exchanged 

with aibekie@gmail.com and aristoblake@gmail.com, two accounts that are believed 

to be used by IBEKIE, as noted above.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 28 of 231 PageID #:36
28

iii. Pertinent Communications Exchanged from the 

ANIUKWU Gmail Account

35. As detailed further in Section II.G.1.b of the Mansker Affidavit, on or 

about May 15, 2017, an email was sent from the ANIUKWU Gmail Account to 

IBEKIE at email address aibekie@gmail.com, which included—as an attachment—a 

form letter used as part of an apparent inheritance-fraud scheme. The substantive 

content of the letter was similar to those: (1) obtained from the Lincoln Premises 

trash pull; (2) returned to the DuPage County State’s Attorney Office, one of which 

bore IBEKIE’s fingerprint on its envelope; and (3) used during the undercover 

operation discussed above to initiate contact with Peter Pfizer.

36. As detailed further in Section II.G.1.b of the Mansker Affidavit, on or 

about June 10, 2018, an email was received by the ANIUKWU Gmail Account from 

Co-Conspirator 5 at [Co-Conspirator 5]@globayo.com, copying IBEKIE as well. The 

email identified Co-Conspirator 5 as the “President & CEO” of GLOBAYO, IBEKIE 

as the “CEO of African Money Union,” and ANIUKWU as “Chief Operating Officer of 

African Money Union.”

a. GLOBAYO is the company to which the UCA was instructed to 

pay fees associated with retaining putative attorney Delouis, and Co-Conspirator 5 is 

the registered agent for GLOBAYO, as described above. The UCA Check was made 

payable to GLOBAYO and delivered to the Harlem Premises through a Controlled 

Delivery, as further described above. African Money Union is referenced and further 

described in Section III.E.2 of the April 2020 Luciano Affidavit.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 29 of 231 PageID #:37
29

37. As detailed further in Section II.G.1.b of the Mansker Affidavit, on or 

about September 21, 2019, the ANIUKWU Gmail Account received an email from 

aristoblake@gmail.com, which included—as an attachment—a form letter used as 

part of an apparent inheritance-fraud scheme, signed by “Mr. Peter Pfizer.” The 

substantive content of the letter was similar to those: (1) obtained from the Lincoln 

Premises trash pull; (2) returned to the DuPage County State’s Attorney Office, one 

of which bore IBEKIE’s fingerprint on its envelope; and (3) used during the 

undercover operation discussed above to initiate contact with Peter Pfizer.

38. As detailed further in Section II.G.1.b of the Mansker Affidavit, on or 

about December 19, 2019, an email was sent from the ANIUKWU Gmail Account to 

an unidentified recipient at seselambo@yahoo.com, which included—as an 

attachment—a form letter that appeared to be identical to the letter described above 

in paragraph 35.

39. As detailed further in Section II.G.1.b of the Mansker Affidavit, an email 

was sent from the ANIUKWU Gmail Account to an unidentified recipient at 

peterpf172@gmail.com, which included—as an attachment—approximately 199 form 

letters addressed to various recipients in alphabetical order, with last names starting 

with the letters C and D. Each letter was signed by “Mr. Peter Pfizer.” The 

substantive content of the letters was similar to those: (1) obtained from the Lincoln 

Premises trash pull; (2) returned to the DuPage County State’s Attorney Office, one 

of which bore IBEKIE’s fingerprint on its envelope; and (3) used during the 

undercover operation discussed above to initiate contact with Peter Pfizer.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 30 of 231 PageID #:38
30

iv. Pertinent Communications Exchanged from the 

Constant Gmail Account

40. As detailed further in Section II.G.2.b of the Mansker Affidavit, on or 

about June 11, 2017, the Constant Gmail Account received an email from 

aristoblake@gmail.com, copying Hallmark_security@hotmail.com, which was signed 

by “Tony” (a common abbreviation for IBEKIE’s first name, Anthony). That same day, 

the Constant Gmail Account received another email from aristoblake@gmail.com, 

again copying Hallmark_security@hotmail.com, which contained the following text

referencing form letters used as part of an apparent inheritance-fraud scheme: 

Emeka,

On another thought, since you have the direct mail addresses and 

I have sent you a sample of the merged email, i suggest you do the 

merging yourself and send me the already merged letter in a bulk 

of 100 each, then i can print it, place the stamp in the single 

window envelope and put them in the mail, i know you said you 

have 1500 direct mail addresses, that fine, when we exhaust it we 

can start using the 3000 (selective pre screened direct mail)I just 

ordered.

God will have mercy on us one day.

Please forward our correspondences to Onowu

Here is our number

Tony 630XXX0699

Sama 630XXX5959

Onowu 080XXXX11430

a. In documents filed by IBEKIE and ANIUKWU with immigration 

authorities in or around 2016 and 2017, IBEKIE’s contact number is listed as (630) 

XXX-0699, and ANIUKWU’s contact number is listed as (630) XXX-5959, as discussed 

further in Sections III.A.1 and III.A.2 of the April 2020 Luciano Affidavit.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 31 of 231 PageID #:39
31

III. CONCLUSION

41. Based on the foregoing, as well as the facts set forth in the April 2020 

Luciano Affidavit and the Mansker Affidavit (which are each incorporated herein by 

reference), probable cause exists that ANIUKWU, IBEKIE, and GOSHA, conspired 

with each other, and others known and unknown, to commit a wire-fraud scheme, in 

violation of Title 18, United States Code, Sections 1343 and 1349.

FURTHER AFFIANT SAYETH NOT.

SIXTO J. LUCIANO

Special Agent, 

Homeland Security Investigations

SUBSCRIBED AND SWORN to before me on July 10, 2020.

Honorable SHEILA M. FINNEGAN

United States Magistrate Judge

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 32 of 231 PageID #:40
Exhibit 1:

Application and Affidavit of HSI SA

Sixto J. Luciano in Support of Gmail 

Search Warrant in Case No. 20 M 215

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 33 of 231 PageID #:41
AO 106 (REV 4/ 10) Affidavit for Search Wa rrant AUSA Sauris h A 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF ILLINOIS, EASTERN DIVISIO:r,{pR 2 0 2020 

UNDER SEAL THOMAS G. BRUTON 

CLERK, U.S DISTRICT COURT 

In the Matter of the Search of: 

The Google accounts saniukwul@gmail.com and 

constantconsulta n t200@gmail.com, further described 

in Attachment A 

Case Number: 

201215 

APPLICATION AND AFFIDAVIT FOR A SEARCH WARRANT 

• 

I, Sixto J. Luciano, a Special Agent of the Homeland Security Investigations, request a sea rch warrant and 

state under pena lty of pe rjury that I have reason to believe that on the fo llowing property or premises: 

See Attachment A 

located in the Northern District of Ca lifornia , there is now concealed: 

See Attachment A 

The basis for the search under Fed. R. Crim. P. 4l (c) is evidence , instrumentalities, a nd fruits. 

The search is related to a violation of: 

Code Section 

Tit le 18, U nited States Code, Sections 1341 a nd 1343 

The app lication is ba sed on these facts: 

Offense Description 

ma il and wire fraud 

See Attach ed Affidavit, 

Conti nued on the attached sheet. 

SIXTO J. LUCIANO. Special Agent 

Homela nd Security Investigations 

Printed name and title 

Pursuant to Fed. R. Crim. P. 4.1, this wa rrant is presented by reliab lectronic means. Th 

provided a sworn statement attesting to the truth of the foregoing v·t by teleph · 

Date: April 20. 2020 

City a nd State : Chicago. Illinois 

Printed name and title 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 34 of 231 PageID #:42
UNITED STATES DISTRICT COURT ) 

) 

NORTHERN DISTRICT OF ILLINOIS ) 

AFFIDAVIT 

TABLE OF CONTENTS 

I. INTRODUCTION AND AFFIANT BACKGROUND ...................................... 1 

II. BACKGROUND INFORMATION REGARDING GOOGLE .......................... 3 

III. STATEMENT OF PROBABLE CAUSE .......................................................... 5 

A. Investigative Background and Summary ........................................................ 5 

1. Uchenna Samuel Aniukwu, aka Samuel Uchenna Aniukwu 

("ANIUKWU") .......................................................................................... 9 

2. Anthony Emeka Ibekie ("IBEKIE") ....................................................... 11 

3. Lasheena Washington ("WASHINGTON") ........................................... 12 

4. Williette Asanji ("ASANJI") ................................................................... 13 

5. Treonda Steadman ("STEADMAN") ...................................................... 13 

6. Lawrence Berry III ("BERRY'') .............................................................. 14 

7. The Lincoln Premises and its associated business entities .................. 15 

B. Receipt of Victim Funds By Various Entities Associated with 

ANIUKWU, IBEKIE, and their Co-Conspirators ......................................... 17 

1. NU-MEKS Healthcare Inc ..................................................................... 17 

a. Corporate Formation .............................................................................. 17 

b. Receipt of Funds from Victim Individual S.K ....................................... 18 

2. EMPEROR CHILLS ................................................................................ 20 

a. Corporate Formation .............................................................................. 20 

b. Receipt of Funds from Victim Business B.E.F ...................................... 20 

3. MEKAS Construction Inc ...................................................................... 23 

a. Corporate Formation .............................................................................. 23 

b. Receipt of Funds from Victim Business M.W ........................................ 23 

c. Receipt of Funds from Victim Individuals J.B. and S.B ....................... 25 

d. Receipt of Funds from Victim Individual D.J ....................................... 27 

4. SAMTONI Medical Equipment ............................................................. 29 

a. Corporate Formation .............................................................................. 29 

b. Receipt of Funds from Victim Individual C.B ....................................... 30 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 35 of 231 PageID #:43
5. INNOCORD Inc ...................................................................................... 34 

a. Corporate Formation .............................................................................. 34 

b. Receipt of Funds from Victim Business F.M ......................................... 34 

6. GREEN HOUSE For Food Industry Inc ............................................... 35 

a. Corporate Formation .............................................................................. 35 

b. Receipt of Funds from Victim Individual C.H ....................................... 36 

c. Receipt of Funds from Victim Business F .M ......................................... 37 

d. Receipt of Funds from Victim Individual K.D ....................................... 39 

7. HALL & HALL Global Inc ..................................................................... 41 

a. Corporate Formation .............................................................................. 41 

b. Receipt of Funds from Victim Business V.M.C. and Victim 

Individuals R.U. and V.M ...................................................................... 41 

c. Receipt of Funds from Victim Business G.F.E ...................................... 44 

8. GODMEKS Inc ....................................................................................... 45 

a. Corporate Formation .............................................................................. 45 

b. Receipt of Funds from Victim Individual D.P ....................................... 45 

9. SAMCORD Inc ........................................................................................ 48 

a. Corporate Formation .............................................................................. 48 

b. Receipt of Funds from Victim Individual D.P ....................................... 48 

c. Receipt of Funds from Victim Individual A.W ...................................... 49 

10. ESIJEMINE Lucky Nengite Inc ............................................................ 51 

a. Corporate Formation .............................................................................. 51 

b. Receipt of Funds from Victim Individual A.W ...................................... 51 

c. Receipt of Funds from Victim Individual R.A ....................................... 52 

11. SAMCHINA Trucking Inc ...................................................................... 54 

a. Corporate Formation .............................................................................. 54 

b. Receipt of Victim Funds ......................................................................... 55 

C. Evidence of International Outgoing Wire Transfers .................................... 58 

D. Trash Pull at the Lincoln Premises ............................................................... 59 

E. CBP Encounters with IBEKIE ...................................................................... 62 

1. October 1, 2018 Border Inspection ........................................................ 62 

2. April 5, 2019 Border Encounter ............................................................. 63 

3. October 31, 2019 Border Encounter ...................................................... 64 

11 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 36 of 231 PageID #:44
F. CBP November 8, 2019 Border Encounter with ANIUKWU ....................... 64 

1. Border Search of ANIUKWU's Laptop .................................................. 66 

G. Probable Cause to Believe that Subject Accounts 1 and 2 Contain Evidence 

of Fraud ........................................................................................................... 70 

IV. SEARCH PROCEDURE FOR SUBJECT EMAIL ACCOUNTS .................. 73 

V. CONCLUSION ............................................................................................... 74 

111 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 37 of 231 PageID #:45
I, Sixto Luciano, being duly sworn, state as follows: 

I. INTRODUCTION AND AFFIANT BACKGROUND 

1. I am a Special Agent :with the U.S. Department of Homeland Security, 

Immigration and Customs Enforcement, Homeland Security Investigations ("HSI") 

and have been so employed since 2008. As part of my duties as a Special Agent, I 

investigate criminal violations relating to white-collar crime, including mail, wire, 

and bank fraud, as well as other financial and cyber-crimes. Before my employment 

with HSI, I worked as a Postal Inspector with the U.S. Postal Inspection Service from 

about April 2008 through August 2008, and as a Special Agent with the Internal 

Revenue Service, Criminal Investigation from about January 2001 through April 

2008. In my capacity as an investigator with these agencies, I have participated in 

the execution of multiple federal search warrants. 

2. This affidavit is made in support of an application for a warrant to 

search-pursuant to Title 18, United States Code, Sections 2703(a), 2703(b)(l)(A) and 

2703(c){l){A)-for information associated with certain account(s) that are stored at 

the premises owned, maintained, controlled, or operated by Google, a free web-based 

electronic mail-service provider located at 1600 Amphitheatre Parkway, Mountain 

View, California, 94043. The accounts to be searched are saniukwul@gmail.com 

("Subject Account 1") and constantconsultant200@gmail.com ("Subject 

Account 2") (collectively, "the Subject Accounts"), which are further described in 

the following paragraphs and in Part II of Attachment A. As set forth below, there is 

probable cause to believe that in the Subject Accounts, described in Part II of 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 38 of 231 PageID #:46
Attachment A, and in Google's possession, there exists evidence, instrumentalities, 

and fruits concerning mail and wire fraud, money laundering, and conspiracy to 

commit the foregoing offenses, in violation of Title 18, United States Code, Sections 

1341, 1343, 1956, and 371. 

3. The statements in this affidavit are based on my personal knowledge, 

and on information I have received from other law-enforcement personnel, as well as 

from persons with knowledge regarding relevant facts. Because this affidavit is being 

submitted for the limited purpose of securing a search warrant, I have not included 

each and every fact known to me concerning this investigation. I have set forth facts 

that I believe are sufficient to establish probable cause to believe that evidence, 

instrumentalities, and fruits of violations of Title 18, United States Code, Sections 

1341, 1343, 1956, and 371, are located in the Subject Accounts. 

4. This affidavit also describes portions of written conversations, which I 

have summarized. These summaries do not necessarily refer to all of the topics 

covered during each conversation. In addition, these summaries do not include every 

conversation made by every writer/author on the topic being described. Portions of 

the conversations that are quoted are preliminary transcriptions, which may be 

subject to modification upon further review. For some conversations, I have offered 

my understandings and/or interpretations of the conversation, which are based upon 

my experience and knowledge of the investigation to date, the content and context of 

the conversations, the experience of other investigators with whom I have consulted, 

as well as my professional training and experience as a law-enforcement agent. 

2 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 39 of 231 PageID #:47
II. BACKGROUND INFORMATION REGARDING GOOGLE 

5. Based on my training and experience and information available from 

Google's website (google.com), I have learned the following information about Google 

and Gmail: 

a. Google offers a collection of Internet-based services, including email and online data storage, which is owned and controlled by Google. The services 

are available at no cost to Internet users, though there are certain options, such as 

additional online data storage, that users may elect to pay money to receive. 

Subscribers obtain an account by registering on the Internet with Google and 

providing Google with basic information, including name, gender, zip code, and other 

personal/biographical information. Subscribers are given a Google account which 

ends in "@gmail.com" which is utilized to access these online services. 

b. Google maintains electronic records pertaining to the individuals 

and entities who maintain Google online subscriber accounts. These records often 

include account access information, e-mail transaction information, account 

application information, and in some circumstances billing and payment information. 

c. Any e-mail that is sent to a Google online account subscriber is 

stored in the subscriber's "mail box" on Google's servers until the subscriber deletes 

the e-mail or the subscriber's mailbox exceeds the storage limits preset by Google. If 

the message is not deleted by the subscriber, the account is below the maximum 

storage limit, and the subscriber accesses the account periodically, that message can 

remain on Google's servers indefinitely. 

3 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 40 of 231 PageID #:48
d. When a subscriber sends an e-mail, it is initiated by the user, 

transferred via the Internet to Google's servers, and then transmitted to its end 

destination. Google online account users have the option of saving a copy of the email sent. Unless the sender of the e-mail specifically deletes the e-mail from the 

Google server, the e-mail may remain on the system indefinitely. 

e. Google online account subscribers can store files, including but 

not limited to e-mails, documents, and image files, on servers maintained and/or 

owned by Google. The online data storage service is known as "Google Drive." 

f. Google online account subscribers can also utilize a feature 

known as "History" that allows a user to track various historical account activity, 

including past Google Internet searches performed, information regarding devices 

which have been used to login to the Google online account, and physical location 

information regarding from where the Google online account was accessed. 

g. Google keeps records that can reveal accounts accessed from the 

same electronic device, such as the same computer or mobile phone, including 

accounts that are linked by "cookies," which are small pieces of text sent to the user's 

Internet browser when visiting websites. 

6. Therefore, the computers of Google are likely to contain all the material 

just described, including stored electronic communications and information 

concerning subscribers and their use of Google, such as account access information, 

transaction information, and account application. In order to accomplish the objective 

of the search warrant with a minimum of interference with the business activities of 

4 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 41 of 231 PageID #:49
Googlet to protect the rights of the subjects of the investigation and to effectively 

pursue this investigationt authority is sought to allow Google to make a digital copy 

of the entire contents of the information subject to seizure specified in Section II of 

Attachment A. That copy will be provided to me or to any authorized federal agent. 

The contents will then be analyzed to identify records and information subject to 

seizure pursuant to Section III of Attachment A. 

III. STATEMENT OF PROBABLE CAUSE 

A. INVESTIGATIVE BACKGROUND AND SUMMARY 

7. This warrant application stems from an ongoing investigation into 

individuals in the Northern District of Illinoist and elsewheret who are suspected of 

facilitatingt or laundering the proceeds oft various online fraud schemes. 

8. To datet the investigation has identified several individuals who have 

conducted overt and affirmative acts in the Northern District oflllinois in furtherance 

of various online schemes and artificest such as the incorporation of business entities 

and the opening of bank accounts at financial institutions-including those that are 

federally insured-in order to facilitate the receipt of funds fraudulently induced from 

victims through false pretensest representationst promisest and concealment of 

material factst and subsequently transfer the funds to accounts maintained abroad. 

9. The co-conspiratorst known and unknownt have used various means to 

conduct the above overt actst including the use of telephonest computerst vehiclest 

correspondencet and the United States Postal Servicet evidence of which are believed 

to be maintained in the Subject Accountst as described further in Attachment A. 

5 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 42 of 231 PageID #:50
10. In summary, and as explained in more detail herein, the below 

individuals and entities were involved in opening accounts at financial institutions 

in the Northern District of Illinois, and elsewhere, to facilitate the receipt and 

subsequent transfer of proceeds fraudulently obtained from victims of the following 

categories of schemes: 

a. Business Email Compromise: a scheme targeting businesses that 

perform wire transfers. The scheme is typically carried out by: (1) compromising 

legitimate business e-mail accounts through social engineering or computer-intrusion 

techniques to gain unauthorized access to the business-email account; (2) blocking or 

redirecting communications to or from the email account; and then (3) using the 

compromised email account or a separate fraudulent email account to communicate 

with personnel from a victim company, attempting to induce the victim company into 

making a wire transfer under fraudulent pretenses. 

b. Romance Fraud: a scheme to defraud a victim on the Internet, 

whereby a co-conspirator contacts a victim online and builds trust through an online 

romance. At some point, the co-conspirator will convince a victim to send money to a 

predetermined recipient under the false pretense that the victim will either get paid 

back in the future or that the money being sent is part of a business transaction. 

Romance scams typically target persons looking for romantic partners or friendship 

on dating websites and other social-media platforms. The scammers may create 

profiles using fictitious or fake names, locations, images, and personas, allowing the 

scammers to cultivate relationships with prospective romance-scam victims. Victims 

6 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 43 of 231 PageID #:51
may be convinced to provide money or gifts to the scammers, or may be asked to 

conduct transactions on behalf of the scammers. 

c. Inheritance Fraud Scheme: a variation of an online-investmentfraud scheme, in which a victim is tricked into sending money from his/her bank 

account under the false pretense that the victim is about to receive a substantial 

inheritance. 

11. The Statement of Probable Cause in this affidavit is divided into the 

following sections: 

a. Sections III.A.I through III.A.6 provide background information 

regarding the co-conspirators that law enforcement has identified, to date, as being 

involved in the fraudulent schemes mentioned herein, including Samuel ANIUKWU, 

whose email accounts are the subject of this warrant application. 

b. Section III.A. 7 identifies the "Lincoln Premises," a residential 

address formerly associated with several co-conspirators, including ANIUKWU and 

Anthony IBEKIE, as well as various business entities registered to that address that 

are relevant to this investigation. 

c. Sections III.B.1 through III.B.11 summarize various business 

entities suspected of being used to facilitate the fraudulent schemes mentioned 

herein, including the corporate formation of those entities, as well as each entity's 

receipt of fraudulently obtained funds from a victim individual or victim business. 

7 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 44 of 231 PageID #:52
d. Section III. C summarizes evidence of international outgoing wire 

transfers of funds suspected to have been generated through the fraudulent schemes 

mentioned herein. 

e. Section III.D summarizes evidence obtained by law enforcement 

during the search of discarded trash at the Lincoln Premises on or about May 1, 2019. 

f. Section III.E summarizes interactions between Customs and 

Border Protection ("CBP") officials and suspected co-conspirator IBEKIE during 

three separate border encounters at the Chicago O'Hare International Airport 

between October 2018 and October 2019. 

g. Section III.F-which has particular relevance to this warrant 

application-summarizes interactions between CBP officials and HSI agents, 

including myself, with suspected co-conspirator ANIUWKU at the Chicago O'Hare 

International Airport on or about November 8, 2019. This section also summarizes 

the findings from my border search of ANIUWKU's laptop (on which data from the 

Subject Accounts was stored). As noted below, at the time that I conducted the 

border search of ANIUWKU's laptop, I was aware of the details of this investigation 

set forth in Sections III.A through Section III.E, and held-based on my knowledge 

of those details-a reasonable suspicion that any digital devices in ANIUWKU's 

possession at the border would contain evidence, fruits, or instrumentalities of the 

fraudulent schemes mentioned herein. I 

1 On or about November 8, 2019, I also conducted a border search of a cellphone device in 

ANIUWKU's possession. This affidavit does not cite or rely upon any information obtained 

8 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 45 of 231 PageID #:53
h. Section III.G summarizes why probable cause exists to search the 

Subject Accounts for the evidentiary items specified in Attachment A. 

1. Uchenna Samuel Aniukwu, aka Samuel Uchenna 

Aniukwu ("ANIUKWU") 

12. ANIUKWU is a citizen or national from Nigeria, who, until about early2019, resided at 5206 Lincoln Avenue in Lisle, Illinois ("the Lincoln Premises"), and 

then later moved to 2726 Alyssa Drive, in Naperville, Illinois (the "Alyssa Premises"). 

13. Physical surveillance, driver's license information, analysis of telephone 

subscriber and toll records, and declarations made by ANIUKWU to CBP officials 

(described further below in Section III.F) indicate that ANIUKWU resided at the 

Alyssa Premises until around late-2019. Further, a review of commercial databases 

and physical surveillance indicates that ANIUKWU and co-conspirator Anthony 

IBEKIE (discussed further below) have moved from the Alyssa Premises in late-2019, 

and that ANIUKWU may now be residing at either 716 S. Weber Rd, Unit #512, in 

Romeoville, Illinois, or 673 Hearth Lane, in Carol Stream, Illinois. The latter address, 

as discussed below, is the residence of co-conspirator Lasheena WASHINGTON. 

14. A Form 485, Application to Register Permanent Residence, dated on or 

about May 18, 2018, and filed with the United States Citizenship and Immigration 

Service ("USCIS") in ANIUKWU's name, lists the Lincoln Premises as ANIUKWU's 

physical address from on or about April 4, 2016 to the date of the application. The 

form further lists ANIUKWU's occupation as a self-employed marketer, also located 

during the border search of ANIUWKU's cellphone, but rather, only upon information 

obtained during the border search of ANIUWKU's laptop. 

9 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 46 of 231 PageID #:54
at the Lincoln Premises, and provides Subject Account 1 and (630) XXX-7666 

("Subject Phone 2") as ANIUKWU's email address and telephone contact number. TMobile records identified NU-MEKS Healthcare Inc (discussed further below in 

Section III.B.l} at the Lincoln Premises as the subscriber for Subject Phone 2 from 

on or about November 22, 2017 to November 14, 2018. 

15. Documents filed with the USCIS reflect IBEKIE as a joint sponsor for 

ANIUKWU to obtain status as a permanent resident of the United States. Further, 

a Form 864A, Contract between Sponsor and Household Member, dated on or about 

November 12, 2016, filed with the USCIS in the name ofIBEKIE lists ANIUKWU as 

IBEKIE's cousin. Additionally, a Form 864, Affidavit of Support filed with the USCIS 

in the name of IBEKIE, dated on or about June 6, 2017, lists ANIUKWU's contact 

number as (630) XXX-5959 ("Subject Phone 3"}, while another Form 864, dated on or 

about November 2, 2016, lists ANIUKWU's contact number as Subject Phone 1 (i.e., 

the same number listed as IBEKIE's contact number in IBEKIE's own Application 

for Naturalization, described further below). T-Mobile records identified NU-MEKS 

Healthcare Inc at the Lincoln Premises as the subscriber for Subject Phone 3 from on 

or about October 19, 2016 to December 4, 2017. 

16. On or about November 8, 2019, CBP officials conducted an inspection of 

ANIUKWU at O'Hare upon his arrival into the United Sates, as discussed further in 

Section III.F. During the inspection, ANIUKWU had a Samsung SM-960U phone in 

his possession using phone number (630) XXX-3378 ("Subject Phone 4"). T-Mobile 

records identify ANIUKWU as the subscriber for Subject Phone 4. 

10 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 47 of 231 PageID #:55
2. Anthony Emeka Ibekie ("IBEKIE") 

1 7. IBEKIE is a citizen or national from Nigeria, and a lawful permanent 

resident of the United States, who, until about early- to mid-2019, resided at the 

Lincoln Premises. 

18. A review of commercial databases, physical surveillance, analysis of 

telephone subscriber and toll records, and declarations made by IBEKIE to CBP 

officials (described further below in !ILE) indicate that IBEKIE resided at the Alyssa 

Premises until around late-2019, but that he currently resides at 797 Oxbow, Unit 

#110, in Oswego, Illinois as of approximately January 2020. 

19. A Form N-400, Application for Naturalization, dated on or about August 

22, 2017, and filed with the USCIS in IBEKIE's name, lists the Lincoln Premises as 

IBEKIE's address from on 01· about January 1, 2010 to the date of the application. 

The form further lists IBEKIE's occupation as a registered nurse with Numeks 

Healthcare Inc., also at the Lincoln Premises, and provides (630) XXX-0699 ("Subject 

Phone l"} as IBEKIE's telephone number. T-Mobile records identified NU-MEKS 

Healthcare Inc at the Lincoln Premises as the subscriber for Subject Phone 1 from on 

or about July 8, 2015 to November 14, 2018. 

20. Documents filed with the USCIS indicate that IBEKIE was married to 

Tonyanika Fogle from on or about April 27, 2001 through April 7, 2006, and later to 

Treonda STEADMAN (described further below in Section II.A.5) from on or about 

January 18, 2007 through September 15, 2015. 

21. On or about October 31, 2019, CBP officials conducted an inspection of 

IBEKIE at the Chicago O'Hare International Airport ("O'Hare'') upon his arrival into 

11 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 48 of 231 PageID #:56
the United Sates, as discussed further in Section III.E. During the inspection, 

IBEKIE had a Samsung SM-G965V phone in his possession utilizing phone number 

(630) XXX-494 7 ("Subject Phone 5"). T-Mobile records identified SAMTONI Medical 

Equipment Inc (discussed further in Section 111.B.4) at the Alyssa Premises as the 

subscriber for Subject Phone 5. 

3. Lasheena Washington (''WASHINGTON") 

22. WASHINGTON is a United States citizen, who, according to commercial 

databases, driver's license information, personal bank statements, and physical 

surveillance, resides at 673 Hearth Lane, Apartment 209 in Carol Stream, Illinois. 

23. Documents filed with the USCIS list WASHINGTON as ANIUKWU's 

spouse and joint sponsor of ANIUKWU's application for permanent residence in the 

United States. The documents further state that WASHINGTON and ANIUKWU 

were married in DuPage County on or about May 20, 2016. 

24. A Form 864, Affidavit of Support filed with the USCIS in the name of 

WASHINGTON, dated on or about November 12, 2016, lists IBEKIE as 

WASHINGTON's brother-in-law. Further, a lease agreement executed by IBEKIE, 

ANIUKWU, and WASHINGTON, dated on or about January 2, 2017, and filed with 

the USCIS reflects that IBEKIE is the putative owner of the Lincoln Premises, with 

ANIUKWU and WASHINGTON as IBEKIE's tenants. 

25. According to DuPage County court records, on or about April 17, 2019, 

IBEKIE stipulated to being the father of WASHINGTON's son in the course of a 

paternity lawsuit filed by WASHINGTON against IBEKIE in Case No. 2018F640. 

12 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 49 of 231 PageID #:57
4. Williette Asanji ("ASAN JI") 

26. ASANJI is a naturalized United States citizen, originally a citizen or 

national from Cameroon, who, according to filings with the USCIS, commercial 

databases, driver's license information, and personal bank statements, resides at 

2084 Mark Circle, in Bolingbrook, Illinois. 

27. On or about October 18, 2017, Naperville Police Department officers 

conducted a traffic stop of IBEKIE, who was driving a 2008 black Mercedes, bearing 

a temporary Texas license plate. During the stop, IBEKIE told officers that he 

purportedly lived in Wisconsin, that he had purchased the vehicle in El Paso, Texas, 

and that his ex-wife resided at the Lincoln Premises. 

28. Through a database check, officers found that the temporary Texas 

license plate, as well as the insurance card and vehicle title that IBEKIE provided, 

were not valid, and that the car was actually registered to ASANJI. Upon being 

confronted with this information, IBEKIE admitted to the officers that the car, in 

fact, belong to ASANJI, whom IBEKIE purportedly paid for its use. 

29. A search of law enforcement databases reflects a black, 2008, four-door, 

Mercedes bearing the same vehicle identification number as the vehicle driven by 

IBEKIE during the above incident was registered in the name of ASANJI, with plate 

455508, until about October 2018. No current registration was found for the vehicle. 

5. Treonda Steadman ("STEADMAN") 

30. STEADMAN is a United States citizen, who, according to commercial 

databases, driver's license information, and physical surveillance, resides at 16512 

13 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 50 of 231 PageID #:58
South Mueller Circle, in Plainfield, Illinois. Documents filed with the USCIS reflect 

that STEADMAN and IBEKIE have two children together. 

31. As previously mentioned in Section III.A.2, documents filed with the 

USCIS indicated that STEADMAN was married to IBEKIE from on or about January 

18, 2007 through September 15, 2015. 

6. Lawrence Berry III ("BERRY'') 

32. BERRY is believed to be a United States citizen, who, according to 

records obtained from the Lisle Police Department, was a former tenant at the 

Lincoln Premises. 

33. In a letter filed with the USCIS, dated on or about October 2, 2017, 

BERRY purports to be the property manager for the building located at the Lincoln 

Premises, listing Subject Phone 1 (i.e., the same number listed as IBEKIE's contact 

number in IBEKIE's own Application for Naturalization) as BERRY's contact 

number. In this letter, BERRY further represents that ANIUKWU and 

WASHINGTON have been tenants at the Lincoln Premises since 2017. 

34. On or about January 3, 2018, BERRY filed a report with the Lisle Police 

Department, in which he provided the following information: 

a. In or around August 2017, BERRY entered into a one-year lease 

and moved into the basement of the Lincoln Premises. He was concerned that his 

landlord, IBEKIE, would throw out BERRY's dogs and belongings because BERRY 

failed to pay rent. 

b. According to BERRY, IBEKIE was formerly a doctor in Nigeria, 

who now rented out rooms to his cousins from Nigeria and also acquired and shipped 

14 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 51 of 231 PageID #:59
vehicles to Nigeria for repairs. Further, IBEKIE instructed BERRY to set up personal 

checking and savings accounts to accept money transfers from unknown sources. 

IBEKIE informed BERRY that the funds were being deposited into BERRY's 

accounts in order to keep them hidden from IBEKIE's wife. BERRY was to withdraw 

those funds when instructed, and to provide them to IBEKIE. 

c. BERRY complied with IBEKIE's request to open bank accounts 

out of fear of being evicted, and-according to BERRY's report to officers-IBEKIE 

had previously become physically aggressive with BERRY and threatened him. This 

aggression typically surfaced when BERRY was unable to withdraw funds from the 

accounts that he opened on IBEKIE's behalf. 

7. The Lincoln Premises and its associated business entities 

35. According to open-source research and physical surveillance, the Lincoln 

Premises-IBEKIE's and ANIUKWU's listed residence with the USCIS-is a singlefamily rental residence. 

36. According to a Lisle Police Department record dated on or about October 

27, 2017, IBEKIE reported a home invasion in progress at the Lincoln Premises and 

said that he was locked in a bedroom in the rear of the residence. Officers responded 

to the Lincoln Premises, where they encountered five individuals, including IBEKIE; 

an individual sleeping in the southeast corner of the residence; and an individual 

named "Larry" in the basement. 2 The report indicates that the officers had to make a 

2 Based on my training, experience, and knowledge of this investigation, as well as my 

conversations with other investigators familiar with the facts of this investigation, I believe 

that "Larry" was Lawrence BERRY. 

15 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 52 of 231 PageID #:60
forced entry into a locked bedroom on the first floor of the residence. F:urther, in the 

report, the responding officers concluded that the incident resulted from a 

"misunderstanding that occurred when some guests were invited in the home by a 

resident." 

37. According to Illinois Secretary of State ("ILSOS") records, between on or 

about June 16, 20 15 and April 2, 2019, approximately 14 entities were incorporated 

with the ILSOS reflecting the Lincoln Premises as either the initial registered office 

in the articles of incorporation, or as the principal address for the corporation in other 

filings, including, but not limited to, the following: 

NAME DATE AGENT 

NU-MEKS HEALTHCARE INC. June 17, 2015 IBEIUE (DIRECTOR) 

EMPERORCHILLS INC. June 16, 2017 IBEIUE 

MEI<AS CONSTRUCTION INC. July 12, 2017 IBEKIE 

SAMTONI MEDICAL EQUIPMENT INC. November 1, 2017 ANIUKWU 

GREEN HOUSE FOR FOOD INDUSTRY INC. Decembe r 14, 2017 ANIUKWU SAM UCHE 

GODMEKS INC. Ap ril 13, 20 18 UCHENNA ANI SAMUEL 

HALL & HALL GLOBAL INC. April 13, 20 18 WILLIE'ITE ASANJI 

ESIJEMINE LUCKY NENGITE INC. July 9, 20 18 EMEI<A IBEKIE 

SAMCHINA TRUCKING INC. July 9, 20 18 LASHEENA WASHINGTON 

38. As discussed in Section III.D, on or about May 1, 20 19, investigators 

obtained the trash abandoned outside the curtilage of the Lincoln Premises. In the 

trash, investigators discovered numerous items appearing to belong to IBEKIE and 

ANIUKWU. Based on my training and experience, as well as the experience of other 

law-enforcement officers familiar with the investigation, it appears the occupants of 

the Lincoln Premises moved out sometime in or around April or May, 2019. 

16 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 53 of 231 PageID #:61
B. RECEIPT OF VICTIM FUNDS BY VARIOUS ENTITIES AsSOCIATED WITH 

ANIUKWU, IBEKIE, AND THEIR CO-CONSPIRATORS 

39. ANIUKWU, IBEKIE, and their known and unknown co-conspirators 

incorporated or registered several business entities with the ILSOS, and also created 

individual bank accounts for each entity. In the course of this investigation, agents 

have tied bank accounts for the entities to the receipt of fraudulently obtained funds 

from the victim individuals and victim businesses described herein. These funds were 

obtained, variously, through the use of business-email-compromise, romance-fraud, 

and inheritance-fraud schemes. What follows in Sections III.B.1 through III.B.11 

below is a summary of: (1) the creation of the subject business entities and their 

related bank accounts; (2) the receipt of fraudulently obtained funds by the entities; 

and (3) agents' interviews with victims concerning how they were defrauded. 

1. NU-MEKS Healthcare Inc. 

a. Corporate Formation 

40. On or about June 17, 2015, Nu-Merks Healthcare Inc was incorporated 

with the ILSOS. Later, on or about August 11, 2015, articles of amendment were filed 

with the ILSOS changing the corporation's name to Nu-Meks Healthcare Inc. ("NUMEKS"). Approximately one year later, on or about June 20, 2016, a domestic/foreign 

corporation annual report was filed with the ILSOS listing IBEKIE as a Director and 

Operations Manager for NU-MEKS. The annual report listed NU-MEK's principal 

address as the Lincoln Premises. 

41. A domestic/foreign corporation annual report for NU-MEKS filed with 

the ILSOS on or about June 7, 2017, lists ANIUKWU as a director for NU-MEKS. 

17 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 54 of 231 PageID #:62
The signature line reflects that this report was authorized by IBEKIE in his capacity 

as Director of NU-MEKS. 

42. A notice of resignation of registered agent filed with the ILSOS on or 

about December 19, 2018 reflects that NU-MEKS's principal office address is 790 

Royal St George Drive, Suite 141 #111, in Naperville, Illinois. Based on open-source 

research and agent surveillance, that address appears to be a shipping, mailing, 

printing, and mailbox-rental business inside a shopping center in Naperville, Illinois. 

b. Receipt of Funds from Victim Individual S.K. 

43. Between on or about August 5, 2016 and May 4, 2017, bank accounts 

were opened in the names of both NU-MEKS and Nu-Merks Healthcare Inc at Bank 

of America, TCF Bank, Wells Fargo Bank, and Fifth Third Bank. 3 IBEKIE is listed 

on the signature cards for the accounts as their authorized signer. The NU-MEKS 

account maintained at Bank of America also includes STEADMAN, IBEKIE's exwife, as an authorized signer. 

44. On or about August 5, 2016, a checking account (XXXX XXXX 1017) in 

the name of NU-MEKS was opened at Bank of America. The signature card for the 

account reflects that IBEKIE is the president ofNU-MEKS and the authorized signer 

for the account. 

3 Based on a search of the Federal Deposit Insurance Corporation ("FDIC") online "BankFind" 

database, which allows users to locate FDIC-insured banking institutions, my training and 

experience, my work on other fraud investigations, as well as my conversations with other 

agents experienced in investigating bank fraud, I know that each of these banks is insured 

by the FDIC. 

18 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 55 of 231 PageID #:63
45. On or about November 25, 2016, the above checking account in the name 

of NU-MEKS received an approximately $29,280 wire transfer from JP Morgan 

Chase Bank indicating it was for the benefit of Victim Individual S.K. Bank of 

America later received a Uniform Indemnification Agreement from Fidelity 

Investments, dated on or about November 28, 2016, describing the transfer as an 

"unauthorized transaction(s)" from the account of Victim Individual S.K., and 

requesting the funds from the transfer be blocked. 

46. On or about August 27, 2019, I conducted a telephonic interview with 

Victim Individual S.K., who said that someone purporting to be him/her contacted 

Fidelity Investments via telephone and initiated an approximately $36,600 

withdrawal from his/her retirement account. Victim Individual S.K. stated that s/he 

learned the funds had been transferred from his/her retirement account at Fidelity 

Investments upon returning from vacation in another state. Victim Individual S.K. 

explained the withdrawal from his/her account incurred a fee payable to the Internal 

Revenue Service, resulting in the net transfer to NU-MEKS totaling approximately 

$29,280. Victim Individual S.K. stated s/he is not familiar with NU-MEKS and did 

not authorize the transaction. Victim Individual S.K. also said that Fidelity 

Investments ultimately reimbursed him/her for the withdrawal, sos/he did not incur 

a loss. 

19 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 56 of 231 PageID #:64
2. EMPERORCHILLS 

a. Corporate Formation 

47. On or about June 16, 2017, EMPERORCHILLS was incorporated with 

the ILSOS. Its articles list IBEKIE as the registered agent, and ANIUKWU as a 

director and incorporator. The articles further list the Lincoln Premises as IBEKIE's 

and ANIUKWU's address. 

b. Receipt of Funds from Victim Business B.E.F. 

48. Between on or about June 27, 2017 and June 30, 2017, multiple accounts 

were opened in the name of EMPERORCHILLS at Wells Fargo Bank, BMO Harris 

Bank, JP Morgan Chase Bank, and West Suburban Bank.4 The signature cards for 

the accounts reflect the name ANIUKWU, or what appear to be variations of 

ANIUKWU's name, such as "Uchenna A Samuel" and "Uchenna Samuel Aniukwu," 

as the authorized signer. The signature cards further appear, upon lay inspection, to 

bear the same or similar signatures. 

49. On or about June 30, 2017, a checking account (XXXXXX2298) was 

opened in the name of EMPERORCHILLS at West Suburban Bank. 

50. On or about September 6, 2017, the above checking account in the name 

ofEMPERORCHILLS received an incoming wire from Victim Business B.E.F. in the 

amount of approximately $119,938. A Bank of Oklahoma wire-transfer request, dated 

on or about September 6, 2019, reflects that the wire was conducted on behalf of 

4 Based on a search of the FDIC "BankFind", which allows users to locate FDIC-insured 

banking institutions, my training and experience, my work on other fraud investigations, as 

well as my conversations with other agents experienced in investigating bank fraud, I know 

that each of these banks is insured by the FDIC. 

20 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 57 of 231 PageID #:65
Victim Business B.E.F. and lists a reference to Business C.A. in the "additional 

information" section of the request. 

51. Records obtained from the Bank of Oklahoma include a series of emails 

between representatives of Victim Business B.E.F. and Business C.A. In one email, 

dated on or about August 31, 2017, a representative of Business C.A. informed a 

representative from Victim Business B.E.F. that Business C.A. would no longer be 

receiving payments at a specified Bank of America account, and would be sending the 

representative of Victim Business B.E.F. details for another bank account for a future 

wire. In another email, dated on or about September 1, 2017, the representative of 

Business C.A. provided the representative of Victim Business B.E.F. with the details 

for the EMPERORCHILLS bank account at West Suburban Bank. 

52. Bank of Oklahoma records also include a series of emails between 

representatives of Bank of Oklahoma and Victim Business B.E.F. The emails indicate 

the wire sent to the EMPERORCHILLS account at West Suburban Bank had been 

conducted as a result of fraud and discussed attempts by Bank of Oklahoma to recall 

the funds. 

53. On or about August 13, 2019, agents interviewed representatives of 

Business C.A., including the representative noted in the emails described above. The 

representative explained that Business C.A. sells vehicles to Business J.V.M., to 

whom Victim Business B.E.F. provides lines of credit. The representative explained 

Business C.A. only utilizes an account maintained at Bank of America to receive 

wires. The representative then reviewed the emails described above and informed 

21 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 58 of 231 PageID #:66
investigators s/he did not send the email informing Victim Business B.E.F. that 

Business C.A. would no longer be receiving wires at the Bank of America account. 

The representative stated that s/he also did not send the email providing Victim 

Business B.E.F. with the details for the EMPERORCHILLS account at West 

Suburban Bank. Further, the representative informed investigators that information 

technology personnel at Business C.A. found his/her email had been hacked, and 

immediately terminated use of the email account. 

54. West Suburban Bank records reveal four checks were negotiated from 

the EMPERORCHILLS bank account on or about September 6, 2017, the same day · 

that account received the wire from the Bank of Oklahoma. The checks, sequentially 

numbered from 1226 to 1229, were made payable to "Aniukwu Samuel." Upon lay 

inspection, the same or similar signature as is seen on the signature card for the 

EMPERORCHILLS bank account appears on the signature and endorsement lines 

on the front and back of each check. 

55. Checks 1226 and 1227, each in the amount of approximately $9,500, 

were negotiated at the West Suburban Bank branch located at 1296 East Chicago 

Avenue, in Naperville, Illinois at approximately 11:54 a.m. and 12:05 p.m., 

respectively. Photos obtained from bank-security cameras appear to show ANIUKWU 

and IBEKIE (whose known photographs I have reviewed in law-enforcement 

databases) at the counter during the timeframe of the transactions. 

22 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 59 of 231 PageID #:67
56. Check 1228, in the amount of approximately $9,300, was negotiated 

approximately four miles away at the West Suburban Bank branch located at 2020 

Feldott Lane, in Naperville, Illinois, at approximately 12:37 p.m. 

57. Lastly, Check 1229, in the amount of approximately $9,600, was 

negotiated approximately 12 miles away from the Feldott Lane branch, at the West 

Suburban Bank branch located at 295 West Loop Road in Wheaton, Illinois, at 

approximately 1:08 p.m. 

58. Based on my training and experience, I am aware that federal law 

typically requires financial institutions to report currency (meaning, cash or coin) 

transactions over $10,000 conducted by, or on behalf of, one person on a FinCEN 

Form 104, Currency Transaction Report ("CTR"). Further, based on my training and 

experience, I am aware that individuals trying to avoid these reporting requirements 

will often break up, or "structure", transactions into smaller amounts falling under 

the $10,000 CTR threshold. 

3. MEKAS Construction Inc. 

a. Corporate Formation 

59. On or about July 12, 2017, Mekas Construction Inc. ("MEKAS") was 

incorporated with the ILSOS. I ts articles list IBEKIE as the registered agent with an 

address at the Lincoln Premises, and further identify IBEKIE and ANIUKWU as 

directors for MEKAS, also at the Lincoln Premises. 

b. Receipt of Funds from Victim Business M.W. 

60. On or about September 8, 2017, a checking account (XXXX XXXX 1240) 

and savings account (XXXX XXXX 5920) were opened in the name of MEKAS at Bank 

23 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 60 of 231 PageID #:68
of America. Signature cards for the accounts list ASANJI as the President of MEKAS 

and the authorized signer for the Bank of America accounts. 

61. On or about October 12, 2017, the MEKAS Bank of America checking 

account received a wire transfer from Victim Business M.W. for approximately 

$10,500. 

62. According to Saukville, Wisconsin Police Department ("Saukville PD") 

records, on or about October 13, 2017, Victim Individual R.W., the owner of Victim 

Business M.W., a machinery business in Wisconsin, contacted the Saukville PD and 

reported suffering a loss of funds due to an email compromise. The police report for 

this incident includes the following information: 

a. Victim Individual R.W. explained s/he attempted to contact 

his/her personal banker the previous day to conduct two wire transfers as part of 

his/her business, including one in the amount of $10,500 to Company H.M. The 

personal banker replied to Victim Individual R.W., advising him/her that Company 

H.M.'s bank did not accept wire transfers and that Victim Individual R.W. would have 

to reach out to Company H.M. and find an alternate bank to transfer the funds. 

b. Victim Individual R.W. forwarded the email from the personal 

banker to a person s/he believed was the owner of Company H.M., however, the email 

was directed to an email address ending in@contractor.net, instead of actual email 

for the owner of Company H.M., ending in@comcast.net. The receiver of the email 

responded and provided Victim Individual R.W. with information for Bank of America 

account (XXXX XXXX1240) in the name ofMEKAS. 

24 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 61 of 231 PageID #:69
c. Only later, after receiving an email from the owner of Company 

H.M. inquiring about the payment, Victim Individual R. W. discovered the emails had 

been spoofed and immediately attempted to recall the transaction through his/her 

bank. Upon further inquiries with Victim Business M.W.'s email-hosting service, 

Victim Individual R.W. learned that an unauthorized mail forwarder had been 

installed on his/her emails, which were being forwarded to 

mohit29032930@gmail.com. Subscriber information for the account indicates 

mohit29032930@gmail.com was registered in the name of Shailendra Singh on or 

about July 08, 2017, with a recovery email of anil.hospineed@gmail.com, and a 

Nigerian phone number +234XXXXX99944. 

c. Receipt of Funds from Victim Individuals J.B. and 

S.B. 

63. On or about October 10, 2017, a checking account (XXXXXX2982) and 

savings account (XXXXXX:2045) were opened in the name of MEKAS at Wells Fargo 

Bank. Signature cards reflect ASANJI as the authorized signer on the Wells Fargo 

accounts. The following day, on or about October 11, 2017, a checking account 

(XXXXX3508) and savings account (XXXXXX0882) were opened in the name of 

MEKAS at JP Morgan Chase Bank. Signature cards list BERRY as the president of 

MEKAS and the authorized signer for these JP Morgan Chase accounts. 

64. On or about October 31, 2017, the MEKAS JP Morgan Chase checking 

account received a wire transfer from Victim Individual J.B. for approximately 

$6,405. 

25 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 62 of 231 PageID #:70
65. On October 21, 2019, I conducted a telephonic interview with Victim 

Individual J.B., who said thats/he was contacted regarding a purported relative who 

passed away in Canada and left behind an inheritance. Victim Individual J.B. 

indicated s/he entered into an agreement with a banker to obtain the inheritance 

funds in return for a 50% fee. Victim Individual J.B. did not recognize the name 

MEKAS, but explained that his/her spouse, Victim Individual S.B., had 

documentation related to the transaction, and would be able to provide additional 

information. 

66. Thereafter, I conducted a telephonic interview with Victim Individual 

S.B. and learned the following: 

a. Victim Individual S.B. was aware that his/her spouse, Victim 

Individual J.B., had fallen victim to a fraudulent scheme related to a letter addressed 

from an individual purportedly named Jean EMMANUEL. 

b. The $6,405 wire transfer to MEKAS was a payment related to a 

retainer agreement with Pierre DELOUIS, a putative attorney with the law firm Hall 

and Hall Chamber, to whom Victim Individual J.B. had been referred in connection 

with the alleged inheritance. Victim Individual S.B. explained, however, that s/he 

and his/her spouse thought it was odd that the payment was going to a construction 

company. 

67. Victim Individuals S.B. and J.B. had retained copies of emails sent by 

Victim Individual J.B. to others related to the supposed inheritance. When Victim 

Individual S.B. began looking into names and addresses from the communications 

26 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 63 of 231 PageID #:71
related to the inheritance with Victim Individual J.B.'s secretary, many of the 

addresses were associated with empty lots, and there appeared to be no information 

related to the other named individuals. 

68. After making the initial $6,405 payment to MEKAS for the retainer 

agreement with putative attorney DELO UIS, Victim Individual J.B. was asked to 

make an additional payment. In response, Victim Individual J.B. said s/he did not 

have immediate funds to make the payment and purposely created delays with the 

individuals with whom s/he was communicating. These communications lasted from 

approximately mid-October 2017 through mid-November 2017. 

69. The couple was never reimbursed for the payment and sustained a loss 

of in the amount of $6,405, corresponding to the wire-transfer made to MEKAS. 

70. Victim Individual S.B. provided me with emails between Victim 

Individual J.B. and jeanemmanuel619@gmail.com, ued@tdcanadagroup.com, and 

pdelouis@hallhallchamber.com, related to the supposed inheritance, including a 

Confidentiality and Trust Agreement between Victim Individual J.B. and 

EMMANUEL, dated on or about October 24, 2017, an Attorney Retainer Agreement 

from Barrister DELO UIS of Hall and Hall Chamber in Toronto, Canada, dated on or 

about October 30, 2017, and an Inheritance Claim Approval Letter from TD Canada 

Trust in Toronto Canada, dated on or about November 1, 2017. 

d. Receipt of Funds from Victim Individual D.J. 

71. On or about November 21, 2017, a checking account (XXXXXX5981) was 

opened in the name of MEKAS at TCF Bank. The signature card for this account 

reflects IBEKIE as the authorized signer. 

27 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 64 of 231 PageID #:72
72. On or about December 11, 2017, a complaint was filed with the Federal 

Bureau of Investigation ("FBI") Internet Crime Complaint Center ("!CCC") in the 

name of Victim Individual D.J., who reported falling victim to a romance scam 

resulting in a loss of approximately $150. In the complaint, Victim Individual D.J. 

described applying for emergency leave for a Captain Steven Kelvin CL.ARK, who was 

utilizing email addresses captainclark@yahoo.com and stevenclarky2010@gmail.com, 

and who was purported to have been stationed in Kabul, Afghanistan with the United 

States Military. Additionally, Victim Individual D.J. provided the text of an email 

purported to have been sent from the United States of America Joint Force with 

North Atlantic Treaty Organization-Afghanistan Keeping Base, United States 

Military International Leave Board. The email, sent from unitedstatesarmydepartmentofemergencyleave@outlook.com, requested that Victim Individual D.J. 

send $1,150, $2,300, or $4,000, depending on the length of emergency leave requested, 

to the MEKAS TCF Bank account, with the Lincoln Premises noted as the beneficiary 

address. 

73. On or about August 7 and August 21, 2019, I conducted telephonic 

interviews with Victim Individual D.J., who confirmed s/he filed the above-described 

complaint and stated the information therein was correct. Victim Individual D.J. 

explained thats/he initially met the individual purporting to be CLARK via Facebook 

and corresponded with CLARK for approximately two to three months via Google 

Hangouts. Victim Individual D.J. said that CLARK initially asked for Apple iTunes 

cards to listen to music. On or about November 12, 2017, Victim Individual D.J. 

28 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 65 of 231 PageID #:73
purchased an iTunes card in the amount of approximately $50 through Amazon.com 

for CLARK. When CLARK claimed that the code for the iTunes card did not work, 

Victim Individual D.J. contacted Amazon.com, who sent a replacement card in the 

amount of approximately $50 on or about November 23, 2017. Victim Individual D.J. 

purchased a second iTunes card for CLARK via Amazon.com on or about December 

2, 2017. In response to receiving this iTunes card, CLARK tersely replied: "That's all 

you can do?" Victim Individual D.J. explained s/he became aware the communications 

from CLARK were not legitimate afters/he received a request from CLARK to marry 

him, as well as a request to pay for his leave within a short time frame. To that end, 

CLARK informed Victim Individual D.J. that he no longer had any family in the 

United States, and that Victim Individual D.J. marrying him would be the only way 

he would be able to take leave. Victim Individual D.J. stated s/he never sent funds 

for CLARK to the account in the email listed in his/her complaint, and that Victim 

Individual D.J. stopped further communications with CLARK. 

4. SAMTONI Medical Equipment 

a. Corporate Formation 

74. On or about November l, 2017, SAMTONI Medical Equipment Inc 

("SAMTONI") was incorporated with the ILSOS. Its articles list ANIUKWU as the 

registered agent with an address at the Lincoln Premises. 

29 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 66 of 231 PageID #:74
b. Receipt of Funds from Victim Individual C.B. 

75. On or about November 8, 2017, a checking account was opened at US 

Bank in the name of SAMTONl.5 A Resolution of Corporation for the US Bank 

account lists "Uchenna Samuel Aniukwu" as the owner of SAMTONI. Further, on or 

about November 17, 2017, a checking account (XXXXX7952) was opened at JP 

Morgan Chase Bank in the name of SAMTONI. The signature card for the JP Morgan 

Chase account lists "Tony Emeka Ibekie" as the president of SAMTONI. 

76. On or about, November 21, 2017, a TCF Bank account (XXXXXX5980) 

was opened in the name of SAMTONI. The signature card for the account lists 

IBEKIE as the authorized signer. This account was opened on the same day as a TCF 

BANK account (XXXXXX5981) in the name of MEKAS, which-as described abovealso listed IBEKIE as the authorized signer. Further, the signature card for the 

SAMTONI TCF Bank account reflects the same business address (at 790 Royal St 

George Drive, Suite 141, in Naperville, Illinois) as listed in the Notice of Resignation 

for NUMEKS that was filed with the ILSOS on or about December 19, 2018. 

77. On or about December 11, 2017, the SAMTONI TCF Bank account 

received a wire transfer from Victim Individual C.B. for approximately $45,000. 

78. On or about August 5 and August 13, 2019, I conducted telephonic 

interviews with Victim Individual C.B., who said the above transfer was related to 

transactions s/he initially believed to have been an investment in Dubai, but now 

5 Based on a search of the FDIC "BankFind", which allows users to locate FDIC-insured 

banking institutions, my training and experience, my work on other fraud investigations, as 

well as my conversations with other agents experienced in investigating bank fraud, I know 

that US Bank is insured by the FDIC. 

30 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 67 of 231 PageID #:75
believes possibly involved Nigerian nationals utilizing the pictures of others online. 

In relevant part, Victim Individual C.B. provided the following information, as well 

as relevant emails s/he exchanged, which allowed investigators to learn the following: 

a. Victim Individual C.B. met an individual purportedly named 

Diego DARIO through Facebook and began communicating with him over an 

approximately six-month period. Victim Individual C.B. provided investigators with 

copies of email communications s/he exchanged with DARIO, as well as others related 

to the a hove transaction. 

b. In emails between Victim Individual C.B. and others, including 

email addresses: diegodario712@yahoo.com, diegodario611@hotmail.com, 

kamesinvestmentplc@consultant.com, admin@globalancebankonline.com, 

globalancebankonline@swissmail.com, and info@globalance-online.com, DARIO told 

Victim Individual C.B. that he was employed as a consultant fund manager with 

Karnes Investment ("Karnes,,) and was involved in fund-management activities with 

major investors. Sometime after informing Victim Individual C.B. of the alleged 

passing of his mother, DARIO said that he would be traveling to Dubai to conduct a 

final business deal before resigning from Karnes to be with Victim Individual C.B. 

c. During the purported trip in Dubai, DARIO informed Victim 

Individual C.B. that his clients in Dubai wanted to enter into a private partnership 

agreement with DARIO and provide him with a substantial amount of compensation, 

but he could not do so due to an existing agreement with Karnes. DARIO informed 

Victim Individual C.B. that he could only enter into the agreement with his clients in 

31 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 68 of 231 PageID #:76
Dubai by using another person as his representative, suggesting Victim Individual 

C.B. serve as his nominee, to which Victim Individual C.B. agreed. 

d. DARIO, in emails with Victim Individual C.B., said that his 

clients in Dubai compensated him and Victim Individual C.B. through shares of the 

"MEGELLAN" fund managed by Karnes. Victim Individual C.B. instructed Karnes to 

sell the MEGELLAN shares in his/her name, purportedly resulting in the receipt of 

$11,691,464, maintained at Globalance Bank ("Globalance") in Switzerland. 

e. In order to obtain access and be able to transfer the funds, at the 

direction of a purported representative of Globalance, Victim Individual C.B. 

transferred $30,000 to SunTrust Bank account XXXXXXXXX3754 in the name of 

Sparks Concepts LLC in Randallstown, Maryland to open an account at Globalance 

Bank. 

f. After opening the SunTrust Bank account, Victim Individual C.B. 

was later informed by a purported representative of Globalance thats/he needed to 

send an additional Cost of Transfer, or "COT", payment-which s/he understood to 

be a type of transfer tax-in the amount of $117,000, via cashier's check, to the 

SAMTONI JP Morgan Chase account. Victim Individual C.B. attempted, but had 

been unable to, send funds to the above account, because JP Morgan Chase Bank only 

allowed transfers between accounts via wire transfer and not via cashier's check. 

g. Victim Individual C.B. then told DARIO thats/he could only send 

$45,000 towards the COT payment. In response, s/he was directed to send the funds 

32 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 69 of 231 PageID #:77
to the SAMTO NI TCF Bank account, w bile DARIO said that he would purportedly 

send the remaining balance of the $117,000 payment. 

h. Victim Individual C.B. first became aware the transactions were 

fraudulent afters/he was requested to send additional funds by DARIO. At that point, 

Victim Individual C.B. contacted Kames in London and was informed that no person 

named DARIO worked there. A representative at Kames also informed Victim 

Individual C.B. that Kames does "not have a MEGELLAN fund," that it was likely 

that Kames's name had been used fraudulently, and suggested Victim Individual C.B. 

contact his/her local law enforcement. 

79. Victim Individual C.B. also provided agents an email that included a 

photo of an Italian passport in the name of Diego Benco DARIO. A search of lawenforcement databases revealed that the number on the passport in the image was 

associated with an Italian passport issued to a female with a different name. Based 

on my training and experience, as well as my conversations with other investigators 

who have experience with Italian passports, I am aware Italian passports are not 

typically reassigned. The passport in the image provided to Victim Individual C.B. 

reflects an issue date of December 30, 2011, and an expiration date of December 30, 

2021. Yet, based on my training and experience, as well as my conversations with 

other law-enforcement agents who have experience with Italian passports, I am 

aware Italian passports typically expire on the day before the tenth year. Accordingly, 

the proper expiration date for an authentic Italian passport issued on December 30, 

2011 would be December 29, 2021. 

33 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 70 of 231 PageID #:78
5. INNOCORD Inc. 

a. Corporate Formation 

80. On or about November 27, 2017, INNOCORD Inc. ("INNOCORD") was 

incorporated with the ILSOS. Its articles list ANIUKWU as the registered agent and 

incorporator with an address of 1042 Maple Avenue in Lisle, Illinois. 

b. Receipt of Funds from Victim Business F.M. 

81. On or about December 11, 2017, a checking account in the name of 

INNOCORD was opened at JP Morgan Chase Bank. The signature card lists "Sam 

Uche Aniukwu" as the president of INNOCORD and authorized signer for the JP 

Morgan Chase account. Further, on or about February 9, 2018, a checking account 

(XXXXXX1058) in the name of INNOCORD was opened at TCF Bank. The signature 

card lists the Lincoln Premises as the address for INNOCORD and "Sam Uche 

Aniukwu" as the authorized signer for the TCF Bank account. 

82. On or about March 1, 2018, the INNOCORD TCF Bank account received 

a wire transfer from Victim Business F.M. for approximately $36,850. 

83. On or about March 17 and March 28, 2018, law enforcement interviewed 

representatives from Victim Business F.M., who explained Victim Business F.M.'s 

accounting manager received a series of emails from approximately February 26, 

2018 through March 21, 2018, purporting to be from Victim Business F.M.'s fleet 

sales manager, several of which were sent while the sales manager was out of town 

on vacation. The emails requested that the accounting manager make wire payments 

to various bank accounts in the name of different companies. On March 28, 2018, 

Victim Business F.M.'s fleet manager said that an employee confirmed his/her email 

34 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 71 of 231 PageID #:79
had been "hacked" whiles/he was on vacation. Representatives from Victim Business 

F.M. provided law enforcement copies of the emails suspected to be fraudulent, which 

showed the following: 

a. On or about March 1, 2018, Victim Business F.M.'s accounting 

manager received an email purporting to be from Victim Business F.M.'s fleet sales 

manager requesting "$36850" be wired to the INNOCORD TCF Bank account. In 

response, Victim Business F.M.'s accounting manager arranged for the requested 

wire transfer to be executed. 

b. On or about March 1, 2018, the same day the wire transfer was 

deposited in the INNOCORD TCF Bank account, three withdrawals were conducted 

from the account in the amounts of approximately $6,000, $9,500, and $159.99. TCF 

Bank records also showed that on or about March 2, 2018, two withdrawals were 

conducted from the same account in the amounts of approximately $9,700 and $7,000, 

followed by three withdrawals on or about March 5, 2018, in the amounts of 

approximately $5,000, $2,250, and $3,000. Withdrawal tickets received to date for the 

above transactions all appear, upon lay inspection, to reflect ANIUKWU's signature. 

6. GREEN HOUSE For Food Industry Inc. 

a. Corporate Formation 

84. On or about December 14, 2017, Green House For Food Industry Inc. 

("GREEN HOUSE") was incorporated with the ILSOS. Its articles list "Aniukwu Sam 

Uche" as the registered agent and incorporator with an address of "Unit 4" at the 

Lincoln Premises. 

35 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 72 of 231 PageID #:80
b. Receipt of Funds from Victim Individual C.H. 

85. Between December 16 and December 30, 2017, multiple accounts were 

opened in the name of GREEN HOUSE at TCF Bank, Bank of America, and Wells 

Fargo Bank. 

86.. On or about December 16, 2017, a checking account (XXXXXX4960) was 

opened in the name of GREEN HOUSE at TCF Bank. The signature card lists "Sam 

Uche Aniukwu" as the authorized signer on the TCF Bank account. 

87. On or about April 4, 2019 and April 6, 2019, the GREEN HOUSE TCF 

Bank account received wire transfers from Victim Individual C.H. in the amounts of 

approximately $6,405 and $27,725.75, respectively. 

88. On or about May 28, 2019, an investigator conducted a telephonic 

interview with Victim Individual C.H, who said thats/he received a letter via United 

States Postal Service from an individual purportedly named Jean DRAPEAW of TD 

Canada Trust, dated on or about March 7, 2018, informing Victim Individual C.H. 

that an individual had died intestate, leaving behind an unclaimed account 

containing approximately $9.2 million. Victim Individual C.H. said s/he contacted 

DRAPEAW and then began communicating with multiple individuals. Victim 

Individual C.H. said s/he also worked with a lawyer from Hall and Hall Chamber in 

Toronto that was referred to him/her. 

89. Victim Individual C.H. provided investigators with documents and 

emails related to the inheritance referencing jdrapeaw@gmail.com, 

ued@tdcanadagroup.com, and pdelouis@hallhallchamber.com. The email and 

documents listed several phone and fax numbers, including: 419-XXX-2688 and 416-

36 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 73 of 231 PageID #:81
XXX-1513 for TD Canada Trust; and 416-XXX-9012 and 416-XXX-5611 for Hall and 

HALL Chamber. 

90. The documents provided by Victim Individual C.H. included the initial 

letter s/he received, in which DRAPEA W offered to present Victim Individual C.H. as 

the deceased' s next of kin and beneficiary of the account in return for a share of the 

funds. The documents also included an Attorney Retainer Agreement referencing 

Pierre DELOUIS, a purported attorney with the firm Hall and Hall Chamber in 

Toronto, Canada (the same putative attorney and law firm used to defraud Victim 

Individual J.B., through MEKAS's bank account, as noted in Section III.B.3.c, above). 

91. On or about October 23, 2019, I spoke with Victim Individual C.H., who 

said that the $6,405 s/he sent to GREEN HOUSE was purportedly payment for half 

of the legal fees related to the inheritance, which were to be split with DRAPEAW. 

Further, Victim Individual C.H. saids/he became suspicious about the inheritance 

when additional payments kept being asked of him/her. Victim Individual C.H. 

realized the inheritance was fraudulent after hearing something in the background 

during a phone call with DRAPEA W that made him/her suspicious. Victim Individual 

C.H. could not recall what had been said, but said that after the phone call, in the 

course of researching the names and companies related to the inheritance, s/he found 

information for a DRAPEAW, with a slightly different spelling, reflecting a different 

picture than a license photo that DRAPEAW provided to him/her. 

c. Receipt of Funds from Victim Business F.M. 

92. On or about December 18, 2017, two checking accounts (XXXX XXXX 

2530, and XXXX XXXX 2921) in the name of GREEN HOUSE were opened at Bank 

37 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 74 of 231 PageID #:82
of America. The signature cards list ANIUKWU as the president of GREEN HOUSE 

and the authorized signer for both Bank of America accounts. 

93. On or about February 27, 2018, GREEN HOUSE Bank of America 

account (XXXX XXXX 2921) received a wire transfer from Victim Business F.M., for 

approximately $14,850. 

94. As previously described in Section III.B.5.b, above, Victim Business 

F.M.'s representatives informed investigators that Victim Business F.M.'s accounting 

manager received a series of emails purporting to be from Victim Business F.M.'s 

fleet sales manager. One of the emails, received on or about February 26, 2018, stated: 

I need your help. We seem to have an overdue invoice i forgot to 

forward it to you before I leave,please wire USD 14850 to this 

account below.i'll forward support document later on. i appreciate 

if you can handle it be{ ore bank cut off time.I cant take calls now 

so email correspondence will be fine. 

95. The foregoing email also provided the banking information for GREEN 

HOUSE Bank of America account (XXXX XXXX 2921). As previously described in 

Section III.B.5.b, above, Victim Business F.M.'s representatives told agents that the 

fleet sales manager was out of the office during the time of the transaction and did 

not send the emails requesting the transfer of funds to Bank of America account in 

the name of GREEN HOUSE. Rather, the above transaction information appears to 

have been sent by a compromised business email account. 

38 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 75 of 231 PageID #:83
d. Receipt of Funds from Victim Individual K.D. 

96. On or about February 27, 2018, one GREEN HOUSE Bank of America 

account received a counter credit in the form of a check from Victim Individual K.D ., 

for approximately $38,200, with the notation, "Yellow Tag." 

97. On or about May 4, 2018, the ICCC received a complaint from Victim 

Individual K.D. who reported falling victim to an online-fraud scheme while trying to 

assist a purported U.S. Army member by the name of Siegel CLARK, using the email 

clarkseigel@gmail.com, (a similar putative soldier as used to defraud Victim 

Individual D.J. through MEKAS's bank account, as discussed above in Section 

111.B.3.d, above) return home from Afghanistan. Victim Individual K.D. reported that 

s/he was instructed to pay the $38,200 for CLARK's "yellow tag" with England 

Customs. Victim Individual K.D. reported s/he transferred $38,200 into an account 

ending in 2921. Later, Victim Individual K.D. found out thats/he had been victimized 

upon performing a reverse image search on a website dedicated to exposing instances 

of fraud and observing that an image of CLARK had been used to victimize another 

individual, this time using the name Aiden CLARK. Victim Individual K.D. reported 

that s/he lost approximately $50,000 as a result of the fraud. 

98. Victim Individual K.D. attached the text of two emails s/he received to 

the ICCC complaint. The first, purportedly from the United States of America Joint 

Force with North Atlantic Treaty Organization-Afghanistan Keeping Base United 

States Military International Leave Board, requested payment in the form of Western 

Union or MoneyGram transfers to "Deborah Tyler" at 137 Largen Street in Virginia. 

The second, purportedly from England Customs, requested a payment of 

39 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 76 of 231 PageID #:84
approximately $38,200 to release CLARK and gold/precious stones in CLARK's 

possession from custody. The email instructed the payment be made to a BMO Harris 

Bank in Munster, Indiana, into account XXXXXX3614 in the name of Anthony 

IBEKIE with an address at the Lincoln Premises. 

99. Subscriber records for clarkseigel@gmail.com indicate that the account 

was registered in the name of Clark Siegel on or about June 26, 2013, using Great 

Britain telephone number XXXXXXXX:4742. 

100. On or about August 6, 2019, I conducted a telephonic interview with 

Victim Individual K.D., who acknowledged filing the above ICCC complaint. Victim 

Individual K.D. said s/he initially met CLARK through the dating site Match.com 

and communicated with CLARK through Google Hangouts. Further, s/he received 

images from CLARK of gold and rare gems purportedly recovered from the Taliban 

and ISIS during his deployment abroad. Victim Individual K.D. received an email 

requiring payment for CLARK's flight since CLARK was not scheduled to receive 

leave. Victim Individual K.D. also explained s/he later received an email purporting 

to be from England Customs, which stated thats/he needed to pay $38,200 to release 

CLARK. Victim Individual K.D. was unable to wire funds, so all of the funds s/he 

transferred on behalf of CLARK were deposited into accounts maintained at Bank of 

America. Additionally, Victim Individual K.D. kept being asked for money, when 

CLARK later purportedly ended up in Mexico and needed funds for another tag. In 

total, Victim Individual K.D. estimated that s/he lost approximately $80,000 as a 

result of the scheme. 

40 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 77 of 231 PageID #:85
7. HALL & HALL Global Inc. 

a. Corporate Formation 

101. On or about April 13, 2018, Hall & Hall Global Inc. ("HALL & HALL") 

was incorporated with the ILSOS. Its articles list ASANJI as the registered agent 

and "Uchenna Ani Samuer' as the incorporator, both with an address of"Unit IA" at 

the Lincoln Premises. 

b. Receipt of Funds from Victim Business V.M.C. and 

Victim Individuals R.U. and V.M. 

102. On or about April 16, 2018, an account (XXXXXX3717) was opened in 

the name of HALL & HALL at TCF Bank. The signature card lists "Asanji P Willette" 

ASANJI as the authorized signer for the TCF Bank account. The same day, on or 

about April 16, 2018, a checking account (XXXXXX5950) and savings account 

(XXXXXX2312) were opened in the name of HALL & HALL at JP Morgan Chase 

Bank. The signature cards list ASANJI as the president of HALL & HALL and 

authorized signer for the JP Morgan Chase accounts. 

103. On or about April 25, 2018, the HALL & HALL TCF Bank account 

received a wire from Victim Business V.M.C. for approximately $6,405. A few days 

later, on or about May 1, 2018, the account received another wire from Victim 

Business V.M.C. for approximately $22,962.75. Then, on or about May 4, 2018, the 

Hall JP Morgan Chase savings account received a wire in the amount of 

approximately $125,000 from Victim Business V.M.C. 

41 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 78 of 231 PageID #:86
104. On or about October 15, 2019, agents contacted Victim Individual V.M, 

who said that his/her spouse, Victim Individual R.U., handles the finances related to 

Victim Business V.M.C. 

105. On or about October 15, 2019, I conducted a telephonic interview with 

Victim Individual R.U., who said thats/he had received a letter via the United States 

Postal Service sometime in or around early-April 2018, from an individual purporting 

to be named Fred LOOKAS of TD Canada Trust, regarding an individual with the 

same last name as Victim Individual R.U. who allegedly passed away in Canada and 

left behind an inheritance. Victim Individual R.U., whose grandfather had been from 

Canada, explained that s/he was instructed to send funds in order to obtain the 

inheritance, allegedly worth $11 million, or else the funds would be turned over to 

the government of Canada. 

106. Victim Individual R.U. also said that as part of the process to obtain the 

inheritance, s/he was referred to an attorney in Canada named Pierre DELOUIS of 

the firm Hall and Hall Chamber (the same putative attorney and law firm used to 

defraud Victim Individuals J.B. and C.H., as noted in Sections I.B.3.c and I.B.6.b, 

above). Victim Individual R.U. said the payment to the HALL & HALL TCF Bank 

account for $6,405 constituted a payment to retain the services ofDELOUIS, and that 

s/he believed the payment in the amount of $22,962.75 was possibly for additional 

attorney fees. Victim Individual R.U. saids/he was also required to make a payment 

in the amount of $125,000 to settle a purported lien on the alleged inheritance. 

42 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 79 of 231 PageID #:87
107. Further, Victim Individual R.U. said s/he was informed the payments 

were being made into an account in Illinois in order to avoid having to pay a tax on 

the transaction. But Victim Individual R. U. became suspicious of the numerous 

payments required to obtain the inheritance and-after attempting to verify the 

individuals and entities with whom s/he was communicating-Victim Individual R.U. 

discovered the phone numbers and addresses provided to him/her did not appear 

legitimate. After s/he confronted the individuals involved in the transaction, Victim 

Individual R.U. recalled thats/he was contacted by an individual with a slight accent 

who threatened to turn Victim Individual R.U. into the authorities for fraud. 

108. Victim Individual R.U. provided me email communications and 

documents s/he exchanged with fredlookas@gmail.com, ued@tdcanadagroup.com, 

and pdelouis@hallhallchamber.com, which included attachments sent to Victim 

Individual R. U. with wire instructions for US Bank account (XXXXXXX5229) in the 

name of GODMEKS INC (a fraudulent entity discussed further below in Section 

III.B.8), TCF Bank account XXXXX5980 in the name of SAMTONI (a fraudulent 

entity discussed further above in Section 111.B.4), and TCF Bank account 

XXXXXX:3717 in the name of HALL & HALL. Also included in the emails were 

attachments purporting to be receipts of international money transfers from 

LOOKAS to Bank of America accounts XXXXXXXX4851 and XXXXXX:3717 in the 

name of HALL & HALL, JP Morgan Chase Bank account XXXXXX:2312 in the name 

of HALL & HALL, and TCF Bank account XXXXXX:5980 account in the name of 

SAMTONI. 

43 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 80 of 231 PageID #:88
c. Receipt of Funds from Victim Business G.F.E. 

109. On or about May 1, 2018-the same day that Victim Individual R.U. 

sent a wire transfer for approximately $22,962.75 to HALL & HALL TCF Bank 

account XXXXXX3717-that same TCF Bank account received a wire transfer from 

Victim Business G.F.E. for approximately $50,000. 

110. On or about October 11, 2019, I conducted a telephonic interviewed 

Victim Business G.F.E's representative, C.G., who said that Victim Business G.F.E 

purchases and sells used printing equipment. C.G. further said s/he was in the 

process of sending a refund to a customer of Victim Business G.F.E., when s/he 

received an email purporting to be from a representative of the customer requesting 

the funds be sent to another account. The email appeared to be legitimate to C.G., 

who complied with the request. Upon later learning the customer never received the 

refund, C.G. tried to stop the transaction through Victim Business G.F.E's bank, but 

was informed that the funds had already been withdrawn. C.G. filed reports with the 

Green Bay Police Department and on an online fraud complaint center. 

111. C.G. provided investigators with a series of emails related to the above 

transaction. One of the emails, dated on or about May 1, 2018, stated the following: 

Please send the wire transfer to below account details, Please note that we have 

stopped payment in our previous bank account, this is due to the fact that we 

have been charged high tax, therefore for now we are currently using our 

production bank account as stated below. 

TCFBANK 

ACCT NAME: HALL & HALL GLOBAL INC 

ROUTING NO: 271972572 

ACCT NO:XXXXXX3717 

BANK ADDRESS: 1156 MAPLE STREET NAPERVILLE ILLINOIS 

60540 

44 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 81 of 231 PageID #:89
Please try and have it done today and. 

Thank you[.] 

112. A review of bank records for the above HALL & HALL TCF Bank 

account shows that on or about May 1, 2019-the same day the account received the 

wires from Victim Individual R.U. and Victim Business G.F.E-an approximately 

$70,460 withdrawal was made. A copy of the withdrawal ticket bears ASANJI's name 

and shows that approximately: (1) $9,900 was withdrawn in cash (just $100 under 

the $10,000 CTR threshold for FinCen); (2) $21,720 was withdrawn as a check made 

payable to ASANJI; and (3) $38,840 was withdrawn as a check made payable to 

HALL&HALL. 

8. GODMEKS Inc. 

a. Corporate Formation 

113. On or about April 13, 2018, the same day HALL & HALL was created, 

GODMEKS Inc. ("GODMEKS") was incorporated with the ILSOS. Its articles list 

"U chenna Ani Samuel" as the registered agent and incorporator, with an address of 

"Unit IA" at the Lincoln Premises. 

b. Receipt of Funds from Victim Individual D.P. 

114. Between on or about May 2, 2018 and May 8, 2018, checking accounts 

were opened in the name of GODMEKS at US Bank, JP Morgan Chase Bank, TCF 

Bank, and BMO Harris Bank. Signature cards for the GODMEKS accounts at US 

Bank, JP Morgan Chase Bank, and TCF Bank list "Uchenna Samuel" as the 

authorized signer, while the signature card for the GODMEKS account at BMO 

Harris Bank lists "Samuel Uchenna" as the authorized signer. 

45 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 82 of 231 PageID #:90
115. On or about June 25, 2018, the GODMEKS JP Morgan Chase account 

received a wire transfer from Victim Individual D.P. for approximately $45,925.75. 

116. On or about August 29, 2019, investigators interviewed Victim 

Individual D.P. who saids/he received an email in March of 2018, addressed from a 

Jean MOREAU of TD Canada Trust Bank, informing Victim Individual D.P. that an 

individual with his/her same surname had died intestate, leaving behind an 

unclaimed account containing approximately $6.9 million. 

117. Victim Individual D.P. previously informed investigators that, in order 

to claim the funds, Victim Individual D.P. was referred to an attorney in Canada 

named Pierre DELOUIS of the firm Hall and Hall Chamber (the same putative 

attorney and law firm used to defraud Victim Individuals J.B., C.H., and R.U., as 

noted in Sections III.B.3.c, III.B.6.b, and III.B. 7 .b, above). Victim Individual D.P. 

further informed investigators s/he sent funds to GODMEKS as part of a payment to 

DELOUIS and Hall and Hall Chamber for services related to the inheritance. 

118. Victim Individual D.P. previously provided investigators with copies of 

documents and emails, including an invoice related to the above payment from Hall 

and Hall Chamber itemizing various legal services totaling $45,925.75, such as: 

-Cost to buy form A 1 and F07-01 at the Probate Registry of the Supreme Court 

of Canada 

-Certificate of Appointment of Estate Trustee without a will 

-Probate Charge 

-Official payment at the High Court of Justice for affidavit of fund claim (Where 

applicant is non Canadian 

-Non-resident tax clearance before the release of certificate 

46 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 83 of 231 PageID #:91
-Our service charge/out of picket expense 

119. Victim Individual D.P. told investigators that DELOUIS contacted 

him/her soon after the wire and directed Victim Individual D .P. to contact the bank 

and recall the funds sent to GODMEKS. Victim Individual D.P. did as DELOUIS 

requested, ultimately receiving back approximately $41,000. DELO UIS later directed 

Victim Individual D.P. via phone to wire the money to a different bank account. 

Victim Individual D.P. said s/he ultimately learned the inheritance was fraudulent 

due to the additional liens and fees that kept being discovered, preventing him/her 

from ever obtaining the funds. Eventually, Victim Individual D.P. contacted a 

number for TD Canada Trust and an individual who answered informed him/her that 

s/he was the third person who inquired about TD Canada Trust. 

120. Victim Individual D.P. previously informed investigators agents that 

s/he had been given two phone numbers to contact during his/her involvement in 

securing the purported inheritance, XXXXXX00051 and XXXXXX89012. On or about 

August 21, 2019, Victim Individual D.P. saids/he recently called both of the numbers 

and th~ same individuals/he recognized as DELOUIS answered both times. 

121. Toll records for Subject Phone 2-which is associated with ANIUKWU 

and NU-MEKS and listed in bank documents for INNOCORD, GREEN HOUSE, 

HALL & HALL, GODMEKS, ESIJEMINE, SAMCHINA, and others noted hereinwas in contact with XXXXXX00051, one of DELOUIS's numbers, approximately 58 

times between on or about February 15, 2018 and April 11, 2018. 

47 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 84 of 231 PageID #:92
9. SAMCORD Inc. 

a. Corporate Formation 

122. On or about June 5, 2018, SAMCORD Inc. ("SAMCORD") was 

incorporated with the ILSOS. Its articles list "Emeka Toni Ibe" as the registered 

agent and incorporator, with an address of 4935 Washington Boulevard, Unit 2, in 

Chicago, Illinois. The name Emeka Toni Ibe appears to be a possible variation of 

IBEKIE's name, reflecting IBEKIE's middle name (i.e., "Emeka"), followed by a 

nickname of IBEKIE's first name (i.e., "Anthony"), and a shortened version of 

IBEKIE's surname. 

b. Receipt of Funds from Victim Individual D.P. 

123. On or about June 6, 2018, a checking account (XXXXXX:5398) in the 

name of SAMCORD was opened at TCF Bank. The signature card lists Emeka Toni 

Ibe as the authorized signer for the account. 

124. On or about June 14, 2018, the SAMCORD TCF checking account 

received a wire transfer from Victim Individual D.P. for approximately $12,810. 

125. As previously described in Section III.B.8.b, above, Victim Individual 

D.P. told investigators that s/he received an email from MOREAU of TD Canada 

Trust regarding a purported inheritance from a deceased Canadian relative. The 

foregoing payment to the SAMCORD TCF checking account represented the initial 

fee to retain the services of putative attorney DELO UIS and Hall and Hall Chamber 

in securing the inheritance. 

48 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 85 of 231 PageID #:93
126. Included among the records that Victim Individual D.P. provided to 

agents was a copy of a letter thanking him/her for the signed retainer agreement with 

Hall and Hall Chamber, which stated: 

... Please see attached our offshore/subsidiary agent account to make the 

payment of the retainer deposit. There is a 19% GST/HST Tax charge 

payable if payment is received in Canada, accordingly, we have waived 

this charge and have provided our offshore agent account for the 

payment to be made without the applicable taxes .... 

Also included in the records received from Victim Individual D .P. were documents 

reflecting details for SAMCORD accounts at TCF Bank and Fifth Third Bank. 

c. Receipt of Funds from Victim Individual A.W. 

127. On or about June 15, 2018, a checking account (XXXX XXXX 5622) in 

the name of SAM CORD was opened at Bank of America. The signature card lists Toni 

Ibe Emeka (another possible variation of IBEKIE's name) as the President of 

SAMCORD. Further, on or about June 25, 2018, a checking account (XXXXXX8376) 

was opened in the name of SAMCORD at Fifth Third Bank. One of the signature 

cards for this account lists IBEKIE as the authorized signer, while a second card lists 

IBEKIE and Jennifer GOSHA as authorized signers. 

128. On or about July 6 and July 9, 2018, the Fifth Third Bank account 

(XXXXXX8376) above received wires from Victim Individual A.W. for approximately 

$9,228.07 and $15,771.93. 

129. On or about October 24, 2018, Victim Individual A.W. filed a complaint 

with the ICCC claiming s/he had fallen victim to a romance scam resulting in a loss 

of approximately $178.030.07. In the complaint, Victim Individual A.W. reported 

49 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 86 of 231 PageID #:94
meeting an individual by the purported name Matthew RUSSO on the online dating 

website OKCupid.com. According to the complaint, RUSSO claimed that he was a 

fund manager with Ventcore Portfolio ("Ventcore") in Kent, England. 

130. Victim Individual A.W. reported RUSSO was going to leave Ventcore 

after the death of his mother and was involved in an arrangement with an individual 

from Dubai, whereby RUSSO was set to receive a substantial sum of funds, but could 

not do so due his employment with Ventcore. So, RUSSO arranged for Victim 

Individual A.W. to be the owner of the shares of approximately $11 million to be 

deposited in a bank in Switzerland. Victim Individual A.W. was required to pay to 

open an account in order to withdraw the funds. Victim Individual A. W. reported 

additional funds were needed to pay the "Cost of Transaction" to move the funds into 

his/her account in the United States, adding that after the payment was made, s/he 

was informed there was a "STOP ORDER" on the funds from the United States 

government. 

131. On or about August 22, 2019, I conducted a telephonic interview of 

Victim Individual A.W., who confirmed s/he filed the complaint and verified the 

information in the complaint was correct. Further, Victim Individual A.W. said that 

s/he had believed s/he was in a relationship with RUSSO, but later came to believe it 

was a scam after his/her brother brought up concerns regarding the transactions. 

Victim Individual A.W. explained s/he confronted the scammers and asked for his/her 

money back. The scammers initially agreed, but required additional funds as part of 

50 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 87 of 231 PageID #:95
the process to return the funds. Victim Individual A.W. estimated s/he lost over 

$267,000 as a result of the scheme. 

10. ESIJEMINE Lucky Nengite Inc. 

a. Corporate Formation 

132. On or about July 9, 2018, ESIJEMINE Lucky Nengite Inc. 

("ESIJEMINE") was incorporated with the ILSOS. Its articles list "Emeka Ibeke" as 

the registered agent at the Lincoln Premises, and Sulamain Adedotun as the 

incorporator at 4306 Nutmeg Lane in Lisle, Illinois. Commercial database searches 

identified an individual by the above name at 4306 Nutmeg Lane, Apt 147, in Lisle, 

Illinois, with a purported social security number of XXX-XX-3184, however, searches 

of law enforcement databases did not identify any information related to the above 

individual. 

b. Receipt of Funds from Victim Individual A.W. 

133. On or about July 11, 2018, a checking account (XXXX XXXX 7376) was 

opened in the name of ESIJEMINE at Bank of America. The signature card lists 

Sulaiman Adedotun as the President of ESIJEMINE. Bank statements for the 

account reflect ESIJEMINE's address as "APT 14 7" at 4306 Nutmeg Lane, in Lisle. 

134. On or about July 17 and July 18, 2018, the ESIJEMINE Bank of 

America checking account received two wire transfers from Victim Individual A.W., 

which totaled approximately $234,401. 

135. As previously described in Section III.B.9.c, above, Victim Individual 

A.W. told agents thats/he believed s/he was sending funds to retrieve approximately 

51 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 88 of 231 PageID #:96
$11 million in his/her name from a bank in Switzerland on behalf of a RUSSO, a 

purported fund manager with Ventcore. 

c. Receipt of Funds from Victim Individual R.A. 

136. On or about July 12, 2018, a checking account (XXXXX2296) and saving 

account (XXXXXX3197) were opened in the name of ESIJEMINE at JP Morgan 

Chase Bank. The signature cards list Adedotun Sulamain as the President of 

ESIJEMINE. 

137. On or about August 23, 2018, the ESIJEMINE JP Morgan Chase 

checking account received a wire transfer from Victim Individual R.A. for 

approximately $6,405. 

138. On or about September 9, 2018, Victim Individual R.A. filed a complaint 

with the !CCC, in which s/he reported having fallen victim to a scam via mail and 

email, resulting in a loss of approximately $6,405. 

139. In the complaint, Victim Individual R.A. reported s/he received a letter 

in July of 2018, addressed from a Chandler ARNAUD of TD Canada Trust Bank, 

informing Victim Individual R.A that an individual bearing his/her last name had 

died intestate, leaving behind an unclaimed account containing approximately $9 

million. Victim Individual R.A. reported s/he was referred to an attorney in Canada 

named Pierre DELOUIS of the firm Hall and Hall Chamber (the same putative 

attorney and law firm used to defraud Victim Individuals J.B., C.H., R.U., and D.P., 

as noted in Sections III.B.3.c, III.B.6.b, III.B.7.b, and III.B.8.b, above). In response, 

Victim Individual R.A. made a $6,405 payment to the ESIJEMINE JP Morgan Chase 

checking account, which represented half of the fee to retain DELOUIS. According to 

52 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 89 of 231 PageID #:97
Victim Individual R.A., s/he was told that it would be best to use a local JP Morgan 

Chase account in Illinois to avoid a "19% GST/HST Tax charge" imposed by Canada. 

140. Victim Individual R.A. reported becoming suspicious after informing the 

persons involved in the supposed inheritance transaction thats/he would travel to 

Canada to open an account and being told, in response, that an account could be 

opened on his/her behalf with only two forms of identification. Thereafter, Victim 

Individual R.A. contacted and spoke with a representative of TD Canada Bank, who 

informed him/her thats/he needed to be physically present to open a bank account. 

Victim Individual R.A. then contacted TD Bank's "unclaimed estate dept" through 

customer service numbers s/he found online and was informed that an account in 

his/her purportedly deceased relative's name did not exist. 

141. On or about August 28, 2019, investigators interviewed Victim 

Individual R.A., who confirmed s/he filed the ICCC complaint and stated that the 

information in it was correct. Victim Individual R.A. also provided agents with copies 

of documents and emails exchanged with ARNAUD and others in the inheritance 

scheme. 

142. The emails and documents provided by Victim Individual R.A. appeared 

to be similar to those provided by Victim Individual R.W. and Victim Individual D.P, 

as evidenced in the following images: 

53 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 90 of 231 PageID #:98
Image sent to Victim Individual R.A. 

Image sent to Victim Individual C.H. 

Or,vcr'sUcenct- ON 

Permi\ dt' conduire C"-'<-'OA 

LOOKAll 

FRED. 

1411-10 WILLOWRIOGE RO 

ETOBICOtCC. ON 1.19A )Y8 

ll187 · 35268 -10215 2017101'1S 

CR5Jll5214 

1,1 

G 

172cm 

Image sent to Victim Individual R.U. 

11. SAMCHINA Trucking Inc. 

a. Corporate Formation 

143. On or about July 9, 2018, SAMCHINA Trucking Inc. was incorporated 

with the ILSOS. Its articles list WASHINGTON and ANIUKWU as incorporators, 

WASHINGTON as the registered agent, and an address at the Lincoln Premises. 

54 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 91 of 231 PageID #:99
b. Receipt of Victim Funds 

144. On or about August 27, 2018, a checking account (XXXXX5841) in the 

name of SAMCHINA was opened at Lisle Savings Bank.6 The signature card lists 

ANIUKWU as the authorized signer for the account. Additionally, a Certification of 

Beneficial Owner of Legal Entity Customers for the account lists ANIUKWU, with 

an address of the Lincoln Premises, as the president of SAM CHINA. 

145. On or about April 22, 2019, demand-deposit account (XXXXXX:7595) in 

the name of SAMCHINA was opened at West Suburban Bank. The signature card 

lists ANIUKWU, with an address of the Lincoln Premises, as the authorized signer 

with Subject Phone 4 as his phone number. Upon lay inspection, the signature on the 

card appears to be different than previous signatures associated with ANIUKWU, 

146. On or about August July 13, 2019, a checking account (XXXXX2331) in 

the name of SAMCHINA was opened at Royal Savings Bank. The signature card for 

the account lists ANIUKWU as the authorized signer with Subject Phone 4 as his 

phone number. 

147. Investigators learned from bank personnel that on or about June 26, 

2019, ANIUKWU deposited a cashier's check for approximately $31,000 into the 

SAMCHINA West Suburban Bank account, which listed Victim Individual M.S. as 

the remitter. After depositing this check, ANIKWU attempted to make a wire 

transfer to Nigeria in the amount of $23,000, for "cleaning containers." Photos 

6 Based on a search of the FDIC "BankFind", which allows users to locate FDIC-insured 

banking institutions, my training and experience, my work on other fraud investigations, as 

well as my conversations with other agents experienced in investigating bank fraud, I know 

that Lisle Savings Bank is insured by the FDIC. 

55 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 92 of 231 PageID #:100
obtained from bank-security cameras appear to show ANIUKWU at the counter 

during the timeframe of the transactions. 

148. On or about June 28, 2019, investigators interviewed Victim Individual 

M.S., who said that s/he sent a cashier's check for $31,000 via FedEx to SAMCHINA 

at the Lincoln Premises, on behalf Jim RICCI, an individual s/he met on the online 

dating website OKCupid.com. Victim Individual M.S. provided investigators with 

access to the email account s/he used to communicate with RICCI. In a series of 

emails, RICCI indicates that he has romantic feelings for Victim Individual M.S. and 

informs him/her of business dealings as a fund manager for Vanguard Investments. 

Through the emails, RICCI tells Victim Individual M.S. that he has negotiated a 

substantial business deal, which will result in him receiving a substantial amount of 

money, but that he needed to utilize Victim Individual M.S's name as a nominee for 

188,572 shares of Vanguard Capital Fund due to an employment clause with 

Vanguard Investments. 

149. Through a series of emails purportedly sent from RICCI, Vanguard 

Investments, and Entrisag Banking AG, Victim Individual M.S. was instructed to 

wire $31,000 to SAMCHINA, described as Vanguard Investments' handling agent in 

Illinois. Victim Individual M.S. was provided with the information for an account in 

the name SAMCHINA at West Suburban Bank. After Victim Individual M.S. was 

unable to wire the funds successfully, RICCI instructed him/her to obtain a cashier's 

check by claiming the funds are for "Payment for purchases," and to send the check 

to SAMCHINA at the Lincoln Premises. 

56 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 93 of 231 PageID #:101
150. After s/he sent the funds, Victim Individual M.S. was instructed that 

s/he needed to make a "Cost of Transfer" payment of $234,000 to process about 

$11,722,464 in proceeds purportedly earned from the sale of the Vanguard Capital 

Fund shares. 

151. Many of the emails from RICCI to Victim Individual M.S. appear to have 

similar, or virtually identical, language to emails from DARIO to Victim Individual 

C.B. (who are discussed further in Section 111.B.4.b, above), as evidenced in the 

excerpts below: 

Email from RICCI to Victim Individual M.S., dated on or about May 24, 2019: 

I have been lucky and traveled through most of Europe and Asia, 

but still want to find time some day to get to Australia and South 

America. I would love to go to Argentina to learn how to do the 

Argentine tango the right way. Do you like to dance? I like to dance, 

like to hold hands, romantic movies are okay by me, and I also like 

documentaries. But I'm willing to explore more and learn new things. I 

reside here in Santa Ana and I am looking forward to meeting you in 

person. [Emphasis added.] 

Email from DARIO to Victim Individual C.B., dated on or about October 10, 

2017: 

I have been lucky and traveled through most of Europe but still 

want to find time some day to get to Australia and South 

America. I would love to go to Argentina to learn how to do the 

Argentine tango the right way. 

Do you like to dance? I used to be pretty good but unfortunately my 

legs cannot do some of the more intricate steps any longer but once a 

week, I still go to the senior dance here locally and absolutely love it. 

[Emphasis added.] 

57 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 94 of 231 PageID #:102
Email from RICCI to Victim Individual M.S., dated on or about June 4, 2019: 

..... You could see how happy my mother was when she saw me. She just 

said what touched my heart "Benco" my son! Where have you been? I 

hope they are not still suffering you with this work? Come let me touch 

your face! Good boy! I can now rest in peace" this was what she said. My 

daughter was already with her in the hospital before i arrived soi am 

very happy to see them all. 

Benco is my second name which is Italian-Spanish. My mother 

love to call me the name as she was the person that gave me the 

name. She said it was the name of the only brother she loved so 

much but died the same year she gave birth to me .... [Emphasis 

added.] 

Email from DARIO to Victim Individual C.B., dated on or about October 18, 

2017: 

.... Benco is my second name which is Italian-Spanish. My mother 

love to call me the name as she was the person that gave me the 

name. She said it was the name of the only brother she loved so 

much but died the same year she gave birth to me .... [Emphasis 

added.] 

C. EVIDENCE OF INTERNATIONAL OUTGOING WIRE TRANSFERS 

152. Agents' review of records associated with the bank accounts described 

herein have revealed numerous wire transfers to accounts outside the United States, 

primarily including those in Nigeria and Ghana. For example, on just fourteen 

accounts at JP Morgan Chase Bank associated with IBEKIE, ANIUKWU, ASANJI, 

BERRY, EMPERORCHILLS, MEKAS, SAMTONI, INNOCORD, HALL & HALL, 

AND ESIJEMINE, agents identified over $1,112,867 in outgoing wire transfers, 

primarily to accounts in Nigeria such as Fidelity Bank PLC in Lagos, to the 

beneficiary Onuigbo IZUCHUKWU. 

58 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 95 of 231 PageID #:103
D. TRASH PULL AT THE LINCOLN PREMISES 

153. On or about May 1, 2019, agents obtained the trash abandoned outside 

the curtilage of the Lincoln Premises. In that trash, agents found numerous relevant 

items of evidence, including what appeared to be a printout of an online bank 

summary, dated on or about February 3, 2017, from Wells Fargo Bank for a business 

checking account ending in 1499, a business market-rate savings account ending in 

4547, an everyday checking account ending in 3694, and a Way2Save savings account 

ending in 4614 appearing to have the balances altered. 

a. Bank records obtained from Wells Fargo establish that on or 

about February 3, 2017, the date noted on the bank summary recovered from the 

trash at the Lincoln Premises, Wells Fargo business checking account ending in 1499 

and business market-rate savings account ending in 454 7 were opened in the name 

NU-MERKS HEALTHCARE INC. Signature cards for both accounts list IBEKIE as 

the authorized signer. 

b. Further, bank records obtained from Wells Fargo Bank establish 

that on or about November 9, 2016, a Wells Fargo everyday checking account ending 

in 3694 and Way2Save savings account ending in 4614 were opened in the name of 

IBEKIE. Bank statements appear to reflect that these accounts were closed on or 

about June 26, 2017, and June 23, 2017, respectively. 

154. During the May 1, 2019 trash pull at the Lincoln Premises, agents 

recovered a second, similarly-altered account summary, dated on or about February 

5, 2017, which listed the following approximate available balances: $500,800 in the 

59 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 96 of 231 PageID #:104
account ending in 1499; $3,486,113 in the account ending in 4547; $2,663,786.62 in 

the account ending in 3649; and $1,862,897.01 in the account ending in 4614. 

155. From the trash, agents also recovered numerous letters addressed to 

various individuals from a John DELON, which were stamped with the logo for TD 

Canada Trust, a financial institution based out of Canada. The letters inform the 

addressee that DELON obtained their contact information while searching for the 

beneficiary of Canadian lottery winnings that had been won by an individual with a 

similar name as each addressee. The letter offered to present the addressee to the 

bank as the winner and to share the funds with the addressee. Further, the letters 

requested each addressee to respond to the email Johnjeandelon@yandex.com with 

his/her their name, address, telephone, and email. 

a. Based on my training and experience, as well as the training and 

experience of other agents with whom I have spoken, I know that Yandex is an 

Internet-services company headquartered in Russia, which maintains servers outside 

the United States. 

156. During the May 1, 2019 trash pull at the Lincoln Premises, agents also 

found ripped up envelopes bearing a return address of Box 707, Wheaton, Illinois 

60187. Based on the information developed in the course of the investigation to date, 

agents are aware that similar letters have been returned to Box 707, Wheaton, 

Illinois, which is the address for the Office of the Circuit Court Clerk for DuPage 

County. Further, agents recovered several papers with handwritten notes, including 

one bearing username "JohnJeanDelon Gmail Account," password "JohnJean5206", 

60 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 97 of 231 PageID #:105
and phone number 312-XXX-6004 ("Subject Phone 6"), and another note listing 

multiple names and phone numbers, including a name with the word "Lottery" next 

to it. Agents subsequently contacted several of the individuals listed in the note, none 

of whom recalled having any involvement with any online schemes or sending funds 

to a bank account in Illinois. 

a. T-Mobile records reflect SAMTONIMEDICALEQUIPMENTINC 

at the Alyssa Premises as the subscriber for Subject Phone 6 from on or about 

February 13, 2019 to June 14, 2019. 

157. Additionally, agents recovered from the Lincoln Premises trash a paper 

bearing the words "Off shore Receiving account" and "Numeks Healthcare INC." The 

paper also included the words "Nigerian Payment Account" with banking information 

for an account in the name of "Onuigbo Izuchukwu" at Fidelity Bank, which-as 

noted Section 111.C, above-was the recipient of many outgoing international wire 

transfers for the bank accounts under investigation in this matter. 

158. Lastly, agents recovered from the trash a T-Mobile document reflecting 

the purchase of two Android phones bearing the phone numbers for Subject Phone 2 

and Subject Phone 3, each in the name of NU-MEKS. Each purchased phone was a 

Samsung Model SM-G955U, the same make and model as the cell phone that CBP 

officers found in IBEKIE's possession during his October 1, 2018 border inspection, 

as described further in Section III .E .1, below. 

61 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 98 of 231 PageID #:106
E. CBP ENCOUNTERS WITH IBEKIE 

1. October 1, 2018 Border Inspection 

159. On or about October 1, 2018, CBP officers conducted an inspection and 

examination of IBEKIE upon his entry into the United States at O'Hare. During the 

border inspection, IBEKIE presented CBP officers with a Wisconsin driver's license, 

which listed his address as the Lincoln Premises. IBEKIE told CBP officers that he 

left the United States on or about August 25, 2018, and had traveled to Nigeria to 

attend the funeral services for his father, who had purportedly passed away in July, 

but whose funeral was scheduled for September 1 through September 5, 2018. 

Further, IBEKIE said that he had visited the Nigerian cities of Lagos, Enugu, and 

Abuja during his trip. 

160. When asked about his current employment, IBEKIE said he worked as 

a registered nurse for NU-MEKS at the Lincoln Premises. But when CBP officers 

inquired why NU-MEKS's address was the same as IBEKIE's home address, they 

noted that IBEKIE had difficulty articulating an answer. IBEKIE informed the CPB 

officials that he owns NU-MEKS, a purported nursing agency, along with his ex-wife 

Treonda STEADMAN. 

161. IBEKIE informed CBP officers that he had been arrested in or around 

April 2018, in Lisle, after having been pulled over for forged license plates while 

driving a friend's car. 

162. CBP officers manually examined a Samsung Model SM-G955U phone in 

IBEKIE's possession in accordance with agency procedures before returning the 

62 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 99 of 231 PageID #:107
phone to IBEKIE. On the phone, CBP officers identified several images of apparent 

financial information, including those reflecting wire transfers to different accounts 

in various names, as well as images reflecting foreign wire transfers to countries 

including Indonesia, Ghana, China, Mexico, and Nigeria. CBP officers also found 

images associating two different addresses with IBEKIE's name: 2084 Mark Circle 

in Bolingbrook, Illinois, and 673 Hearth Lane, Apt 209, in Carol Stream, Illinois. 

2. April 5, 2019 Border Encounter 

163. On or about April 5, 2019, CBP officers encountered IBEKIE at O'Hare 

as he boarded a flight to Dubai, United Arab Emirates. IBEKIE informed the officers 

that he was going on a family trip to Lagos, Nigeria. He also said that he operates a 

money-transfer business called African Money Union, located at the Lincoln 

Premises, and provided officers with the email Africanmoneyunioninc@gmail.com, 

and Subject Phone 5 as his phone number. Further, IBEKIE told the officers that he 

operates a scholarship called the "Anthony lbekie Foundation," which purportedly 

helps underprivileged youth in Nigeria afford school. IBEKIE added that he was 

traveling with approximately $8,740 in cash. 

a. According to 11808 records, African Money Union Inc. 

("AFRICAN MONEY UNION") was incorporated on or about June 23, 2017. Its 

articles list IBEKIE as the registered agent, and IBEKIE and Ngozi Adindu as the 

directors and incorporators. 

b. According to records obtained from BMO Harris Bank, an account 

(XXXXXX3525) in the name of AFRICAN MONEY UNION shows numerous counter 

63 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 100 of 231 PageID #:108
deposits in the form of cashier's checks, which reference IBEKIE and various entities 

associated with the Lincoln Premises, including EMPERORCHILLS, MEKAS, and 

SAMTONI. The records for the account also show numerous cash deposits and cash 

withdrawals, what appear to be personal living expenses, as well as international 

outgoing wire transfers to Nigeria and other locations. 

3. October 31, 2019 Border Encounter 

164. On or about October 31, 2019, CBP officers conducted an inspection and 

examination of IBEKIE upon his entry into the United States at O'Hare. During the 

border inspection, IBEKIE presented CBP officers with a customs-declaration form 

listing the Alyssa Premises as his street address. 

165. IBEKIE had a Samsung SM-G965V device in his possession that was 

using the same phone number as Subject Phone 5. 

166. When asked about his current employment, IBEKIE said he worked as 

a doctor for SAMTONI at the Alyssa Premises." (As noted in 1 160, above, about one 

year earlier, IBEKIE told CBP officials that he worked as a registered nurse for NUMEKS at the Lincoln Premises.) IBEKIE explained he attended medical school in 

Belize. When asked if he was certified to practice medicine in the United States, 

IBEKIE said he assisted in preparing notes that are signed by a certified practitioner. 

F. CBP NOVEMBER 8, 2019 BORDER ENCOUNTER WITH ANIUKWU 

167. Through law enforcement databases, I learned that ANIUKWU had 

departed the United States and was scheduled to arrive at O'Hare International 

64 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 101 of 231 PageID #:109
Airport on or about November 8, 2019, via Air India Flight 127 departing from New 

Delhi, India. 

168. Based on all of the foregoing information described in this affidavitwhich was known to me at the time of the November 2019 border encounter with 

ANIUKWU-I believed that reasonable suspicion existed to support a border search 

of the digital devices in ANIUKWU's possession upon his arrival into the United 

States, and arranged for CBP's assistance to conduct an inspection and examination 

of ANIUKWU upon his arrival to the United States. 

169. On or about November 8, 2019, CBP officers conducted an inspection 

and examination of ANIUKWU upon his entry into the United States at O'Hare on 

Air India Flight 127 from New Delhi, India to determine his admissibility to enter 

the United States. 

170. During the inspection, ANIUKWU presented CBP officers with a 

customs-declaration form listing the Alyssa Premises as his street address. 

ANIUKWU also presented CBP officers with a letter, dated on or about May 24, 2019, 

bearing the letterhead of AFRICAN MONEY UNION, to verify his employment. The 

letter, signed in the name of IBEKIE, extended a job offer to ANIUKWU as a 

"Telephone Customers Service Representative." The letter also listed Subject Phone 

5 as the contact number for both IBEKIE and AFRICAN MONEY UNION. 

171. I was present at O'Hare International Airport while the CPD officers' 

interaction with ANIUKWU was ongoing. During their inspection, CBP officers 

provided me with the customs declaration form and other documents presented by 

65 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 102 of 231 PageID #:110
ANIUKWU. CBP officers also provided me with an Apple MacBook Pro laptop 

(bearing serial number XXXXXXXXHV27) and a Samsung SM-960U Galaxy Note 9 

cell phone using the phone number associated with Subject Phone 4, which were in 

ANIUKWU possession upon his arrival into the United States. I then conducted 

border searches of the digital devices in ANIUKWU's possession upon his arrival into 

the United States pursuant to my authority as a customs officer to conduct searches 

without warrant at the border or its functional equivalent. 7 

1. Border Search of ANIUKWU's Laptop 

172. On or about November 8, 2019, at O'Hare, I reviewed certain data stored 

on the MacBook Pro laptop found in ANIUKWU's possession, in accordance with DHS 

policies and procedures governing border searches of digital devices. During this 

review, I saw that the laptop's email application had information related to accounts 

saniukwul@gmail.com (Subject Account 1) and constantconsultant200@gmail.com 

(Subject Account 2). 

173. Subscriber records subpoenaed from Google-prior to my November 8, 

2019 border search-for Subject Account 1 reflect that the account belongs to 

"Samuel Aniukwu," with a recovery email of grealtand_uc@yahoo.co.uk, and a 

recovery phone number of (XXX) XXX-7040. Further, subscriber records obtained 

from Google-again, prior to my November 8, 2019 border search-for Subject 

7 As stated previously, this affidavit does not cite or rely upon any information obtained 

during the border search of ANIUWKU's cell phone, but rather, only upon information 

obtained during the border search of ANIUWKU's laptop. 

66 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 103 of 231 PageID #:111
Account 2 reflect that the account belongs to "Opia Samuel," with the same recovery 

email as Subject Account 1, and a recovery phone number of Subject Phone 4. 

174. While keeping the MacBook Pro laptop offline (i.e., preventing the laptop 

from connecting to the Internet), I saw the sender, subject, and preview-text fields of 

emails stored on the laptop's email application. I did not select or open the emails. I 

also did not view the content of any email beyond what was apparent in the previewtext pane. 

175. During my border search, I saw emails located in the "Drafts - Google" 

folder associated with Subject Account 1. One such draft email appeared to forward 

a message sent on or about August 9, 2019 from pdelouis@hallandhallchamber.com, 

the same email address that putative attorney Pierre DELOUIS of Hall and Hall 

Chamber provided to Victim Individuals J.B, C.H., and R.U. 

176. The preview-text pane for two additional emails displayed the following 

observable text: 

Thank you for contacting Hall and Hall Chamber, a law firm that 

specializes in inheritance/will claims and can help you contest a will. 

You have contacted us to represent you in dealing with your 

inheritance ... 

177. Further, in a folder labeled "Important" that was associated with 

Subject Account 2, I saw an email from Akidiamoke Usman; the preview-text pane 

for that email included the following observable text: 

67 

' 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 104 of 231 PageID #:112
my broda, sorry for not updating you for few days now about those client. 

They are big idiot. i think someone has told them that it's a scam, they 

are just telling me rubbish, I tried to find out if the amount I gave them 

which ... 

In the same folder, I saw multiple emails whose preview text reflected personal 

identifying information for various individuals, including names, addresses, phone 

numbers, and amounts of money. Several of the emails referenced the words 

"diplomat", "parcel", or "consignment," while others appeared to request the recipient 

to contact the individuals mentioned in the preview text, occasionally referred to as 

"Clients," including an email from sender "tony & CONSTANT" bearing the subject 

line: "Please call this client 2morrow by 2 PM your time." 

a. Based on my training an experience, I am familiar of a variation 

of a romance-fraud scheme in which victims are falsely told that their romantic 

partner is going to send items of value, such as substantial amount of funds, to them 

for safekeeping through diplomatic-courier services. Once the items purportedly 

arrive, the romantic partner or a purported representative of the courier service will 

contact the victim and request the payment of funds in order to have the shipment 

released. Further, from my review of a complaint filed with the ICCC in or around 

July 2018, it appears that Victim Individual C.D.T.T. was defrauded into sending 

funds to an account in the name of GODMEKS pursuant to this diplomatic-courier 

variant of romance-fraud schemes. 

68 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 105 of 231 PageID #:113
178. During my border search of the MacBook Pro laptop, I also saw an email 

from "Nydia & COSTANT" bearing the subject line "Re,,, SAM OPIA FROM DAVID 

JACKSON." From my review of a complaint filed with the ICCC in or around October 

2016, it appears that Victim Individual J.M. was asked to send $1,320 to the UK 

International Courier Shipping Company, and thats/he reported interacting with an 

individual named "Sam Opia," of Chicago, who referred Victim Individual J.M. to an 

individual named "Anthony Ibekie." 

179. Further, in a folder labeled "Boxbe Waiting List" that was associated 

with Subject Account 2, I saw subject lines and/or preview text of emails from TCF 

Bank Alerts that referenced online statements for accounts in the name of 

ESIJEMINE and SETRACO SERVICES INC ("SETRACO"). 

a. ILSOS records obtained during the course of the investigation 

reflect SETRACO was incorporated on or about March 4, 2019, with an agent name 

"SAMMY MAXWELL," and an agent address of the Lincoln Premises, while ILSOS 

online databases notes the Lincoln Premises as the address of record for SETRACO. 

b. On or about June 14, 2019, an investigator contacted Victim 

Individual C.L., who confirmed filing a report with the San Antonio Police 

Department on or about March 31, 2019, in which s/he reported receiving a 

solicitation letter from a John DELON of TD Canada Trust Bank, apprising Victim 

Individual C.L. that s/he had a possible family member who died intestate with an 

unclaimed account in the amount of $9.2 million. In the report, Victim Individual C.L. 

saids/he sent funds as requested to TCF Bank account XXXXX7097 in the name of 

69 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 106 of 231 PageID #:114
SETRACO, as well as another account in the name of Jenant Inc. located in Illinois. 

Victim Individual C.L. further provided investigators with documents bearing the 

name Pierre DELOUIS and the email address pdelouis@hallhallchamber.com. 

180. During my border search, I additionally observed an email addressed to 

Sulaiman Adedotun, referencing paperless enrollment for JPMorgan Chase Bank 

account XXXXXX2296. As noted previously, Adedotun is the listed incorporator of 

ESEJIMINE, and the listed President and signor for accounts in the name of 

ESEJIMINE at Bank of America and JP Morgan Chase. Moreover, I saw emails for 

online banking accounts related to ESIJEMINE at Bank of America and TCF Bank, 

as well as PayPal emails referencing GODMEKS. 

181. After I completed my onsite border search, the MacBook Pro was 

returned to ANIUKWU prior to his departure from the port of entry at O'Hare. 

G. PROBABLE CAUSE TO BELIEVE THAT SUBJECT ACCOUNTS 1 AND 2 

CONTAIN EVIDENCE OF FRAUD 

182. Based on the foregoing facts, as well as my training and experience, my 

know ledge of this investigation, and my consultation with other agents, I believe that 

bank accounts associated with NU-MEKS, EMPERORCHILLS, MEKAS, SAMTONI, 

INNOCORD, GREEN HOUSE, GODMEKS, HALL & HALL, SAMCORD, 

ESIJEMINE, and SAMCHINA, and others are being used to facilitate mail and wire 

fraud, money laundering, and conspiracy to commit the foregoing offenses, through 

business-email compromise, romance-fraud, and investment-fraud schemes. As noted 

in this affidavit, each of the foregoing entities is associated with IBEKIE, ANIUWKU, 

70 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 107 of 231 PageID #:115
ASANJI, STEADMAN, BERRY, WASHINGTON, and other co-conspirators known 

and unknown. 

183. Based on my training and experience, as well as the training and 

experience of other agents with whom I have spoken, I am aware that individuals 

engaged in financial activity-whether legitimate or fraudulent-typically maintain 

some form of accounting to track their transactions. These records can be formal 

books, or can be rudimentary in nature-meant to simply track income earned and 

expenses incurred-and can reflect evidence of the acquisition and disposition of 

criminally derived proceeds. 

184. Generally, individuals, especially those who are involved in illicit 

financial transactions, maintain personal and business financial information in 

locations where it would be secure and readily accessible, such as in their residences, 

and-in the case of financial transactions involving online banking-on electronic 

devices such as computers, cell phones, or tablets near their person. 

185. Furthermore, based on my training and experience and infor:iμation 

obtained from other law enforcement officers who investigate mail and wire fraud, 

money laundering, conspiracy to commit the foregoing offenses, and related crimes, I 

know the following: 

a. It is common practice for individuals involved in mail and wire 

fraud to use and maintain computers, cellular phones, smartphones, and other digital 

devices. They often employ such devices for, among other things: (1) obtaining or 

storing personal victim profiles, including names, addresses, phone numbers, social 

71 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 108 of 231 PageID #:116
security numbers, dates of birth, driver's license or state identification numbers, alien 

registration numbers, passport numbers, employer or taxpayer identification 

numbers, bank account numbers, credit card numbers, email addresses, IP addresses, 

and PIN numbers or passwords for financial institutions or Internet service 

providers; (2) applying for, modifying, or maintaining bank accounts and/or credit 

card accounts to facilitate the receipt, transfer, or use of funds obtained from victims 

through fraudulent means; and (3) keeping records of their crimes. 

b. Individuals who participate in fraudulent schemes, including 

those predicated upon online communications with potential victim individuals or 

businesses, often use digital devices to communicate with their co-conspirators by 

phone, email, and text message. Oftentimes, they also maintain telephone numbers 

of their co-conspirators in their cellular telephones or smartphones. 

186. Based on my training and experience, the information disclosed in this 

affidavit, and information related to me by other law-enforcement agents who 

specialize in the investigation of mail or wire fraud schemes and related offenses, it 

is likely that Subject Account 1 and Subject Account 2 contain evidence, or were 

used in furtherance, of the offenses described in Attachment A. What is more, based 

on my findings during my border search of the MacBook Pro laptop found in 

ANIUKWU's possession, I believe that a search of Subject Accounts 1 and 2 will 

reveal evidence of ANIUKWU's involvement in the fraudulent schemes detailed in 

this affidavit-including through the use of entities such as ESIJEMINE, HALL & 

72 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 109 of 231 PageID #:117
HALL, GODMEKS, and NUMEKS, among others-as well as the identity of 

ANIUKWU's co-conspirators and their victims. 

187. Further, based on my training and experience in fraud investigations, I 

believe that a search of email-provider account contents for individuals-like 

ANIUWKU-engaged in criminal conduct yields investigative leads relating to: 

a. the identities of participants engaged in and witnesses to mail 

and wire fraud, money laundering, and conspiracy to commit the foregoing offenses; 

b. the contact information of participants engaged in and witnesses 

to mail and wire fraud, money laundering, and conspiracy to commit the foregoing 

offenses; 

c. the timing of communications among participants and other 

individuals involved in mail and wire fraud, money laundering, and conspiracy to 

commit the foregoing offenses; 

d. the methods and techniques used in mail and wire fraud, money 

laundering, and conspiracy to commit the foregoing offenses; and 

e. information regarding the physical location of participants 

engaged in and witnesses to mail and wire fraud, money laundering, and conspiracy 

to commit the foregoing offenses. 

IV. SEARCH PROCEDURE FOR SUBJECT EMAIL ACCOUNTS 

188. In order to facilitate seizure by law enforcement of the records and 

information described in Attachment A, this affidavit and application for search 

warrant seek authorization, pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 

73 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 110 of 231 PageID #:118
2703(c)(l)(A), to permit employees of Google to assist agents in the execution of this 

warrant. In executing this warrant, the following procedures will be implemented: 

a. The search warrant will be presented to Google personnel who 

will be directed to the information described in Section II of Attachment A; 

b. In order to minimize any disruption of computer service to 

innocent third parties, Google employees and/or law enforcement personnel trained 

in the operation of computers will create an exact duplicate of the computer accounts 

and files described in Section II of Attachment A, including an exact duplicate of all 

information stored in the computer accounts and files described therein; 

189. Google employees will provide the exact duplicate in electronic form of 

the information described in Section II of the Attachment A and all information stored 

in those accounts and files to the agent who serves this search warrant; and 

190. Following the protocol set out in the Addendum to Attachment A, law 

enforcement personnel will thereafter review all information and records received 

from Google employees to locate the information to be seized by law enforcement 

personnel pursuant to Section III of Attachment A. 

V. CONCLUSION 

191. Based on the above information, I respectfully submit that there is 

probable cause to believe that evidence, instrumentalities, and fruits of violations of 

Title 18, United States Code, Sections 1341, 1343, 1956, and 371 are located within 

one or more computers and/or servers found at Google, headquartered at 1600 

Amphitheatre Parkway, Mountain View, California, 94043. By this affidavit and 

application, I request that the Court issue a search warrant directed to Google 

74 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 111 of 231 PageID #:119
a llowing agents to seize the electronic evidence and other information associated with 

the Subject Accounts that is stored on Google's servers following the search 

procedure described in Attachment A and the Addendum to Attachment A. 

FURTHER AFFIANT SA YETH NOT. 

~ . 

Spec

~~ ial Agent 

Homeland Security Investigations 

75 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 112 of 231 PageID #:120
ATTACHMENT A 

I. SEARCH PROCEDURE 

1. The search warrant will be presented to Google personnel, who will be 

directed to isolate those accounts and files described in Section II below. 

2. In order to minimize any disruption of computer service to innocent 

third parties, company employees and/or law enforcement personnel trained in the 

operation of computers will create an exact duplicate of the computer accounts and 

files described in Section II below, including an exact duplicate of all information 

stored in the computer accounts and files described therein. 

3. Google employees will provide the exact duplicate in electronic form of 

the accounts and files described in Section II below and all information stored in those 

accounts and files to the agent who serves the search warrant. Google shall disclose 

'responsive data, if any, by sending to Special Agent Sixto J. Luciano, Homeland 

Security Investigations, Chicago Cyber Crimes Task Force, 1 Tower Lane, 

Suite 1600, Oakbrook Terrace, IL 60181, using the US Postal Service or another 

courier service, notwithstanding 18 U.S.C. § 2252A or similar statute or code. 

4. Following the protocol set out in the Addendum to this Attachment, law 

enforcement personnel will thereafter review information and records received from 

company employees to locate the information to be seized by law enforcement 

personnel specified in Section III below. 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 113 of 231 PageID #:121
II. FILES AND ACCOUNTS TO BE COPIED BY EMPLOYEES OF GOOGLE 

To the extent that the information described below in Section III is within the 

possession, custody, or control of Google, which are stored at premises owned, 

maintained, controlled, or operated by Google, headquartered at 1600 Amphitheatre 

Parkway, Mountain View, California, 94043, Google is required to disclose the 

following information to the government for the following accounts: 

saniukwul@gmail.com and constantconsultant200@gmail.com 

(the "Subject Accounts") 

a. All available account contents from inception of account to 

present, including e-mails, attachments thereto, drafts, contact lists, address books, 

and search history, stored and presently contained in, or maintained pursuant to law 

enforcement request to preserve. 

b. All electronic files stored online via Google Drive, stored and 

presently contained in, or on behalf of the accounts described above. 

c. All search history records stored and presently contained in, or on 

behalf of the accounts described above including, if applicable, web and application 

activity history (including search terms), device information history, and location 

history. 

d. All existing printouts from original storage of all the electronic 

mail described above. 

2 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 114 of 231 PageID #:122
e. All transactional information of all activity of the electronic mail 

addresses and/or individual accounts described above, including log files, dates, 

times, methods of connecting, ports, dial-ups, and/or locations. 

f. All business records and subscriber information, in any form kept, 

pertaining to the electronic mail addresses and/or individual accounts described 

above, including applications, subscribers' full names, all screen names associated 

with the subscribers and/or accounts, all account names associated with the 

subscribers, methods of payment, telephone numbers, addresses, and detailed billing 

and payment records. 

g. All records indicating the services available to subscribers of the 

electronic mail addresses and/or individual accounts described above. 

h. All account contents previously preserved by Google, in electronic 

or printed form, including all e-mail, including attachments thereto, and Google Drive 

stored electronic files for the accounts described above. 

1. All subscriber records for any Google account associated by 

cookies, recovery email address, or telephone number to the accounts described above. 

Pursuant to 18 U.S.C. § 2703(d), the service provider is hereby ordered to 

disclose the above information to the government within 14 days of the signing of this 

warrant. 

3 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 115 of 231 PageID #:123
Ill. INFORMATION TO BE SEIZED BY LAW ENFORCEMENT PERSONNEL 

All information described above in Section II that constitutes evidence, 

instrumentalities, and fruits concerning violations of Title 18, United States Code, 

Sections 1341, 1343, 1956, and 371 (the "Subject Offenses"}, as follows: 

1. Items related to the identity of the user or users of the Subject 

Accounts. 

2. Items related to the physical location of the users of the Subject 

Accounts at or near the times of the Subject Offenses. 

3. Items related to the identities and contact information of participants in 

or witnesses to the Subject Offenses. 

4. Financial records, including receipts, checks, bank and savings and loan 

records of deposit, withdrawal and wire transfer, statements and other bank records, 

letters of credit, credit card statements, money orders, cashier's checks, passbooks, 

cancelled checks, certificates of deposit, loan records, customer account information, 

income and expense summaries, cash disbursement journals, financial statements, 

and state and federal income tax returns. 

5. Any general ledgers, journals, and accounting records, including 

electronic accounting records, for NU-MEKS Healthcare Inc. ("NU-MEKS"), 

EMPERORCHILLS, MEKAS Construction Inc. ("MEKAS"), HALL & HALL Global 

Inc. ("HALL & HALL"}, GODMEKS Inc. ("GODMEKS"), SAMCORD Inc. 

("SAMCORD"}, ESIJEMINE Lucky Nengite Inc. ("ESIJEMINE"), SAMCHINA 

4 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 116 of 231 PageID #:124
Trucking Inc. ("S.AM:CHINA"), African Money Union Inc. ("AFRICAN MONEY 

UNION"), or any other entity associated with Anthony Emeka Ibekie ("IBEKIE"), 

Uchenna Samuel Aniukwu, aka Samuel Uchenna Aniukwu ("ANIUKWU"), Lasheena 

Washington ("WASHINGTON"), Williette Asanji ("ASANJI"), Treonda Steadman 

("STEADMAN"), Lawrence Berry III ("BERRY"), Chandler Arnaud ("ARNAUD"), 

Diego Dario ("DARIO"), Pierre Delouis ("DELOUIS"), Jean Drapeaw ("DRAPEAW'), 

Onuigbo Izuchukwu ("IZUCHUKWU"), Fred Lookas ("LOOKAS"), Steven Kelvin 

Clark ("STEVEN"), or Siegel Clark ("SIEGEL"); 

6. Credit card statements, bank statements, payment records, application 

forms and all related documentation for any accounts held by NU-MEKS, 

EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, S.AM:CORD, 

ESIJEMINE, S.AM:CHINA, AFRICAN MONEY UNION, IBEKIE, ANIUKWU, 

WASHINGTON, ASANJI, STEADMAN, BERRY, ARNAUD, DARIO, DELOUIS, 

DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, or SIEGEL; 

7. Billing statements, purchase orders, delivery receipts, invoices, 

payment records and any other supporting documentation for any goods or services 

rendered by NU-MEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, 

S.AM:CORD, ESIJEMINE, S.AM:CHINA, AFRICAN MONEY UNION, or any other 

entity associated with IBEKIE, ANIUKWU, WASHINGTON, ASANJI, STEADMAN, 

BERRY, ARNAUD, DARIO, DELOUIS, DRAPEAW, IZUCHUKWU, LOOKAS, 

STEVEN, or SIEGEL; 

5 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 117 of 231 PageID #:125
8. All communications, including written correspondence, mailings, 

letters, emails, or notes concerning sales or invoicing for any goods or services 

rendered by NU-MEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, 

SAMCORD, ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, or any other 

entity associated with IBEKIE, ANIUKWU, WASHINGTON, ASANJI, STEADMAN, 

BERRY, ARNAUD, DARIO, DELOUIS, DRAPEAW, IZUCHUKWU, LOOKAS, 

STEVEN, or SIEGEL; 

9. All communications, including written correspondence, mailings, 

letters, emails, or notes exchanged between or among IBEKIE, ANIUKWU, 

WASHINGTON, ASANJI, STEADMAN, BERRY, ARNAUD, DARIO, DELOUIS, 

DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, or SIEGEL concerning: (1) NUMEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, SAMCORD, 

ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, or any other entity 

associated with the foregoing individuals; (2) the receipt, withdrawal, transfer, 

expenditure, or use of funds deposited at any bank account; (3) requests or demands 

for payment of funds issued to any third party, including any individual or business; 

(4) putative inheritances, lottery winnings, or investments; (5) 5206 Lincoln Avenue 

in Lisle, Illinois (the "Lincoln Premises"); or (6) 2726 Alyssa Drive, Naperville, Illinois 

(the "Alyssa Premises"). 

10. All communications, including written correspondence, mailings, 

letters, emails, or notes exchanged between or among IBEKIE, ANIUKWU, 

6 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 118 of 231 PageID #:126
WASHINGTON, ASANJI, STEADMAN, BERRY, ARNAUD, DARIO, DELOUIS, 

DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, or SIEGEL, and any third party on 

any online dating website, including but not limited to OKCupid.com. 

11. Any and all federal and state corporate tax records to include 1099, W2, 940, and 941 forms for NU-MEKS, EMPERORCHILLS, MEKAS, HALL & HALL, 

GODMEKS, SAMCORD, ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, or 

any other entity associated with IBEKIE, ANIUKWU, WASHINGTON, ASANJI, 

STEADMAN, BERRY, ARNAUD, DARIO, DELOUIS, DRAPEAW, IZUCHUKWU, 

LOOKAS, STEVEN, or SIEGEL; 

12. Payroll records for NU-MEKS, EMPERORCHILLS, MEKAS, HALL & 

HALL, GODMEKS, SAMCORD, ESIJEMINE, SAMCHINA, AFRICAN MONEY 

UNION, or any other entity associated with IBEKIE, ANIUKWU, WASHINGTON, 

ASANJI, STEADMAN, BERRY, ARNAUD, DARIO, DELOUIS, DRAPEAW, 

IZUCHUKWU, LOOKAS, STEVEN, or SIEGEL; 

13. Any evidence of past or current indebtedness, contracts, promissory 

notes, mortgage records, vehicle loans, business loans, or student loans for NUMEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, SAMCORD, 

ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, IBEKIE, ANIUKWU, 

WASHINGTON, ASANJI, STEADMAN, BERRY, ARNAUD, DARIO, DELOUIS, 

DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, or SIEGEL; 

7 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 119 of 231 PageID #:127
14. Indicia of occupancy, residency, control or ownership of the Lincoln 

Premises or the Alyssa Premises, such as utility bills, telephone bills, loan payment 

receipts, rent documents, canceled envelopes, keys, photographs, and bank records; 

and 

15. All of the non-content records described above in Section IL 

8 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 120 of 231 PageID #:128
ADDENDUM TO ATTACHMENT A 

With respect to the search of any information and records received from the 

free web-based electronic mail service provider, law enforcement personnel will locate 

the information to be seized pursuant to Section III of Attachment A according to the 

following protocol. 

The search procedure may include the following techniques (the following is a 

non-exclusive list, and the government may use other procedures that, like those 

listed below, minimize the review of information not within the list of items to be 

seized as set forth herein): 

a. searching for and attempting to recover any hidden, or encrypted 

data to determine whether that data falls within the list of items to be seized as set 

forth herein. 

b. surveymg various file directories and the electronic mail, 

including attachments thereto to determine whether they include data falling within 

the list of items to be seized as set forth herein. 

c. opening or reading portions of electronic mail, and attachments 

thereto, in order to determine whether their contents fall within the items to be seized 

as set forth herein, and/or 

d. performing key word searches through all electronic mail and 

attachments thereto, to determine whether occurrences oflanguage contained in such 

9 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 121 of 231 PageID #:129
electronic mail, and attachments thereto, exist that are likely to appear in the 

information to be seized described in Section III of Attachment A. 

Law enforcement personnel are not authorized to conduct additional searches 

on any information beyond the scope of the items to be seized by this warrant. 

10 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 122 of 231 PageID #:130
Exhibit 2:

Application and Affidavit of IRS-CI SA

Amy C. Mansker in Support of Premises 

Search Warrant in Case No. 20 M 215

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 123 of 231 PageID #:131
AO 106 (REV 4/10) Affidavit for Search Warrant AUSA Saurish Appleby-Bhattacharjee, (312) 469-6045

AUSA Paige Nutini, (312) 697-4071

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF ILLINOIS, EASTERN DIVISION

UNDER SEAL

In the Matter of the Search of:

The apartment unit located at 797 Oxbow Avenue, 

Unit 110, Oswego, Illinois 60543, further described in 

Attachment A-1

Case Number: 

APPLICATION AND AFFIDAVIT FOR A SEARCH WARRANT

I, AMY C. MANSKER, a Special Agent of the Internal Revenue Service Criminal Investigation, request a 

search warrant and state under penalty of perjury that I have reason to believe that on the following properties or 

premises:

See Attachment A-1

located in the Northern District of Illinois, there is now concealed:

See Attachment B 

The basis for the search under Fed. R. Crim. P. 41(c) is evidence, instrumentalities, and fruits.

The search is related to a violation of:

Code Section

Title 18, United States Code, Sections 1341, 1343, 1956, 

1349, and 371

Offense Description

mail and wire fraud, money laundering, and conspiracy 

to commit the foregoing offenses

The application is based on these facts:

See Attached Affidavit continued on the attached sheet.

Applicant’s Signature

AMY C. MANSKER, Special Agent

IRS Criminal Investigation

Printed name and title

Pursuant to Fed. R. Crim. P. 4.1, this warrant is presented by reliable electronic means. The above-named agent 

provided a sworn statement attesting to the truth of the foregoing affidavit by telephone.

Date: July 8, 2020

Judge’s signature

City and State: Chicago, Illinois SHEILA M. FINNEGAN, U.S. Magistrate Judge

Printed name and title

20M364

1:40 pm

FILED 7/8/2020

THOMAS G. BRUTON CLERK, U.S. DISTRICT COURT

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 124 of 231 PageID #:132
UNITED STATES DISTRICT COURT )

)

NORTHERN DISTRICT OF ILLINOIS )

AFFIDAVIT

TABLE OF CONTENTS

I. INTRODUCTION AND AFFIANT BACKGROUND ........................................ 1

II. FACTS SUPPORTING PROBABLE CAUSE TO SEARCH ............................. 3

A. Investigative Background and Summary.................................................... 3

B. Prior Warrant............................................................................................... 5

C. Receipt of Victim Funds By Various Entities Associated with

ANIUKWU, IBEKIE, and their Co-Conspirators ....................................... 6

1. HALL & HALL Global Inc. .................................................................. 7

a. Corporate Formation .................................................................. 7

b. Receipt of Funds from Victim Business V.M.C. and

Victim Individuals R.U. and V.M............................................... 7

c. Receipt of Funds from Victim Business G.F.E. ....................... 10

d. Disposition of Victim Funds Received...................................... 11

2. JENANT Inc. / SETRACO Services Inc. ........................................... 15

a. Corporate Formation ................................................................ 15

b. Receipt of Funds from Victim Individual C.L.......................... 15

c. Disposition of Funds from Victim Individual C.L. .................. 17

3. SAMCORD Inc.................................................................................... 21

a. Corporate Formation ................................................................ 21

b. Receipt of Funds from Victim Individual A.W......................... 22

c. Disposition of Funds from Victim Individual A.W. ................. 23

D. Undercover Investigation........................................................................... 24

1. Overview............................................................................................. 24

2. Historical Investigation of Inheritance Scam Letters ...................... 25

a. Trash Pull at the Lincoln Premises ......................................... 25

b. Letters Received by DuPage County State’s

Attorney Office .......................................................................... 26

3. Communications Incident to Undercover Operation........................ 28

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 125 of 231 PageID #:133
2

E. Investigation Leading to the Harlem Premises ........................................ 37

1. Controlled Delivery ............................................................................ 37

2. Additional Information Regarding the Harlem Premises ................ 40

F. Investigation Leading to the Oxbow Premises ......................................... 41

1. Subscriber Information and IP Addresses ........................................ 41

a. Email Addresses Used to Communicate With the UCA ......... 41

b. Personal Email Address of IBEKIE ......................................... 43

c. IP Address Tracking the Controlled Delivery ......................... 45

d. IP Addresses Appearing to Originate from the

United Kingdom........................................................................ 46

i. Subscriber Information, Internet Service Provider,

and Virtual Private Network Services............................. 46

ii. Historical Purchases of VPN Services by ANIUKWU,

IBEKIE, and Their Co-Conspirators................................ 48

2. Surveillance at the Oxbow Premises ................................................. 51

3. Additional Information Regarding the Oxbow Premises.................. 54

G. Investigation Leading to the Weber Premises .......................................... 57

1. The ANIUKWU Gmail Account......................................................... 57

a. Subscriber Information and IP Addresses ............................... 57

b. Relevant Communications........................................................ 58

2. The Constant Gmail Account............................................................. 71

a. Subscriber Information............................................................. 71

b. Relevant Communications........................................................ 72

3. Surveillance at the Weber Premises ................................................. 77

4. Records/Communications with Property Management at the

Weber Premises.................................................................................. 79

a. Lease Records Obtained from Continental Properties............ 79

b. Email Communications from the ANIUKWU Gmail

Account to Springs at Weber Road........................................... 80

5. Additional Information Regarding the Weber Premises .................. 82

H. Evidence of Fraud Will Be Found at the Oxbow Premises, the Weber

Premises, and the Harlem Premises ......................................................... 82

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 126 of 231 PageID #:134
3

III. SPECIFICS REGARDING SEARCHES OF ELECTRONIC STORAGE 

MEDIA............................................................................................................... 85

IV. PROCEDURES TO BE FOLLOWED IN SEARCHING ELECTRONIC 

STORAGE MEDIA............................................................................................ 87

V. CONCLUSION.................................................................................................. 88

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 127 of 231 PageID #:135
UNITED STATES DISTRICT COURT )

)

NORTHERN DISTRICT OF ILLINOIS )

AFFIDAVIT

I, AMY C. MANSKER, being duly sworn, state as follows: 

I. INTRODUCTION AND AFFIANT BACKGROUND

1. I am a Special Agent with the Internal Revenue Service Criminal 

Investigation (“IRS-CI”) and have been so employed since approximately 2016. As 

part of my duties as a Special Agent, I investigate criminal violations relating to 

white-collar crime, including mail, wire, and bank fraud, money-laundering offenses, 

as well as violations of federal tax laws. In my capacity as a Special Agent, I have 

participated in the execution of multiple federal search warrants. Additionally, prior 

to my employment with IRS-CI, I worked as a Police Officer with Naperville Police 

Department from approximately 2014 through 2016.

2. This affidavit is made in support of an application for a warrant to 

search the apartment units located at 797 Oxbow Avenue, Unit 110, Oswego, Illinois 

60543, described further in Attachment A-1 (the “Oxbow Premises”); 716 South

Weber Road, Unit 512, Romeoville, Illinois 60446, described further in Attachment 

A-2 (the “Weber Premises”); and 1419 North Harlem Avenue, Apartment B, Oak 

Park, Illinois 60302, described further in Attachment A-3 (the “Harlem Premises”) 

for evidence, instrumentalities, and fruits described further in Attachment B, 

concerning mail and wire fraud, money laundering, and conspiracy to commit the 

foregoing offenses, in violation of Title 18, United States Code, Sections 1341, 1343, 

1956, 1349, and 371.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 128 of 231 PageID #:136
2

3. The statements in this affidavit are based on my personal knowledge,

and on information I have received from other law-enforcement personnel and from 

persons with knowledge regarding relevant facts. Because this affidavit is being 

submitted for the limited purpose of securing a search warrant, I have not included 

each and every fact known to me concerning this investigation. I have set forth facts 

that I believe are sufficient to establish probable cause to believe that evidence, 

instrumentalities, and fruits of violations of Title 18, United States Code, Sections 

1341, 1343, 1956, 1349, and 371, are located at the Oxbow Premises, the Weber 

Premises, and the Harlem Premises.

4. This affidavit also describes portions of written conversations, which I

have summarized. These summaries do not necessarily refer to all of the topics 

covered during each conversation. In addition, these summaries do not include every 

conversation made by every writer/author on the topic being described. Portions of 

the conversations that are quoted are preliminary transcriptions, which may be 

subject to modification upon further review. For some conversations, I have offered 

my understandings and/or interpretations of the conversation, which are based upon 

my experience and knowledge of the investigation to date, the content and context of 

the conversations, the experience of other investigators with whom I have consulted, 

as well as my professional training and experience as a law-enforcement agent.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 129 of 231 PageID #:137
3

II. FACTS SUPPORTING PROBABLE CAUSE TO SEARCH 

A. INVESTIGATIVE BACKGROUND AND SUMMARY

5. This warrant application stems from an ongoing investigation into 

individuals in the Northern District of Illinois, and elsewhere, who are suspected of 

facilitating, or laundering the proceeds of, various online fraud schemes. As detailed 

further below, this investigation has recently involved use of an undercover agent to 

communicate with suspected co-conspirators, which, coupled with other information 

obtained over the course of the investigation, has generated probable cause to believe 

that evidence of fraud will be found at the Oxbow Premises, the Weber Premises, 

and the Harlem Premises.

6. To date, the investigation has identified several individuals who have 

conducted overt and affirmative acts in the Northern District of Illinois in furtherance 

of various online schemes and artifices, such as the incorporation of business entities 

and the opening of bank accounts at financial institutions—including those that are 

federally insured—in order to facilitate the receipt of funds fraudulently induced from 

victims through false pretenses, representations, promises, and concealment of 

material facts, and subsequently transfer the funds to accounts maintained abroad. 

7. The co-conspirators, known and unknown, have used various means to 

conduct the above overt acts, including the use of telephones, computers, vehicles, 

correspondence, and the United States Postal Service, evidence of which are believed 

to be maintained at the Oxbow Premises, the Weber Premises, and the Harlem 

Premises.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 130 of 231 PageID #:138
4

8. In summary, and as explained in more detail herein, the individuals and 

entities at issue in this investigation were involved in opening accounts at financial 

institutions in the Northern District of Illinois, and elsewhere, to facilitate the receipt 

and subsequent transfer of proceeds fraudulently obtained from victims of the 

following categories of schemes:

a. Business Email Compromise: a scheme targeting businesses that 

perform wire transfers. The scheme is typically carried out by: (1) compromising 

legitimate business e-mail accounts through social engineering or computer-intrusion 

techniques to gain unauthorized access to the business-email account; (2) blocking or 

redirecting communications to or from the email account; and then (3) using the 

compromised email account or a separate fraudulent email account to communicate 

with personnel from a victim company, attempting to induce the victim company into 

making a wire transfer under fraudulent pretenses.

b. Romance Fraud: a scheme to defraud a victim on the Internet, 

whereby a co-conspirator contacts a victim online and builds trust through an online 

romance. At some point, the co-conspirator will convince a victim to send money to a 

predetermined recipient under the false pretense that the victim will either get paid 

back in the future or that the money being sent is part of a business transaction. 

Romance scams typically target persons looking for romantic partners or friendship 

on dating websites and other social-media platforms. The scammers may create 

profiles using fictitious or fake names, locations, images, and personas, allowing the 

scammers to cultivate relationships with prospective romance-scam victims. Victims 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 131 of 231 PageID #:139
5

may be convinced to provide money or gifts to the scammers, or may be asked to 

conduct transactions on behalf of the scammers.

c. Inheritance Fraud Scheme: a variation of an online-investmentfraud scheme, in which a victim is tricked into sending money from his/her bank 

account under the false pretense that the victim is about to receive a substantial 

inheritance.

B. PRIOR WARRANT

9. On or about April 20, 2020, the Honorable Virginia M. Kendall, United

States District Judge, issued a warrant in Case No. 20 M 215 (the “Gmail Warrant”), 

authorizing the search of two Gmail accounts associated with Samuel Aniukwu, a

suspected co-conspirator in the fraudulent schemes under investigation. The 

application and affidavit of Homeland Security Investigations (“HSI”) Special Agent 

Sixto J. Luciano in support of the Gmail Warrant (the “Luciano Affidavit”), attached 

hereto as Exhibit 1 and incorporated by reference, details relevant findings of the 

investigation to date, including, in pertinent part:

a. Providing background information regarding the co-conspirators

that law enforcement has identified, to date, as being involved in the fraudulent 

schemes mentioned herein, including Samuel Uchenna Aniukwu (“ANIUKWU”) and 

Anthony Emeka Ibekie (“IBEKIE”);

b. Summarizing various business entities suspected of being used to

facilitate the fraudulent schemes at issue in the investigation, including the corporate 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 132 of 231 PageID #:140
6

formation of those entities, as well as each entity’s receipt of fraudulently obtained 

funds from a victim individual or victim business; and

c. Detailing evidence of international outgoing wire transfers of

funds suspected to have been generated through the fraudulent schemes as well as 

interactions between Customs and Border Protection (“CBP”) officials, IBEKIE, and 

ANIUKWU, including evidence of suspected fraud obtained during a border search of 

digital devices in ANIUKWU’s possession.

10. Rather than repeating verbatim the factual statements in the Luciano

Affidavit, which are incorporated by reference herein, the instant affidavit focuses 

upon: (1) historical evidence of victim funds received by specific entities associated 

with ANIUWKU and IBEKIE that are relevant here, including HALL & HALL 

Global Inc., JENANT Inc., SETRACO Services Inc., and SAMCORD Inc.; (2) relevant 

communications exchanged among an undercover IRS-CI agent and suspected coconspirators in the fraudulent schemes; and (3) investigators’ efforts to establish that 

those communications exchanged with the undercover agent originated from digital 

devices located within the Oxbow Premises, the Weber Premises, and the 

Harlem Premises.

C. RECEIPT OF VICTIM FUNDS BY VARIOUS ENTITIES ASSOCIATED WITH

ANIUKWU, IBEKIE, AND THEIR CO-CONSPIRATORS

11. ANIUKWU, IBEKIE, and their known and unknown co-conspirators

incorporated or registered several business entities with the Illinois Secretary of 

State (“ILSOS”), and also created individual bank accounts for each entity. In the 

course of this investigation, agents have tied bank accounts for these entities—

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 133 of 231 PageID #:141
7

including, in relevant part, HALL & HALL Global Inc., JENANT Inc., SETRACO 

Services Inc., and SAMCORD Inc.—to the receipt of fraudulently obtained funds from 

the victim individuals and victim businesses described herein. What follows in 

Sections II.C.1, II.C.2 and II.C.3 below is a summary of: (1) the creation of the subject 

business entities and their related bank accounts; (2) the receipt and disposition of 

fraudulently obtained funds by the entities; and (3) agents’ interviews with victims 

concerning how they were defrauded.

1. HALL & HALL GLOBAL INC.

a. CORPORATE FORMATION

12. On or about April 13, 2018, Hall & Hall Global Inc. (“HALL & HALL”) 

was incorporated with the ILSOS. Its articles list Williette Asanji (“ASANJI”) as the 

registered agent and “Uchenna Ani Samuel” (a variant of ANIUKWU’s name) as the 

incorporator, both with an address of “Unit 1A” at 5206 Lincoln Avenue in Lisle, 

Illinois (the “Lincoln Premises”), a property previously associated with IBEKIE and 

ANIUKWU as noted in the Luciano Affidavit.

b. RECEIPT OF FUNDS FROM VICTIM BUSINESS V.M.C. AND 

VICTIM INDIVIDUALS R.U. AND V.M.

13. On or about April 16, 2018, an account (XXXXXX3717) was opened in 

the name of HALL & HALL at TCF Bank. The signature card lists “Asanji P Willette” 

ASANJI as the authorized signer for the TCF Bank account. The same day, on or 

about April 16, 2018, a checking account (XXXXXX5950) and savings account 

(XXXXXX2312) were opened in the name of HALL & HALL at JP Morgan Chase 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 134 of 231 PageID #:142
8

Bank. The signature cards list ASANJI as both the president of HALL & HALL and 

authorized signer for the JP Morgan Chase accounts. 

14. On or about April 25, 2018, the HALL & HALL TCF Bank account

received a wire from Victim Business V.M.C. for approximately $6,405. A few days 

later, on or about May 1, 2018, the account received another wire from Victim 

Business V.M.C. for approximately $22,962.75. Then, on or about May 4, 2018, the 

HALL & HALL JP Morgan Chase savings account received a wire in the amount of 

approximately $125,000 from Victim Business V.M.C.

a. Based on my training and experience, knowledge of this

investigation, and conversations with other investigators involved in this matter, I 

know that domestic wire transfers conducted within the United States are cleared 

through the Fedwire funds-transfer system, an electronic interbank funds-transfer 

system operated by the Federal Reserve. Further, based on my training and 

experience, and my interviews of Federal Reserve employees in prior investigations, 

I know that Fedwire does not process wire transfers in Illinois but rather in New 

Jersey and/or Texas. Thus, any Fedwire transfers received by financial institutions 

in Illinois, as discussed throughout this affidavit, are interstate wire transactions.

15. On or about October 15, 2019, agents contacted Victim Individual V.M,

who said that his/her spouse, Victim Individual R.U., handles the finances related to 

Victim Business V.M.C.

16. On or about October 15, 2019, agents conducted a telephonic interview

with Victim Individual R.U., who said that s/he had received a letter via the U.S.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 135 of 231 PageID #:143
9

Postal Service sometime in or around early-April 2018, from an individual purporting 

to be named Fred Lookas (“LOOKAS”) of TD Canada Trust, regarding an individual 

with the same last name as Victim Individual R.U. who allegedly passed away in 

Canada and left behind a sizeable inheritance. Victim Individual R.U., whose 

grandfather had been from Canada, explained that s/he was instructed to send funds 

in order to obtain the inheritance, allegedly worth $11 million, or else the funds would 

be turned over to the government of Canada.

17. Victim Individual R.U. also said that as part of the process to obtain the

inheritance, s/he was referred to an attorney in Canada named Pierre Delouis

(“DELOUIS”) of the firm Hall and Hall Chamber (the same putative attorney and law 

firm used to defraud Victim Individuals J.B. and C.H., as noted in Sections III.B.3.c 

and III.B.6.b, in the Luciano Affidavit). Victim Individual R.U. said the payment to 

the HALL & HALL TCF Bank account for $6,405 constituted a payment to retain the 

services of DELOUIS, and that s/he believed the payment in the amount of $22,962.75 

was possibly for additional attorney fees. Victim Individual R.U. said s/he was also 

required to make a payment in the amount of $125,000 to settle a purported lien on 

the alleged inheritance.

18. Further, Victim Individual R.U. said s/he was informed the payments

were being made into an account in Illinois in order to avoid having to pay a tax on 

the transaction. But Victim Individual R.U. became suspicious of the numerous 

payments required to obtain the inheritance and—after attempting to verify the 

individuals and entities with whom s/he was communicating—Victim Individual R.U. 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 136 of 231 PageID #:144
10

discovered the phone numbers and addresses provided to him/her did not appear 

legitimate. After s/he confronted the individuals involved in the transaction, Victim 

Individual R.U. recalled that s/he was contacted by an individual with a slight accent

who threatened to turn Victim Individual R.U. into the authorities for fraud.

19. Victim Individual R.U. provided agents email communications and 

documents s/he exchanged with fredlookas@gmail.com, ued@tdcanadagroup.com, 

and pdelouis@hallhallchamber.com, which included attachments sent to Victim 

Individual R.U. with wire instructions for US Bank account (XXXXXXX5229) in the 

name of GODMEKS INC (a fraudulent entity discussed further in Section III.B.8 of 

the Luciano Affidavit), TCF Bank account XXXXX5980 in the name of SAMTONI (a 

fraudulent entity discussed further in Section III.B.4 of the Luciano Affidavit), and 

TCF Bank account XXXXXX3717 in the name of HALL & HALL. Also included in the 

emails were attachments purporting to be receipts of international money transfers 

from LOOKAS to Bank of America accounts XXXXXX4851 and XXXXXX3717 in the 

name of HALL & HALL, JP Morgan Chase Bank account XXXXXX2312 in the name 

of HALL & HALL, and TCF Bank account XXXXXX5980 in the name of SAMTONI.

c. RECEIPT OF FUNDS FROM VICTIM BUSINESS G.F.E.

20. On or about May 1, 2018—the same day that Victim Individual R.U. 

sent a wire transfer for approximately $22,962.75 to HALL & HALL TCF Bank 

account XXXXXX3717—that same TCF Bank account received a wire transfer from 

Victim Business G.F.E. for approximately $50,000.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 137 of 231 PageID #:145
11

21. On or about October 11, 2019, agents conducted a telephonic interview

with Victim Business G.F.E’s representative, C.G., who said that Victim Business 

G.F.E purchases and sells used printing equipment. C.G. further said s/he was in the 

process of sending a refund due to a customer of Victim Business G.F.E., when s/he 

received an email purporting to be from a representative of the customer requesting 

that the funds be sent to another account. The email appeared to be legitimate to 

C.G., who complied with the request. Upon later learning the customer never received 

the refund, C.G. tried to stop the transaction through Victim Business G.F.E’s bank, 

but was informed that the funds had already been withdrawn. C.G. filed reports with 

the Green Bay Police Department and on an online-fraud complaint center. 

22. C.G. provided investigators with a series of emails related to the above 

transaction. One of the emails, dated on or about May 1, 2018, stated the following:

Please send the wire transfer to below account details, Please note that we have 

stopped payment in our previous bank account , this is due to the fact that we 

have been charged high tax, therefore for now we are currently using our 

production bank account as stated below.

TCF BANK

ACCT NAME: HALL & HALL GLOBAL INC

ROUTING NO: 271972572

ACCT NO:XXXXXX3717

BANK ADDRESS: 1156 MAPLE STREET NAPERVILLE ILLINOIS 

60540

Please try and have it done today and.

Thank you[.]

d. DISPOSITION OF VICTIM FUNDS RECEIVED

23. A review of bank records for the above HALL & HALL TCF Bank 

account shows that on or about May 1, 2018—the same day the account received the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 138 of 231 PageID #:146
12

wires from Victim Individual R.U. and Victim Business G.F.E—an approximately 

$70,460 withdrawal was made. A copy of the withdrawal ticket bears ASANJI’s name 

and shows that approximately: (1) $9,900 was withdrawn in cash; (2) $21,720 was 

withdrawn as a check (#305855739) made payable to ASANJI; and (3) $38,840 was 

withdrawn as a check (#305855738) made payable to HALL & HALL.

a. Based on my training and experience, I know that financial 

institutions are required by law to file a currency transaction report (“CTR”) with the 

Financial Crimes Enforcement Network (“FinCEN”) for a cash deposit, withdrawal, 

or exchange of currency exceeding $10,000. I also know, based on my training and 

experience, that criminal enterprises routinely limit the amount of any individual 

deposit or withdrawal of unlawfully obtained currency, in an effort to prevent the 

filing of a CTR and thereby avoid detection by law enforcement. This practice—known 

as “structuring”—is prohibited under federal law, namely, Title 31, United States 

Code, Section 5324. Here, as noted above, the cash withdrawal made in ASANJI’s 

name on or about May 1, 2018 was only $100 below the CTR threshold for FinCen.

24. On or about April 12, 2018, an account (XXXXXX9530) was opened in 

the name of “Asanji Willette” at JP Morgan Chase Bank. The signature card lists 

ASANJI as the authorized signer for the JP Morgan Chase Bank account.

25. A review of bank records for the ASANJI JP Morgan Chase Bank 

account (XXXXXX9530) shows that on or about May 1, 2018—the same day an 

approximately $70,460 withdrawal was made from the HALL & HALL TCF Bank 

account in ASANJI’s name—an approximately $21,720 deposit was made. A copy of 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 139 of 231 PageID #:147
13

the deposit ticket bears ASANJI’s name. The item associated with the deposit ticket 

was an official check (#305855739) in the approximate amount of $21,720 issued by 

TCF Bank on or about May 1, 2018, made payable to ASANJI, and appears to be the 

same check withdrawn from the HALL & HALL TCF Bank account.

26. A review of bank records for the above ASANJI JP Morgan Chase Bank 

account (XXXXXX9530) shows that on or about May 2, 2018—one day after an 

approximately $21,720 deposit was made to the ASANJI JP Morgan Chase Bank 

account (XXXXXX9530)—an approximately $23,000 outgoing wire transfer was made 

to an account in Nigeria at Access Bank PLC in Lagos to the beneficiary IBEKIE.

27. A review of bank records for the HALL & HALL JP Morgan Chase Bank 

account (XXXXXX5950) shows that on or about May 1, 2018—the same day an 

approximately $70,460 withdrawal was made from the HALL & HALL TCF Bank 

account—an approximately $38,840 deposit was made. A copy of the deposit ticket

bears HALL & HALL’s name. The deposit item associated with the deposit ticket was 

an official check (#305855738) in the approximate amount of $38,840 issued by TCF 

Bank on May 1, 2018 made payable to HALL & HALL with a memo noting “RE:

ASANJI WILLETTE” and appears to be the same check withdrawn from the HALL 

& HALL TCF Bank account.

28. A review of bank records for the HALL & HALL JP Morgan Chase Bank 

account (XXXXXX5950) shows that on or about May 3, 2018—two days after an 

approximately $38,840 deposit was made to HALL & HALL JP Morgan Chase Bank 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 140 of 231 PageID #:148
14

account (XXXXXX5950)—an approximately $47,300 outgoing wire transfer was made 

to an account in Nigeria at Access Bank PLC in Lagos to the beneficiary IBEKIE.

29. Based on my training and experience, knowledge of this investigation, 

and conversations with other investigators, I know that criminal enterprises involved 

in fraud routinely attempt to conceal the origins of illegally obtained money, including 

through transfers of funds between accounts belonging to fictional business entities, 

or wire transfers to foreign banks. Here, as demonstrated above, accounts in the name 

of HALL & HALL—a fictional business entity associated with IBEKIE, ANIUKWU, 

and ASANJI—received tens of thousands of dollars in fraudulently obtained funds 

between mid-April and early-May, 2018. Between on or about May 1 and May 3, 2018, 

tens of thousands of dollars were withdrawn from these accounts as checks, or in cash 

withdrawals falling below FinCEN’s reporting threshold for CTRs. The withdrawals 

were, in turn, re-deposited into other accounts in the name of HALL & HALL or 

ASANJI at other banks. Further, during an approximately two-day period between 

on or about May 2 and May 3, 2018, tens of thousands of dollars from HALL & HALL 

or ASANJI bank accounts were wire-transferred to foreign bank accounts in 

IBEKIE’s name. Based on my training and experience, and conversations with other 

investigators involved in this matter, this sort of financial activity is consistent with 

a money-laundering scheme designed to hide the origins of funds obtained by fraud.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 141 of 231 PageID #:149
15

2. JENANT INC. / SETRACO SERVICES INC.

a. CORPORATE FORMATION

30. A search of ILSOS online databases disclosed Jenant Inc. (“JENANT”) 

was incorporated on or about December 4, 2018 with the ILSOS. Further, the ILSOS 

online databases list Jennifer GOSHA (“GOSHA”) as the registered agent with an 

address of “1419 N. Harlem Ave, Apt B, Oak Park, IL 60302” (i.e., the Harlem 

Premises).

31. ILSOS records obtained during the course of the investigation also 

reflect that Setraco Services Inc. (“SETRACO”) was incorporated on or about March 

4, 2019, with an agent name “Sammy Maxwell” (“MAXWELL”)1 and an agent address 

of “Unit 5” at the Lincoln Premises, a property previously associated with IBEKIE 

and ANIUKWU as noted in the Luciano Affidavit.

b. RECEIPT OF FUNDS FROM VICTIM INDIVIDUAL C.L.

32. On or about January 29, 2019, a checking account (XXXXXX9392) was 

opened in the name of JENANT at TCF Bank. The signature card for this account 

lists GOSHA as the authorized signer and owner of JENANT. The signature card also 

lists the Harlem Premises as the address for both GOSHA and JENANT. 

33. On or about March 5, 2019, a checking account (XXXXXX7097) was 

opened in the name of SETRACO at TCF Bank. The signature card for this account 

lists “SAMMY MAXWELL” as the authorized signer and owner of SETRACO. The 

 

1 MAXWELL is believed to be an alias of ANIUKWU based on records and bank-security 

footage obtained during the course of this investigation and further described in Section 

II.C.2.c, below.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 142 of 231 PageID #:150
16

signature card lists “Unit 5” at the Lincoln Premises as the address for both 

MAXWELL and SETRACO.

34. On or about March 8, 2019, the TCF Bank account (XXXXXX9392) in 

the name of JENANT received a wire transfer from Victim Individual C.L. for 

approximately $6,405. On or about March 27, 2019, a deposit was made to the same 

account for approximately $97,500. The deposit item was a cashier’s check 

(#41816725) dated March 26, 2019 issued by International Bank of Commerce (“IBC 

Bank”) payable to JENANT in the amount of $97,500. The cashier’s check lists the 

remitter as Victim Individual C.L.

35. On or about March 14, 2019, the TCF Bank account (XXXXXX7097) in 

the name of SETRACO received a wire transfer from Victim Individual C.L. for 

approximately $22,962.75. On or about March 27, 2019, a deposit was made to the 

same account for approximately $80,000. The deposit item was a cashier’s check 

(#6851701494) dated March 25, 2019 issued by Wells Fargo Bank payable to 

SETRACO in the amount of $80,000. The cashier’s check lists the remitter as Victim 

Individual C.L.

36. On or about June 14, 2019, an investigator contacted Victim Individual 

C.L., who confirmed filing a report with the San Antonio Police Department on or 

about March 31, 2019, in which s/he reported receiving a solicitation letter from a 

John Delon (“DELON”) of TD Canada Trust Bank, apprising Victim Individual C.L. 

that s/he had a possible family member who died intestate with an unclaimed account 

in the amount of $9.2 million. In the report, Victim Individual C.L. said s/he sent 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 143 of 231 PageID #:151
17

funds as requested to TCF Bank account XXXXX7097 in the name of SETRACO, as 

well as another account in the name of JENANT located in Illinois. Victim Individual 

C.L. further provided investigators with documents bearing the name Pierre 

DELOUIS and the email address pdelouis@hallhallchamber.com (the same putative 

attorney used to defraud Victim Individuals J.B. and C.H., as noted in Sections 

III.B.3.c and III.B.6.b of the Luciano Affidavit, as well as in Section II.C.1.b, above).

c. DISPOSITION OF FUNDS FROM VICTIM INDIVIDUAL C.L.

37. A review of bank records for the TCF Bank account (XXXXXX9392) in 

the name of JENANT shows that on or about March 11, 2019—approximately three 

days after the account received a wire transfer from Victim Individual C.L. in the 

amount of $6,405—an approximately $5,000 cash withdrawal was made. A copy of 

the withdrawal ticket bears GOSHA’s name. Further review shows that the funds 

received from Victim Individual C.L. on or about March 27, 2019, via cashier’s check 

in the amount of approximately $97,500, remained in the TCF Bank account 

(XXXXXX9392) until approximately October 23, 2019. On or about April 1, 2019, IBC 

Bank sent a Hold Harmless and Indemnification Agreement to TCF Bank Fraud 

Protection Services requesting that the funds be returned. On or about October 23, 

2019, TCF Bank Fraud Protection Services sent a letter to IBC Bank confirming 

payment of the hold-harmless claim. On or about the same date, TCF Bank issued a 

cashier’s check (#306010267) payable to IBC Bank in the amount of approximately 

$97,500. The memo line states, “RE: REF CXXXXXXX DXXX, C38210208.” 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 144 of 231 PageID #:152
18

38. A review of bank records for the TCF Bank account (XXXXXX7097) in 

the name of SETRACO shows that on or about March 14 and March 15, 2019—around 

the same time the account received the wire transfer from Victim Individual C.L.—

several withdrawals were made from the account as follows:

a. On or about March 14, 2019, an approximately $10,138 

withdrawal was made. A copy of the withdrawal ticket bears the name “Sammy M.” 

and shows that approximately: (1) $6,000 was withdrawn in cash (and thus not 

subject to FINCEN’s CTR threshold); and (2) $4,138 was withdrawn as an official 

check (#305943184) made payable to EREP Acquisition Management LLC. The 

official check (#305943184) was redeposited into the SETRACO TCF Bank account 

(XXXXXX7097) on or about the same date it was issued. The check was endorsed by 

“Sammy M.” and the endorsement included the notation, “not use for the purpose

[sic]”;

b. On or about March 14, 2019, an approximately $500 ATM 

withdrawal was made from the account;

c. On or about March 15, 2019, an approximately $2,650 cash 

withdrawal (not subject to FINCEN’s CTR threshold) was made from the account. A 

copy of the withdrawal ticket bears the name “Sammy M”;

d. On or about March 15, 2019, an approximately $4,138 outgoing 

wire transfer was made from the account for the benefit of EREP Acquisition 

Management LLC; and

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 145 of 231 PageID #:153
19

e. On or about March 15, 2019, an approximately $8,500 outgoing 

wire transfer was made to an account in Nigeria at Access Bank PLC to the 

beneficiary IBEKIE. 

39. A review of bank records for the TCF Bank account (XXXXXX7097) in 

the name of SETRACO shows several withdrawals were made after the account 

received funds from Victim Individual C.L. on or about March 27, 2019, via cashier’s 

check in the amount of $80,000 as follows:

a. On or about March 27, 2019, an approximately $3,500 cash 

withdrawal (not subject to FINCEN’s CTR threshold) was made from the account. A 

copy of the withdrawal ticket bears the name “Sammy M”;

b. On or about March 29, 2019, an approximately $9,000 cash 

withdrawal (not subject to FINCEN’s CTR threshold) was made from the account. A 

copy of the withdrawal ticket bears the name “Sammy M”;

c. On or about March 29, 2019, an approximately $25,000 outgoing 

wire transfer was made to an account in Nigeria at Access Bank PLC to the 

beneficiary IBEKIE; and

d. The remainder of the funds received from Victim Individual C.L. 

remained in the account until on or about July 26, 2019, when an official check 

(#105071730) was issued by TCF Bank payable to SETRACO in the approximate 

amount of $47,630 in order to close the account. 

i. On or about September 23, 2019, a checking account 

(XXXXXXXX1606) was opened in the name SETRACO at US Bank. The signature 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 146 of 231 PageID #:154
20

card for this account lists MAXWELL (believed to be the same person as ANIUKWU, 

for the reasons below) as the authorized signer and President of SETRACO. 

ii. On or about September 23, 2019, a deposit was made to US 

Bank account (XXXXXXXX1606) for approximately $47,630. The deposit item was a 

cashier’s check (#105071730) dated on or about July 26, 2019, issued by TCF Bank 

payable to SETRACO in the approximate amount of $47,630, and appears to be the 

same check withdrawn from the SETRACO TCF Bank account (XXXXXX7097), as 

discussed above.

iii. On or about September 30, 2019, the US Bank account 

(XXXXXXXX1606) was closed and a cashier’s check (#4319502287) was issued by US 

Bank payable to SETRACO in the approximate amount of $47,427.50, in order to 

close the account. 

1) On or about October 2, 2019, an individual 

identifying himself as SAMMY MAXWELL cashed a US Bank cashier’s check 

(#4319502287) dated on or about September 30, 2019, made payable to SETRACO in 

the approximate amount of $47,427.50 at PLS Financial Services, which appears to 

be the same check as mentioned above, withdrawn from the SETRACO US Bank 

account (XXXXXXXX1606). 

2) Photos and video of the foregoing transaction were 

obtained from PLS Financial Services. Based on my training and experience, 

knowledge of the investigation, conversations with other investigators involved in 

this matter, and general familiarity with ANIUWKU’s appearance from photographs 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 147 of 231 PageID #:155
21

and records obtained over the course of the investigation, the individual in the PLS 

Financial Services photos and video—who identified himself as SAMMY 

MAXWELL—appears to be ANIUKWU.

3) The individual presented a Nigerian passport 

(#AXXXX8278) in the name of MAXWELL bearing a picture that was similar in 

appearance to ANIUKWU. 

4) The individual provided the Lincoln Premises as his 

address and provided phone number (630) XXX-3378. During a CBP border 

inspection, on or about November 8, 2019, ANIUKWU was in possession of a phone 

using number (630) XXX-3378, as further described in Section III.A.1 of the Luciano 

Affidavit. T-Mobile records identify ANIUKWU as the subscriber associated with this 

phone number. 

40. Based on my training and experience, as with the above-mentioned 

financial transactions using HALL & HALL bank accounts, this sort of financial 

activity is consistent with a money-laundering scheme designed to hide the origins of 

fraudulently obtained funds.

3. SAMCORD INC.

a. CORPORATE FORMATION

41. On or about June 5, 2018, Samcord Inc. (“SAMCORD”) was incorporated 

with the ILSOS. Its articles list “Emeka Toni Ibe” as the registered agent and 

incorporator, with an address of 4935 Washington Boulevard, Unit 2, in Chicago, 

Illinois. The name Emeka Toni Ibe appears to be a possible variation of IBEKIE’s 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 148 of 231 PageID #:156
22

name, reflecting IBEKIE’s middle name (i.e., “Emeka”), followed by a nickname of 

IBEKIE’s first name (i.e., “Anthony”), and a shortened version of IBEKIE’s surname.

b. RECEIPT OF FUNDS FROM VICTIM INDIVIDUAL A.W.

42. On or about June 25, 2018, a checking account (XXXXXX8376) was 

opened in the name of SAMCORD at Fifth Third Bank. One of the signature cards 

for this account lists IBEKIE as the authorized signer, while a second card lists 

IBEKIE and GOSHA as authorized signers.

43. On or about July 6 and July 9, 2018, the Fifth Third Bank account 

(XXXXXX8376) mentioned above received wire transfers from Victim Individual A.W. 

for approximately $9,228.07 and $15,771.93.

44. On or about October 24, 2018, Victim Individual A.W. filed a complaint 

with the Internet Crime Complaint Center, claiming that s/he had fallen victim to a 

romance scam resulting in a loss of approximately $178.030.07. In the complaint, 

Victim Individual A.W. reported meeting an individual by the purported name 

Matthew Russo (“RUSSO”) on the online dating website OKCupid.com. According to 

the complaint, RUSSO claimed that he was a fund manager with Ventcore Portfolio 

(“Ventcore”) in Kent, England.

45. Victim Individual A.W. reported RUSSO was going to leave Ventcore 

after the death of his mother and was involved in an arrangement with an individual 

from Dubai, whereby RUSSO was set to receive a substantial sum of funds but could 

not do so due his employment with Ventcore. So, RUSSO arranged for Victim 

Individual A.W. to be the owner of the shares worth approximately $11 million, to be 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 149 of 231 PageID #:157
23

deposited in a bank in Switzerland. Victim Individual A.W. was required to pay to 

open an account in order to withdraw the funds. Victim Individual A.W. reported that

additional funds were needed to pay the “Cost of Transaction,” to move the funds into 

his/her account in the United States, adding that after the payment was made, s/he 

was informed that there was a “STOP ORDER” on the funds from the United States 

government.

46. On or about August 22, 2019, agents conducted a telephonic interview 

of Victim Individual A.W., who confirmed s/he filed the complaint and verified the 

information in the complaint was correct. Further, Victim Individual A.W. said that 

s/he had believed s/he was in a relationship with RUSSO, but later came to believe it 

was a scam after his/her brother brought up concerns regarding the transactions. 

Victim Individual A.W. explained s/he confronted the scammers and asked for his/her 

money back. The scammers initially agreed but required additional funds as part of 

the process to return the funds. Victim Individual A.W. estimated s/he lost over 

$267,000 as a result of the scheme.

c. DISPOSITION OF FUNDS FROM VICTIM INDIVIDUAL A.W.

47. A review of bank records for the SAMCORD Fifth Third Bank account 

shows that on or about July 6, 2018—the same day the account received the wire from 

Victim Individual A.W.—an approximately $5,000 cash withdrawal (not subject to 

FinCEN’s CTR threshold) was made from the account. A copy of the withdrawal ticket 

bears IBEKIE’s name.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 150 of 231 PageID #:158
24

48. A review of bank records for the SAMCORD Fifth Third Bank account 

shows that on or about July 9, 2018—the same day the account received the wire from 

Victim Individual A.W.—an approximately $9,000 cash withdrawal (not subject to 

FinCEN’s CTR threshold) was made from the account. No associated drawer name 

was available on the withdrawal item produced by Fifth Third Bank.

49. Based on my training and experience, as with the above-mentioned 

financial transactions using HALL & HALL, SETRACO, and JENANT bank 

accounts, this sort of financial activity is consistent with a money-laundering scheme 

designed to hide the origins of fraudulently obtained funds.

D. UNDERCOVER INVESTIGATION

1. OVERVIEW

50. In or around May 2019, agents conducted a trash pull at the Lincoln 

Premises, a property previously associated with IBEKIE and ANIUKWU, as noted in 

the Luciano Affidavit. Among other things, agents recovered form letters from the 

trash, addressed to multiple individuals as part of an apparent inheritance-fraud 

scheme. Over the course of the investigation, agents recovered similar form letters

from other locations, which ultimately led to an undercover operation to initiate

contact with the putative sender of the letters. That undercover operation culminated 

with the June 2020 controlled delivery of a USPS Express Parcel package to the 

Harlem Premises, which contained a cashier’s check for a payment made as part of 

an inheritance-fraud scheme.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 151 of 231 PageID #:159
25

51. As detailed below, this undercover operation—in combination with other 

information obtained in the investigation, including subscriber information and IP 

addresses for email accounts used to communicate with the undercover agent, IP 

addresses tracking the USPS Express Parcel as part of the controlled delivery, and 

physical surveillance—established probable cause that the Oxbow Premises, 

Weber Premises, and Harlem Premises each contain evidence, fruits, and 

instrumentalities of fraud. 

2. HISTORICAL INVESTIGATION OF INHERITANCE-SCAM LETTERS

a. TRASH PULL AT THE LINCOLN PREMISES

52. On or about May 1, 2019, agents obtained the trash abandoned outside 

the curtilage of the Lincoln Premises. In that trash, agents found numerous relevant 

items of evidence, including multiple letters addressed to various individuals from a 

John DELON (the same individual involved in an inheritance-fraud scheme targeting 

Victim Individual C.L., as discussed in Section II.C.2.b, above), which were stamped 

with the logo for TD Canada Trust, a financial institution based out of Canada. The 

letters inform the addressees that DELON obtained their contact information while 

searching for the next of kin to a deceased customer of TD Canada Trust—with a 

similar name as each addressee—who died intestate leaving his/her bank account, 

containing approximately $9.2 million, with an open-beneficiary status. The letter 

offered to present the addressee to the bank as the next of kin to claim the dormant 

account and to share the funds with the addressee. Further, the letters requested 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 152 of 231 PageID #:160
26

that each addressee respond to the email address for DELON specified in the letter, 

to indicate the addressee’s readiness to proceed with the transaction.

53. During the May 1, 2019 trash pull at the Lincoln Premises, agents also 

found ripped up envelopes bearing a return address of Box 707, Wheaton, Illinois 

60187. Based on information developed in the investigation to date, agents are aware 

that similar letters have been returned to Box 707, Wheaton, Illinois, which is the 

address for the Office of the Circuit Court Clerk for DuPage County. (Agents have not 

determined, however, why this particular return address for the Circuit Court Clerk 

was used on the subject letters.) Further, agents recovered papers with handwritten 

notes, including one bearing username “JohnJeanDelon Gmail Account,” password 

“JohnJean5206.”

a. As noted previously, “5206” is the numerical street address for the 

Lincoln Premises, the same location where the above-mentioned trash pull occurred.

b. LETTERS RECEIVED BY DUPAGE COUNTY STATE’S 

ATTORNEY OFFICE

54. On or about February 25, 2020, two letters similar to those recovered 

during the Lincoln Premises trash pull were returned to 503 North County Farm 

Road, Wheaton, Illinois, which is the address for the DuPage County State’s Attorney 

Office. (Again, agents have not yet determined why this particular return address for 

the DuPage County State’s Attorney Office was used on the subject letters.) Further, 

on or about March 18, 2020, one similar letter was returned to the same address noted 

above for the DuPage County State’s Attorney Office. The letters were addressed to 

various individuals from a Peter Pfizer (“PFIZER”); they were also stamped with the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 153 of 231 PageID #:161
27

logo for Standard Chartered, a financial institution based out of England. The letters 

inform the addressees that PFIZER obtained their contact information while 

searching for the next of kin to a deceased customer of Standard Chartered, with a 

similar name as each addressee, who died intestate leaving his/her bank account (the 

“Inheritance Account”), containing approximately $11.6 million, with an openbeneficiary status. The letter offered to present the addressee to the bank as the next 

of kin to claim the Inheritance Account and to share the funds with the addressee. 

Further, the letters requested that each addressee respond to PFIZER at the email 

address Ppfizer456@aol.com, to indicate the addressee’s readiness to proceed with the 

transaction.

a. Agents submitted the two returned letters along with associated 

envelopes containing the letters obtained, on or about February 25, 2020, to the IRSCI National Forensic Laboratory (the “IRS-CI NFL”) for fingerprint analysis, on or 

about March 6, 2020. Results of the fingerprint analysis were received on or about 

June 4, 2020. The IRS-CI NFL obtained fingerprint exemplars bearing the name 

Anthony E. Ibekie (FBI# XXXXXXFD1) from the Federal Bureau of Investigation 

Next Generation Identification Automated Fingerprint Identification System (the 

“FBI NGI AFIS”). The IRS-CI NFL processed both letters and both envelopes for 

latent prints. Suitable latent prints developed during processing were searched in the 

FBI NGI AFIS database and compared to the exemplars obtained for IBEKIE. 

Results of the fingerprint analysis showed that one latent print located on one of the 

envelopes was made by Anthony E. Ibekie (FBI# XXXXXXFD1).

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 154 of 231 PageID #:162
28

i. Based on my training and experience, conversations with 

IRS-CI NFL personnel, conversations with other law enforcement agents, and a 

review of information obtained from www.fbi.gov/services/cjis/fingerprints-and-otherbiometrics/ngi, FBI NGI AFIS is an electronic repository containing biometric and 

criminal-history information maintained and made available to the criminal-justice 

community by the Federal Bureau of Investigation. The system uses a fingerprintmatching algorithm to compare latent prints to exemplars maintained in the FBI NGI 

AFIS database. Users can search latent images against the criminal, civil, and 

Unsolved Latent File repositories. A search of law-enforcement databases showed 

that FBI# XXXXXFD1 is associated with IBEKIE, and that IBEKIE has a criminal 

history as cited herein and in the Luciano Affidavit. Based on this information, I know 

that fingerprint exemplars for IBEKIE would be located in the criminal repository of 

the FBI NGI AFIS database.

3. COMMUNICATIONS INCIDENT TO UNDERCOVER OPERATION

55. On or about May 1, 2020, an IRS-CI Special Agent operating in an 

undercover capacity (the “UCA”) sent an email to Ppfizer456@aol.com in response to 

one of the letters received at the DuPage County State’s Attorney Office, purporting 

to be a relative of one of the addressees, Victim Individual W.B.2 The UCA informed 

PFIZER that s/he handles the affairs of Victim Individual W.B. and would like to 

proceed with the transaction on behalf of Victim Individual W.B.

 

2 Unless otherwise noted, the UCA’s communications with PFIZER or other co-conspirators 

throughout the undercover operation occurred via email.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 155 of 231 PageID #:163
29

56. On or about May 1, 2020, the UCA received a response from PFIZER, 

who was using Ppfizer456@aol.com. The response included an attachment reiterating 

and further expounding on information provided in the initial letter regarding the 

Inheritance Account. The attachment instructed the UCA to provide her/his full 

name, address, and mobile number. It also instructed the UCA to confirm her/his 

willingness and ability to handle the transaction and her/his willingness to sign a 

non-disclosure agreement. On or about May 3, 2020, the UCA responded with 

answers to PFIZER’s questions.

57. On or about May 5, 2020, the UCA received a Confidentiality and Trust 

Agreement, also referred to as a Non-Disclosure Agreement in the text of the contract 

(the “NDA”), from PFIZER via email with instructions to sign and return the NDA. 

The NDA stated, in pertinent part, that Victim Individual W.B. agrees to share the 

total amount received—$11.6 million plus accumulated interest—with PFIZER in the 

following ratio: 60% for Victim Individual W.B. and 40% for PFIZER. The NDA was 

signed by PFIZER and dated on or about May 5, 2020. The NDA contained a signature 

line denoting that the UCA should sign on behalf of Victim Individual W.B. On or 

about May 6, 2020, the UCA signed and returned the NDA to PFIZER.

58. On or about May 14, 2020, the UCA received an email from PFIZER 

acknowledging receipt of the NDA. Attachments to the email included an Application 

for Transfer of the Estate of My Relative Late Mr. SXXXXXXX BXXXX (the “Bank 

Application”) addressed to The Manager of Operations at the Unclaimed Estate 

Department (the “UED”) of Standard Chartered Group, as well as a Death Certificate 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 156 of 231 PageID #:164
30

for SXXXXXXX BXXXX, the putative deceased customer of Standard Chartered with 

the Inheritance Account. In the email, PFIZER instructed the UCA to sign the Bank 

Application laying claim to the money in the Inheritance Account and to email the 

Bank Application to ued@standardgroupservices.com, with the Death Certificate and 

a copy of the UCA’s identification. On or about May 16, 2020, the UCA submitted all 

documents to ued@standardgroupservices.com, as instructed by PFIZER.

59. On or about May 18, 2020, the UCA received confirmation from 

Wyashika Sellar (“SELLAR”), who purported to be Manager of Operations for the 

UED of Standard Chartered, using ued@standardgroupservices.com to communicate 

with the UCA. Attached to the email was a letter from SELLAR and a questionnaire 

(the “Bank Questionnaire”) bearing the logo of Standard Chartered Bank. The letter 

acknowledged receipt of the Bank Application and instructed the UCA to complete 

the Bank Questionnaire and return it to ued@standardgroupservices.com. 

60. The Bank Questionnaire included various questions pertaining to 

SXXXXXXX BXXXX’s personal information, details surrounding his death, details 

surrounding the Inheritance Account, and the UCA’s personal information. On or 

about May 19, 2020, the UCA forwarded the Bank Questionnaire to PFIZER 

requesting assistance with the questions pertaining to SXXXXXXX BXXXX. On or 

about May 19, 2020, the UCA received an email from PFIZER containing the answers 

to the Bank Questionnaire along with instructions to return the completed Bank 

Questionnaire to the bank immediately. On or about May 20, 2020, the UCA emailed 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 157 of 231 PageID #:165
31

the completed Bank Questionnaire to ued@standardgroupservices.com and notified 

PFIZER that the Bank Questionnaire had been submitted. 

61. On or about May 22, 2020, the UCA received an email from SELLAR 

confirming successful completion of the Bank Questionnaire. Attached to the email 

was a letter from SELLAR and a Deceased Estate Administration packet bearing the 

logo of TD Canada Trust. The SELLAR letter confirmed accurate completion of the 

Bank Questionnaire and instructed the UCA to contact Standard Chartered’s affiliate 

bank, TD Canada Trust. The SELLAR letter provided a contact email for TD Canada 

Trust of ued@tdcanadagroup.com. Several victims cited in the Luciano Affidavit (see 

Sections III.B.3.c, III.B.6.b, and III.B.7.b, therein) were also instructed to correspond 

with ued@tdcanadagroup.com. The Deceased Estate Administration packet provided 

informational material on claiming estates of people who die without known blood 

relatives and without leaving a will. On or about May 22, 2020, the UCA forwarded 

the information received from SELLAR to PFIZER.

62. On or about May 24, 2020, the UCA received an email from PFIZER 

which included an attachment, Referral Letter and Release of Estate, addressed to 

the UED of TD Canada Trust. PFIZER instructed the UCA to email the Referral 

Letter and Release of Estate, the SELLAR letter confirming successful completion of 

the Bank Questionnaire, and the Death Certificate to ued@tdcanadagroup.com. On 

or about May 27, 2020, the UCA emailed the documents as instructed by PFIZER to 

ued@tdcanadagroup.com.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 158 of 231 PageID #:166
32

63. On or about May 27, 2020, the UCA received an email from PFIZER 

instructing her/him to contact PFIZER at peterp968@yahoo.com for all future 

communications.

64. On or about May 27, 2020, the UCA received an email from Nikka Avis 

(“AVIS”), who purported to be the Manager of Operations for the UED of TD Canada 

Trust, using ued@tdcanadagroup.com to communicate with the UCA. The email 

confirmed receipt of the documents sent by the UCA on or about May 27, 2020, and 

instructed the UCA to retain the services of a Canadian attorney to administer the 

estate. AVIS recommended DELOUIS, a putative attorney with the law firm HALL 

& HALL, and provided pdelouis@hallhallchamber.com as a contact email address for 

DELOUIS. Numerous victims cited in the Luciano Affidavit (see Sections III.B.3.c 

and III.B.6.b, therein), as well as in this affidavit (see Sections II.C.1.b and II.C.2.b, 

above), were similarly instructed to correspond with DELOUIS, HALL & HALL, and 

pdelouis@hallhallchamber.com.

65. On or about May 28, 2020, the UCA forwarded the information from 

AVIS to PFIZER. In turn, PFIZER responded to the UCA on or about the same date,

instructing her/him that a Canadian lawyer is needed and that it is best to use the 

putative attorney, DELOUIS, as recommended by AVIS. Attached to the email was a 

letter (the “Representation Letter”) drafted to DELOUIS to be signed by the UCA 

requesting representation in the matter. PFIZER instructed the UCA to send the 

Representation Letter to DELOUIS.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 159 of 231 PageID #:167
33

66. On or about May 29, 2020, the UCA had a recorded phone call with 

PFIZER, who contacted the UCA from a private number. During the call, PFIZER 

instructed the UCA to send the Representation Letter to DELOUIS, the putative 

attorney. Further, PFIZER explained that DELOUIS would handle everything with 

the bank on their behalf, adding that the bank would not require any money to be 

paid and that arrangements could be made for money owed to DELOUIS to be taken 

out of the funds from the Inheritance Account. PFIZER also said that he used a calling 

card to contact the UCA, because it is an international call and thus cheaper to use a 

calling card. PFIZER then said that the use of the calling card was why his phone 

number showed up as private. PFIZER provided the following international cell 

phone number to the UCA to contact him if needed: +44-XXX-XXX-0817. However, 

PFIZER recommended that the UCA email him if he needed to speak with him, and 

PFIZER would call him using the calling card, because it would be cheaper.

67. On or about May 30, 2020, the UCA sent the Representation Letter to 

DELOUIS at email address pdelouis@hallhallchamber.com. The UCA received a 

response from DELOUIS, who was using pdelouis@hallhallchamber.com, on or about 

the same date. The response informed the UCA that DELOUIS intended to verify the 

existence of the Inheritance Account with the Ministry of Finance and visit TD 

Canada Trust to present himself as the UCA’s solicitor. DELOUIS stated he would 

contact the UCA at a future date with further instructions to pursue the case.

68. On or about June 1, 2020, the UCA received an email from DELOUIS, 

attaching an Attorney Retainer Agreement (the “Retainer Agreement”) that the UCA 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 160 of 231 PageID #:168
34

was instructed to sign and return. DELOUIS also said that he would forward bankaccount information for the payment of fees outlined in the Retainer Agreement upon 

receipt of the signed contract. The Retainer Agreement, in turn, provided that the 

Inheritance Account had supposedly been verified by the Ministry of Finance and TD 

Canada Trust and contained approximately $13,400,820 with accumulated interest. 

The Retainer Agreement further provided that HALL & HALL would receive a 1.5% 

commission of the total sum to be paid, after the UCA received the funds from the 

Inheritance Account. The Retainer Agreement outlined two mandatory government 

fees (the “Government Fees”) totaling approximately $6,400 that must be paid by the 

UCA prior to receiving the funds in the Inheritance Account, as follows:

a. An alleged Probate Registry Processing Fee to be paid to the 

Canadian Government through one of their accredited payment-receiving brokers, for 

approximately $3,900; and

b. An alleged Change of Ownership Processing Fee to be made 

available to HALL & HALL to process the claim, for approximately $2,500.

69. On or about June 2, 2020, the UCA forwarded the Retainer Agreement 

to PFIZER asking if the Government Fees could be taken out of the funds from the 

Inheritance Account. On or about the same date, the UCA received an email response 

from PFIZER, who stated that he would see if the Government Fees could be taken 

out of the funds from the Inheritance Account. PFIZER added that he would pay 40% 

of the Government Fees if they could not be deducted from the Inheritance Account.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 161 of 231 PageID #:169
35

70. On or about June 5, 2020, the UCA emailed the signed Retainer 

Agreement to DELOUIS and requested the bank-account information for payment of 

the Government Fees. On or about the same date, the UCA notified PFIZER via email 

the signed Retainer Agreement had been sent to DELOUIS.

71. On or about June 5, 2020, the UCA had a recorded phone call with 

PFIZER, who was using an unknown number. During the conversation, PFIZER 

instructed the UCA regarding what to say to bank personnel when the UCA wires 

money to pay the Government Fees. To that end, PFIZER told the UCA to inform the 

bank that the UCA was wiring money to purchase goods or merchandise. Specifically, 

PFIZER stated the following, in form or substance:

But here’s what I want to tell you though. ’Cause I’m a banker, 

part of our job is that, um, when a customer comes to the bank, 

our job is to make sure that we discourage the customer. The bank 

does whatever they have to do to keep their customer safe. So, 

when you go into the bank and you’re having a conversation with 

any of these representatives be careful the kind of words you are 

using. What I would advise is, um, when you, when it comes to 

why you’re sending the money the purpose of the sending is to for 

purchase of goods or purchase of, uh, merchandise. That way it 

doesn’t raise a whole lot of question and then them discouraging 

you from, ’cause sometimes they have a right to refuse. Just so 

you know.

72. At the end of his recorded phone call with the UCA on or about June 5, 

2020, PFIZER again reiterated the information further described in paragraph 71

and instructed the UCA not to give any details to the bank regarding wiring the 

Government Fees. Specifically, PFIZER stated the following, in form or substance:

Don’t forget what I mentioned to you about the banker who is 

gonna help you. Just, uh, don’t tell them any details. It’s for 

purchase of goods or merchandise and that should be enough.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 162 of 231 PageID #:170
36

73. On or about June 5, 2020, DELOUIS contacted the UCA via email and 

instructed the UCA to pay the Government Fees through a wire transfer. DELOUIS 

provided the following account information in the wire instructions:

Bank Name: Chase

Bank Address: 1212 Hobson Road Naperville, IL 60543

Account Number: XXXXX6830

Routing Number: 071000013

Swift Code: CHASUS33

Beneficiary Name: Emetech Solutions Inc

Beneficiary Address: 797 Oxbow Avenue Oswego, IL 60540 (i.e., 

the Oxbow Premises)

a. A search of ILSOS online databases disclosed Emetech Solutions 

Inc. (“EMETECH”) was incorporated on or about March 6, 2020. The ILSOS online 

databases list IBEKIE as the registered agent for EMETECH, with a listed address 

of 2726 Alyssa Drive, Naperville, Illinois 60565 (the “Alyssa Premises”), which is 

described further in the Luciano Affidavit as the address associated with fictional 

business entities under investigation, including SAMTONI Medical Equipment Inc.

A review of commercial databases, physical surveillance, analysis of telephone 

subscriber and toll records, as well as declarations made by IBEKIE to CBP officials 

indicate that IBEKIE lived at the Alyssa Premises until around late-2019 (described 

further in Section III.A.2 of the Luciano Affidavit). Further, physical surveillance, 

driver’s license information, analysis of telephone subscriber and toll records, as well 

as declarations made by ANIUKWU to CBP officials indicate that ANIUKWU lived

at the Alyssa Premises until around late-2019 (described further in Section III.A.1 of 

the Luciano Affidavit).

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 163 of 231 PageID #:171
37

b. On or about March 10, 2020, a checking account (XXXXX6830) 

was opened in the name of EMETECH at JP Morgan Chase Bank. The signature card 

for this account lists Ebuka Elton-John EGBUNAM (“EGBUNAM”) as the authorized 

signer and President of EMETECH. The signature card lists the Oxbow Premises

as the address for EMETECH.

74. On or about June 9, 2020, DELOUIS contacted the UCA via email and 

instructed the UCA to disregard the prior wire instructions and send payment of the 

Government Fees using a cashier’s check payable to Globayo LLC (“GLOBAYO”) with 

an address of the Alyssa Premises.

a. A search of ILSOS online databases disclosed that GLOBAYO 

was incorporated on or about June 1, 2017. The ILSOS online databases list Vincent 

Izuegbu (“IZUEGBU”) as the registered agent.

75. On or about the same date, DELOUIS sent a second email instructing 

the UCA to send the cashier’s check to 1419 N. Harlem Avenue, Suite B, Oak Park, 

Illinois 60302 (i.e., the Harlem Premises).

E. INVESTIGATION LEADING TO THE HARLEM PREMISES

1. CONTROLLED DELIVERY

76. On or about June 15, 2020, the UCA obtained a cashier’s check 

(#1689201121) from Bank of America in the amount of approximately $1,100, made 

payable to GLOBAYO (the “UCA Check”).

77. On or about June 16, 2020, with the assistance of the U.S. Postal 

Inspection Service (“USPIS”), agents prepared a U.S. Postal Service Express Mail 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 164 of 231 PageID #:172
38

parcel bearing tracking number EJ199352533US (the “Express Parcel”). Enclosed in 

the Express Parcel was the UCA Check. Before placing the UCA Check inside the 

Express Parcel, agents added a handwritten notation to the face of the UCA Check 

as follows: “For Pierre Delouis – Legal Fees.” The Express Parcel was addressed to 

“Globayo LLC” at the Harlem Premises.

78. On or about June 18, 2020, agents saw a silver BMW sport utility vehicle 

bearing Illinois license plate 38822US (the “BMW SUV”), driven by a black female,

arrive at the Harlem Premises. A search of law-enforcement databases disclosed 

Illinois license plate 38822US is registered to GOSHA at the Harlem Premises for 

a silver 2009 BMW vehicle.

3 The status of the registration is valid, with an expiration 

date of on or about July 31, 2020.

79. On or about June 18, 2020, subsequent to the arrival of the BMW SUV, 

a U.S. Postal Inspector operating in an undercover capacity as a U.S. Postal Carrier 

conducted a controlled delivery of the Express Parcel containing the UCA Check (the 

“Controlled Delivery”) to the Harlem Premises. The Postal Inspector was equipped 

with a covert device that documented the Controlled Delivery in a contemporaneous

audio-video recording, which I have reviewed.

80. From my review of the audio-video recording of the Controlled Delivery, 

conversations with other agents with knowledge of this investigation, and general 

 

3

. As discussed above, GOSHA is the registered agent for JENANT, the authorized signer of 

JENANT’s account with TCF Bank, and an authorized co-signer with IBEKIE on the 

SAMCORD checking account with Fifth Third Bank. Additionally, as outlined below, GOSHA 

owns the Harlem Premises, where DELOUIS instructed the UCA to mail a cashier’s check.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 165 of 231 PageID #:173
39

familiarity with GOSHA’s appearance based on photographs and driver’s license 

records obtained from law-enforcement databases, I know that GOSHA answered the 

door of the Harlem Premises.

81. The Postal Inspector questioned GOSHA regarding the Express Parcel 

being addressed to a business entity at a residential address. GOSHA looked at the 

label on the Express Parcel and confirmed the delivery address was correct. GOSHA 

further stated that she had been working from home. The Postal Inspector, and other 

agents who have reviewed the audio-video recording of the Controlled Delivery, 

understood GOSHA’s statement regarding working from home to be an explanation 

for receiving mail addressed to a business entity at her residence.

82. GOSHA questioned the Postal Inspector regarding the time of delivery,

stating that the Express Parcel should have arrived in the morning instead of in the 

afternoon. The Postal Inspector, and other agents who have reviewed the audio-video 

recording of the Controlled Delivery, understood GOSHA’s line of questioning to 

mean that she had knowledge of the Express Parcel and was anticipating its arrival.

83. GOSHA then signed a PS Form 3849 (USPS We Re-Deliver for You 

Notification) bearing Express Mail tracking number EJ199352533US. The signature 

appears to reflect “JGosha.” In the Printed Name field on the form, GOSHA wrote “J 

GOSHA.” The form was dated on or about June 18, 2020.

84. Upon signing PS Form 3849 dated on or about June 18, 2020, bearing 

Express Mail tracking number EJ199352533US, GOSHA took receipt of the Express 

Parcel and closed the door, carrying the Express Parcel into the Harlem Premises.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 166 of 231 PageID #:174
40

2. ADDITIONAL INFORMATION REGARDING THE HARLEM PREMISES

85. Agents have associated GOSHA, IBEKIE, and EGBUNAM with the 

Harlem Premises through multiple means. As described below, GOSHA owns and 

resides at the Harlem Premises. Additionally, IBEKIE and EGBUNAM both listed 

the Harlem Premises as their residence when applying to be added to the Oxbow 

Premises lease in April 2020 (EGBUNAM on or about April 27, 2020; and IBEKIE 

on or about April 29, 2020).

86. A review of LexisNexis Accurint for Law Enforcement4 (“Accurint”) 

indicates that GOSHA is associated with the Harlem Premises. Data obtained from 

Accurint shows that GOSHA is the owner of the Harlem Premises, and that the 

property was purchased by GOSHA on or about August 7, 2018. Additionally, data 

obtained from Accurint shows utility-connection records in the name of GOSHA at 

the Harlem Premises.

87. A search of law-enforcement databases shows the Harlem Premises 

listed as the address on GOSHA’s Illinois driver’s license. Additionally, GOSHA’s 

BMW SUV is registered in Illinois to the Harlem Premises.

 

4 LexisNexis Accurint for Law Enforcement is a commercially available database. According 

to risk.lexisnexis.com/products/accurint-for-law-enforcement, Accurint is a web-based 

application that provides law-enforcement personnel access to a comprehensive database of 

public records and proprietary information drawing from over 13,000 current and historical 

sources. Based on my training and experience, Accurint is used by law-enforcement personnel 

to identify various information and possible leads pertaining to subjects of criminal 

investigations including, but not limited to, associated addresses, telephone numbers, 

relatives, associates, assets, civil and criminal judgements, businesses, and utility records.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 167 of 231 PageID #:175
41

88. A search of the Cook County Treasurer online database returned 

property-tax bills for tax years 2018 and 2019 for the Harlem Premises. The 2019 

tax bill shows a due date of on or about August 3, 2020. Tax bills for both years are 

addressed to GOSHA at the Harlem Premises.

89. Records obtained from Nicor Gas show that GOSHA is the subscriber 

for utility services at the Harlem Premises. GOSHA contacted Nicor on or about 

September 5, 2018, to establish utility service for the Harlem Premises. 

F. INVESTIGATION LEADING TO THE OXBOW PREMISES

90. Agents have associated IBEKIE, ANIUKWU, GOSHA, and EGBUNAM

with the Oxbow Premises through multiple means. What follows in Sections II.F.1, 

II.F.2, and II.F.3, below, is a summary of: (1) subscriber information and IP addresses 

involved in the UCA investigation and Controlled Delivery, or belonging to IBEKIE,

that are associated with the Oxbow Premises; (2) surveillance tying the abovementioned co-conspirators to the Oxbow Premises; and (3) additional information 

obtained connecting the above-mentioned co-conspirators to the Oxbow Premises.

1. SUBSCRIBER INFORMATION AND IP ADDRESSES

a. EMAIL ADDRESSES USED TO COMMUNICATE WITH THE 

UCA

91. Subscriber information for Ppfizer456@aol.com—the initial account that 

PFIZER used in communicating with the UCA—was obtained from Oath Inc. The 

subject account showed a subscriber name of “PP.” No subscriber address information 

was available. Subscriber details list the following as the IP address where the email 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 168 of 231 PageID #:176
42

account was registered: 2600:1700:1cb0:2d80:555c:92f6:6900:98b (the “PFIZER AOL

IP”), on or about February 3, 2020.

92. Subscriber information obtained from AT&T showed that the PFIZER 

AOL IP was registered to ANIUKWU at the Oxbow Premises. 

93. Oath Inc. provided a summary of login activity for Ppfizer456@aol.com. 

Two subsequent logins (the “Additional PFIZER AOL IPs), among others, appeared 

for the email account as follows:

a. IP Address 2600:1700:1cb0:2d80:850:c377:df29:94b1, on or about 

February 17, 2020; and

b. IP Address 2600:1700:1cb0:2d80:50dc:fd5c:6b2e:8bc1, on or about 

March 4, 2020.

94. Subscriber information obtained from AT&T showed that the Additional 

PFIZER AOL IPs were registered to ANIUKWU at the Oxbow Premises.

95. Subscriber information for ued@standardgroupservices.com—the email 

address to which PFIZER directed the UCA to send the Bank Application, and which 

SELLAR, the purported Manager of Operations for the UED of Standard Chartered, 

used to communicate with the UCA—was obtained from Google. The subject account

showed a subscriber name of “Standard Group Services” with a creation date of March 

30, 2020. Google also provided a summary of login and failed-login activity for 

ued@standardgroupservices.com (the “Standard Group IPs”) as follows:

a. IP Address 2600:1700:1cb0:2d80:535:e383:36f2:dc2b, on or about 

March 30, 2020 (three logins and two failed logins);

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 169 of 231 PageID #:177
43

b. IP Address 2600:1700:1cb0:2d80:75b7:c9d7:a4c7:2589, on or 

about March 30, 2020 (two logins);

c. IP Address 2600:1700:1cb0:2d80:8138:73f:459b:1e7f, on or about 

March 30, 2020 (one login and two failed logins);

d. IP Address 2600:1700:1cb0:2d80:b454:753d:afb5:58ba, on or 

about March 31, 2020 (two logins);

e. IP Address 2600:1700:1cb0:2d80::fd65:528:7f05:23f, on or about 

April 1, 2020 (two logins); and,

f. IP Address 2600:1700:1cb0:2d80:249c:73de:393:f19b, on or about 

April 15, 2020 (one login).

96. Subscriber information obtained from AT&T showed that the Standard 

Group IPs were registered to ANIUKWU at the Oxbow Premises.

b. PERSONAL EMAIL ADDRESS OF IBEKIE

97. As noted in Section II.G.1.b, below, the account aibekie@gmail.com—

believed to be used by IBEKIE—has exchanged numerous communications with 

other co-conspirator email accounts in furtherance of the fraudulent schemes under 

investigation. Subscriber information for aibekie@gmail.com obtained from Google 

showed a subscriber name of “Anthony Ibekie.”

98. On or about June 15, 2020, the Honorable Rebecca R. Pallmeyer, Chief 

United States District Judge, issued pen-trap orders in Case No. 19 GJ 060

(collectively, the “Pen/Trap”), authorizing the installation and use of a pen register 

and trap-and-trace device on the following email accounts: saniukwu1@gmail.com, 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 170 of 231 PageID #:178
44

constantconsultant200@gmail.com, aristoblake@gmail.com, aibekie@gmail.com, and 

Ppfizer456@aol.com.

99. Results of the Pen/Trap showed that IP address 104.185.26.48 was used 

to login to aibekie@gmail.com on or about June 17, 2020. Subscriber records obtained 

from AT&T showed that this IP address is registered to ANIUKWU at the Oxbow 

Premises.

a. Subscriber records obtained from AT&T for the PFIZER AOL IP, 

the Additional PFIZER AOL IPs, and the Standard Group IPs were related to IPV6 

IP addresses; the subscriber for those IP addresses was ANIUKWU at the Oxbow 

Premises, as further described in Section II.F.1.a. Agents contacted an AT&T 

Representative on or about May 19, 2020, who explained that in order for AT&T to 

obtain IP subscriber records from their system, they must first convert the IPV6 IP 

address to an IPV4 IP address. The conversion of the IPV6 IP address to the IPV4 IP 

address for the PFIZER AOL IP, the Additional PFIZER AOL IPs, and the Standard 

Group IPs was listed on the records provided by AT&T as 104.185.26.48, which was 

the same IPV4 address listed on the login records provided by Google pursuant to the 

Pen/Trap for aibekie@gmail.com. The subscriber records for the PFIZER AOL IP, the 

Additional PFIZER AOL IPs, and the Standard Group IPs also contained information 

explaining that AT&T U-Verse customers have a unique IP directly provisioned to 

their account. Based on the information provided by the AT&T Representative as well 

as previously obtained subscriber records from AT&T, I know that: (1) the subscriber 

for the IP address obtained from Google for the login to aibekie@gmail.com, on or 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 171 of 231 PageID #:179
45

about June 17, 2020, is ANIUKWU at the Oxbow Premises; and (2) the specific 

email accounts listed above (ppfizer456@aol.com, ued@standardgroupservices.com, 

and aibekie@gmail.com) were accessed from the Oxbow Premises at different times 

between on or about February 3, 2020, and on or about June 17, 2020.

c. IP ADDRESS TRACKING THE CONTROLLED DELIVERY

100. USPIS obtained a list from their internal database of all IP addresses 

that were used to track the Express Parcel with tracking number EJ199352533US 

delivered to the Harlem Premises through the Controlled Delivery. One of the IP 

addresses used to track the Express Parcel on or about June 17, 2020 was 

2600:1700:1cb0:2d80:fc85:e5c4:3128:1fae. Subscriber records obtained from AT&T 

showed this IP address is registered to ANIUKWU at the Oxbow Premises.

a. As noted previously, the first four groups of the IPV6 IP addresses 

for the PFIZER AOL IP, the Additional PFIZER AOL IPs, and the Standard Group 

IPs were 2600:1700:1cb0:2d80. The first four groups of the IPV6 address used to track 

the Express Parcel was 2600:1700:1cb0:2d80, which is the same as the first four 

groups for the PFIZER AOL IP, the Additional PFIZER AOL IPs, and the Standard 

Group IPs. Based on the information provided by an AT&T Representative as well as 

previously obtained subscriber records from AT&T, I know that the subscriber for the 

IP address used to track the Express Parcel is ANIUKWU at the Oxbow Premises. 

I also know that the account aibekie@gmail.com and online tracking information for 

the Express Parcel were each accessed from the Oxbow Premises on or about June 

17, 2020, the day before the Controlled Delivery was completed.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 172 of 231 PageID #:180
46

d. IP ADDRESSES APPEARING TO ORIGINATE FROM THE 

UNITED KINGDOM

i. Subscriber Information, Internet Service 

Provider, and Virtual Private Network 

Services

101. Subscriber information for peterp968@yahoo.com (one of the accounts

that PFIZER used to communicate with the UCA prior to the Controlled Delivery) 

obtained from Oath Inc. showed a subscriber name of “Peter P.” No subscriber 

address information was available. Subscriber details list the following as the IP 

address where the account was registered: 5.62.43.171 on or about May 27, 2020. 

Oath Inc. provided a summary of login activity for peterp968@yahoo.com consisting 

of four subsequent logins on or about May 27, 2020, from IP address 185.51.228.240. 

Both IP addresses used to login to peterp968@yahoo are hereinafter collectively 

referred to as the “PFIZER Yahoo IPs.”

102. Google provided login activity for aibekie@gmail.com pursuant to the 

Pen/Trap which showed the following logins or attempted logins:

a. IP address 5.62.43.146 on or about June 17, 2020, with 62 logins 

or attempted logins; 

b. IP address 5.62.43.172 on or about June 17, 2020, with six logins 

or attempted logins; and

c. IP address 172.16.204.18 on or about June 18, 2020, with one 

login or attempted login. 

All three IP addresses, noted within this paragraph, used for logins or attempted 

logins to aibekie@gmail.com, are collectively referred to as the “IBEKIE Gmail IPs.”

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 173 of 231 PageID #:181
47

Pursuant to the Pen/Trap, Google provided information showing an Internet Service 

Provider (“ISP”) of AVAST Software (“AVAST”) and an ISP region of England for all

of the IBEKIE Gmail IPs.

103. USPIS obtained a list from their internal database of all IP addresses 

that accessed tracking information for the Express Parcel delivered to the Harlem 

Premises through the Controlled Delivery, including, in pertinent part:

a. IP address 77.234.43.132 three times on or about June 18, 2020;

b. IP address 5.62.43.160 one time on or about June 18, 2020; 

c. IP address 5.62.43.173 three times on or about June 17, 2020; and

d. IP address 77.234.43.188 one time on or about June 17, 2020. 

All four IP addresses noted within this paragraph that accessed tracking information 

for the Express Parcel are collectively referred to as the “Tracking IPs.”

104. An online search of publicly available databases showed the ISP for the 

PFIZER Yahoo IPs, IBEKIE Gmail IPs, and Tracking IPs is AVAST Software in the 

United Kingdom; therefore, subpoenas could not be issued to the ISP to obtain further 

information pertaining to these IP addresses.

a. However, based on information obtained from AVAST’s website 

(www.avast.com/en-us/secureline-vpn#pc), I know that AVAST is a public limited 

company incorporated and domiciled in the United Kingdom. AVAST offers a 

commercially available Virtual Private Network (“VPN”) service, which uses bankgrade encryption to tunnel communication through any network. AVAST advertises 

on its site, “You shouldn’t have to worry about employers, advertisers, governments, 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 174 of 231 PageID #:182
48

or your own ISP snooping on what you do online.” The AVAST site further states their 

VPN service “hides your online activities, doesn’t log websites visited or app usage,” 

and offers “DNS leak protection.”

b. According to a publicly available AVAST Annual Report for 2019, 

AVAST’s brand portfolio includes HMA. Based on my training and experience, the 

training and experience of other agents with whom I have spoken, and online 

research, I know that HMA is “HideMyAss!,” a commercially available VPN service.

105. IP subscriber information obtained for aibekie@gmail.com, further 

described above in Section II.F.1.b, shows an IP address associated with the Oxbow 

Premises was used to login to aibekie@gmail.com on or about June 17, 2020. On or 

about the same date and one day after, IP addresses registered to AVAST in the 

United Kingdom were also used with multiple logins or attempted logins to the same 

email account, as further described above in paragraphs 102 and 104. 

106. Subscriber information further described in Section II.F.1.c, above,

shows that an IP address associated with the Oxbow Premises was used to track 

the Express Parcel on or about June 17, 2020. On or about the same date and one day 

after, IP addresses registered to AVAST in the United Kingdom were also used to 

track the Express Parcel further described above in paragraphs 103 and 104.

ii. Historical Purchases of VPN Services by 

ANIUKWU, IBEKIE, and Their CoConspirators

107. Records for bank accounts associated with ANIUKWU, IBEKIE, and 

their co-conspirators show a history of purchasing VPN services as follows:

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 175 of 231 PageID #:183
49

a. On or about December 7, 2016, a Bank of America checking

account (XXXXXXXX5021) was opened in the name of “ANIUKWU Samuel Uchenna” 

at Bank of America. ANIUKWU was the only authorized signer on the signature card. 

On or about May 9, 2017, a purchase in the amount of approximately $59.88 was 

made from this account. The description of the purchase included “AVNGATE HMA 

PRO V.” Based on my training and experience, the training and experience of other 

agents with whom I have spoken, and online research, I know that “AVNGATE HMA 

PRO V” is Avangate (2checkout) HideMyAss! Pro VPN, which is a commercially 

available VPN service.

i. Avangate’s public website (www.avangatenetwork.com) 

notes that Avangate is an affiliate network of software and digital goods merchants. 

The website provided a list of Avangate’s merchants, which includes “HideMyAss by 

Avast Software.” As noted in Section II.F.1.d.i, above, IP addresses registered to 

AVAST Software were used to access peterp968@yahoo.com, aibekie@gmail.com, and 

tracking information for the Express Parcel.

b. On or about December 30, 2017, a BMO Harris Bank checking 

account (XXXXXX4741) was opened in the name of IBEKIE, who was the only 

authorized signer on the signature card. On or about May 24, 2018, a purchase in the 

amount of approximately $83.88 was made from this account. The description of the 

purchase included “AVNGATE HMA PRO VPN.” Based on my training and 

experience, the training and experience of other agents with whom I have spoken,

and online research, I know that “AVNGATE HMA PRO VPN” is Avangate

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 176 of 231 PageID #:184
50

(2checkout) HideMyAss! Pro VPN, the same commercially available VPN service that 

was purchased using ANIUKWU’s Bank of America account on or about December 7, 

2016. Further, information available on the public website HideMyAss.com indicates 

that, as of June 23, 2020, the cost of a one-year subscription for HideMyAss! Pro VPN 

is approximately $83.88.

c. On or about May 11, 2019, a BMO Harris Bank checking account 

(XXXXXX5874) was opened in the name of Berger Services Inc. (“BERGER”). 

Tonyanika Fogle (“FOGLE”) was the only authorized signer listed on the signature 

card.5 On or about May 30, 2019, a purchase in the amount of approximately $114.37 

was made from this account. The description of the purchase included “2COCOM 

HMA PRO VPN.” Based on my training and experience, the training and experience 

of other agents with whom I have spoken, and online research, I know that “2COCOM 

HMA PRO VPN” is Avangate (2checkout) HideMyAss! Pro VPN, the same 

commercially available VPN service that was purchased using ANIUKWU’s Bank of 

America account on or about December 7, 2016, and IBEKIE’s BMO Harris account 

on or about December 30, 2017.

d. Based on my training and experience and the training and 

experience of other agents with whom I have spoken, I know that VPNs can be used 

 

5 As noted in Section III.A.2 of the Luciano Affidavit, documents filed with the United States 

Citizenship and Immigration Services indicate that IBEKIE was married to FOGLE from on 

or about April 27, 2001 through April 7, 2006. Bank records for the BMO Harris Bank account 

in BERGER’s name—for which FOGLE is the sole signatory—also reflect outgoing wire 

transfers to foreign bank accounts in IBEKIE’s name, including as recently as September 11, 

2019.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 177 of 231 PageID #:185
51

to change the appearance of an individual’s geographic location in order to conceal 

their identity and remain anonymous on the Internet. As noted above, bank records 

show that ANIUKWU, IBEKIE, and their co-conspirators purchased VPN services

offered by AVAST Software in the past. Here, over the same two-day period in June 

2020, IP addresses associated with aibekie@gmail.com, PFIZER’s email addresses 

used to communicate with the UCA, and tracking delivery of the Express Parcel, 

resolved to both the Oxbow Premises and AVAST Software in the United Kingdom. 

Based on my training and experience and the training and experience of other agents 

with whom I have spoken, I believe that any United Kingdom-associated IP addresses 

mentioned herein during the period of June 17, 2020, and June 18, 2020, likely reflect 

the use of a VPN for purpose of masking the true physical location of the users’ online 

activity, including those related to UCA communications and the Controlled Delivery.

2. SURVEILLANCE AT THE OXBOW PREMISES

108. Physical surveillance indicates that IBEKIE resides at the Oxbow 

Premises. ANIUKWU has not been seen at the Oxbow Premises during the belowdescribed instances of physical surveillance conducted by agents (though multiple IP 

addresses associated with account activity noted above are subscribed to ANIUKWU 

at the Oxbow Premises). A summary of surveillance activity is as follows:

a. On or about January 23, 2020, law-enforcement personnel saw a 

beige Mercedes Benz sport utility vehicle (the “MB SUV”) bearing Wisconsin license 

plate AFX7998 parked at the Oxbow Premises. A search of law-enforcement 

databases disclosed Wisconsin license plate AFX7998 is registered to IBEKIE for a 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 178 of 231 PageID #:186
52

beige 2007 Mercedes Benz with an expiration date of July 25, 2020. The status of the 

registration is Suspended-Emissions Suspension. On the same date, law-enforcement 

personnel saw a black Mercedes Benz sedan (the “MB Sedan”) bearing Illinois license 

plate 455508 parked at the Oxbow Premises. A search of law-enforcement 

databases disclosed Illinois license plate 455508 is registered to ASANJI for a black 

2008 Mercedes-Benz 4-door with a status of Expired. IBEKIE has been known to 

drive the MB Sedan, as detailed in Section III.A.4 of the Luciano Affidavit.

b. On or about January 26, 2020, the MB Sedan was seen at the 

Oxbow Premises.

c. On or about the following dates, the MB SUV was seen at the 

Oxbow Premises: January 26, 2020; February 3, 2020; February 9, 2020; February 

23, 2020; March 14, 2020; March 24, 2020; March 26, 2020; March 30, 2020; April 24, 

2020; May 16, 2020; June 6, 2020; June 7, 2020; June 8, 2020, June 13, 2020, and 

July 1, 2020.

d. On or about June 5, 2020, law-enforcement personnel saw the MB 

SUV enter the parking lot of the apartment complex of the Oxbow Premises and 

park there. The driver’s side window of the MB SUV was down, and law-enforcement 

personnel saw a black male driving the vehicle. Based on their general familiarity 

with IBEKIE’s appearance from photographs and driver’s license records obtained 

from law-enforcement databases, law-enforcement personnel were able to positively 

identify the driver as IBEKIE. Law-enforcement personnel also saw IBEKIE exit the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 179 of 231 PageID #:187
53

vehicle after parking, retrieve an unknown item from the backseat of the vehicle, and 

walk towards the Oxbow Premises.

e. On or about June 8, 2020, law-enforcement personnel saw the MB 

SUV enter the parking lot of the apartment complex of the Oxbow Premises and 

park there. A black male was seen exiting the MB SUV. The individual entered a 

garage unit that appeared to be an attached garage for the Oxbow Premises. Later, 

on the same date, law-enforcement personnel saw a different black male exit the same 

attached garage unit and enter a white Kia Soul (the “Kia”). The Kia was seen driving 

to and parking at the management office of the apartment complex. After a short 

time, the Kia returned to and parked at the Oxbow Premises. Law-enforcement 

personnel saw a black male exit the Kia and enter the attached garage unit of the 

Oxbow Premises.

i. The Kia did not have a front or back license plate. Lawenforcement personnel saw a temporary registration from Texas bearing the number 

4166428 with an expiration date of on or about July 22, 2020, in the rear window of 

the Kia. Agents were unable to locate registration information in law-enforcement 

databases matching the information on the temporary Texas registration. An 

Operations Specialist was contacted at the Texas Department of Motor Vehicles (“TX 

DMV”) regarding the temporary registration. Personnel at the TX DMV confirmed 

there is no record of that temporary registration in their system.

ii. Based on additional records obtained in this investigation, 

discussed further in the following subsection, IBEKIE and EGBUNAM each

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 180 of 231 PageID #:188
54

submitted rental applications for the Oxbow Premises indicating that the Kia 

belongs to EGBUNAM.

f. On or about June 9, 2020 and July 1, 2020, law-enforcement 

personnel observed the Kia parked at the Oxbow Premises.

3. ADDITIONAL INFORMATION REGARDING THE OXBOW PREMISES

109. A review of Accurint indicates that both IBEKIE and ANIUKWU are 

associated with the Oxbow Premises. Data obtained from Accurint shows IBEKIE 

as a registered agent for African Money Credit Union Inc. with the Oxbow Premises

listed as the address for the registered agent and for the business. Further, data 

obtained from Accurint shows utility-connection records in the name of ANIUKWU 

at the Oxbow Premises.

110. Information obtained from Continental Properties, the propertymanagement company for the Oxbow Premises, showed that the Oxbow Premises

is leased to GOSHA (who received the Controlled Delivery at the Harlem Premises)

with a lease term of December 28, 2019 through March 27, 2021. 

a. On or about April 29, 2020, IBEKIE applied to be added to the 

lease for the Oxbow Premises, listing his relationship to the primary applicant (i.e., 

GOSHA) as “Spouse.” IBEKIE provided the following information further solidifying 

other connections developed throughout the course of the investigation:

i. Email address: aibekie@gmail.com (further described in 

Section II.F.1.b, above);

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 181 of 231 PageID #:189
55

ii. Phone number: (630) XXX-4947 (further described in 

Section III.A.2 of the Luciano Affidavit);

iii. Current Address: the Harlem Premises, stating the 

property is owned, not rented;

iv. Current Employer: NU-MEKS Healthcare with an address 

of the Lincoln Premises (further described in Section III.B.1 of the Luciano Affidavit); 

and

v. Vehicle Information:

1) 2007 beige Mercedes GL450 with Wisconsin license 

plate AFX7998 and owner listed as IBEKIE (further described in Section II.F.2)

2) 2008 black Mercedes S550 with Illinois license plate 

455508 and owner listed as IBEKIE (further described in Section II.F.2)

3) 2012 white Kia Soul with no plate listed and owner 

listed as EGBUNAM (further described in Section II.F.2).

b. On or about April 27, 2020, EGBUNAM applied to be added to the 

lease of the Oxbow Premises. EGBUNAM listed his relationship to the primary 

applicant (i.e., GOSHA) as “Son.” In this application, EGBUNAM provided the 

following information further solidifying other connections developed throughout the 

course of the investigation:

i. Current Address: the Harlem Premises, stating the 

property is owned, not rented; and,

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 182 of 231 PageID #:190
56

ii. Vehicle Information: 2012 white Kia Soul with “temporary 

tag” listed for the license plate number and owner listed as EGBUNAM (further 

described in Section II.F.2).

111. On or about January 29, 2020, IBEKIE was arrested by the Carol 

Stream Police Department on charges of domestic battery, interfering with reporting, 

assault, criminal damage to property, and trespass to real property. A review of the 

police report from the Carol Stream Police Department disclosed IBEKIE provided 

the Oxbow Premises as his residence. A review of the bail bond associated with this 

arrest disclosed that ANIUKWU posted bail for IBEKIE.

112. Records obtained from Nicor Gas show ANIUKWU is the subscriber for 

utility services at the Oxbow Premises. ANIUKWU contacted Nicor on or about 

December 27, 2019 to stop service on the Alyssa Premises, where both ANIUKWU 

and IBEKIE are believed to have resided until around late-2019 (described further in 

Section III.A.1 and III.A.2 of the Luciano Affidavit). ANIUKWU established utility 

service with Nicor for the Oxbow Premises on or about January 6, 2020. 

a. Nicor records list ANIUKWU’s phone number as (630) XXX-4947. 

On or about October 31, 2019, CBP officials conducted an inspection of IBEKIE at the 

Chicago O’Hare International Airport (“O’Hare”) upon his arrival into the United 

Sates (described further in the Luciano Affidavit in Section III.A.2 and III.E). During 

the inspection, IBEKIE had a Samsung SM-G965V phone in his possession utilizing 

phone number (630) XXX-4947. T-Mobile records identified SAMTONI Medical 

Equipment Inc (discussed further in Sections III.A.2 and III.B.4 of the Luciano

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 183 of 231 PageID #:191
57

Affidavit) at the Alyssa Premises as the subscriber for (630) XXX-4947. Nicor records

also list ANIUKWU’s email address as aristoblake@gmail.com (further described in 

Section II.G.1.b, below). 

G. INVESTIGATION LEADING TO THE WEBER PREMISES

113. Agents have associated ANIUKWU with the Weber Premises through 

multiple means. On or about April 21, 2020, agents executed the Gmail Warrant, 

authorizing the search of two of ANIUKWU’s accounts: saniukwu1@gmail.com (the 

“ANIUKWU Gmail Account”) and constantconsultant200@gmail.com (the “Constant 

Gmail Account”). What follows in Sections II.G.1, II.G.2, II.G.3, II.G.4, and II.G.5,

below, is a summary of: (1) subscriber information and IP addresses associated with 

the ANIUKWU Gmail Account and the Constant Gmail Account; (2) relevant 

communications identified pursuant to a review of the ANIUKWU Gmail Account

and the Constant Gmail Account; and (3) additional information obtained connecting 

ANIUKWU to the Weber Premises.

1. THE ANIUKWU GMAIL ACCOUNT

a. SUBSCRIBER INFORMATION AND IP ADDRESSES

114. Information obtained from Google for the ANIUKWU Gmail Account

showed that the account is subscribed to ANIUKWU. 

115. Google provided a summary of login and failed-login activity for the 

ANIUKWU Gmail Account which included, among others, the following:

a. IP Address 2600:1700:1fc0:9510:4145:2e88:aa06:d998 on or about

December 30, 2019 (two logins).

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 184 of 231 PageID #:192
58

116. Subscriber information obtained from AT&T showed the ANIUKWU 

Gmail Account IP was registered to ANIUKWU at the Weber Premises.

b. RELEVANT COMMUNICATIONS

117. The complete review and analysis of the ANIUKWU Gmail Account has 

not been completed; however, the excerpts below provide a limited sampling of some 

communications related to fraudulent activity discovered in the account. The excerpts 

listed below are not intended to provide an exhaustive compilation of all fraudulent 

emails in the ANIUKWU Gmail Account.

118. On or about May 15, 2017, an email with the subject line “Fwd: seeeeeee” 

was sent from the ANIUKWU Gmail Account to IBEKIE at email address 

aibekie@gmail.com. The body of the email contained the following text:

---------- Forwarded message---------

From: KENNEDY FORD <kennedyford@consultant.com>

Date: Mon, May 15, 2017 at 2:05 PM

Subject: seeeeeee

To: saniukwu1@gmail.com

The email included a Microsoft Word attachment titled “nnukwu ego (1) 

(1).....chumo.” The attachment included a template letter bearing the logo of Kennedy 

Ford Associates. The letter was dated on or about March 5, 2017, and signed by 

“Kennedy Ford” (“KENNEDY”). The letter informs the addressee that KENNEDY is 

the personal attorney of a deceased individual sharing the same last name as the 

addressee, and that the deceased individual left behind a bank account, containing 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 185 of 231 PageID #:193
59

approximately £6.85 million, with an open-beneficiary status. The letter offered to 

present the addressee to the bank as the next of kin to claim the dormant account 

and to share the funds with the addressee. Further, the addressee was instructed to 

reply to kennedyford@consultant.com, to express his/her interest in pursuing the 

claim. The substantive content of the letter was similar to the Standard Chartered 

letters described in multiple previous and subsequent sections.

119. On or about June 7, 2017, an email with the subject line “Proposal” was 

received by the ANIUKWU Gmail Account from IBEKIE at aibekie@gmail.com. The 

email instructed ANIUKWU to review the attached document and was signed by 

IBEKIE as “Director,” “Green Visions International.” In the signature block of the 

email, IBEKIE included the phone number (630) XXX-0699, which is also referenced 

and further described in Section III.A.2 of the Luciano Affidavit. The email had an

attachment titled “Samuelaniukwuscan0068,” which included a letter addressed to 

ANIUKWU from IBEKIE, dated on or about June 7, 2017, informing ANIUKWU that 

he has been nominated as a potential member of the board of directors for African 

Money Union Inc, which is referenced and further described in Section III.E.2 of the 

Luciano Affidavit. IBEKIE signed the letter as the “CEO” of African Money Union.

120. On or about June 10, 2018, an email with the subject line “CHICAGO 

INVESTMENT SUMMIT UPDATES: PROPOSAL TO APPOINT SENIOR SPECIAL 

ADVISERS (FOR FOREIGN INVESTMENTS) WITHOUT PAY” was received by the 

ANIUKWU Gmail Account from IZUEGBU at vincent@globayo.com. IBEKIE was 

also a recipient on the email. The email was addressed to an unidentified recipient at 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 186 of 231 PageID #:194
60

[Foreign Official 1]@anambrastate.gov.ng. The body of the email was addressed to 

“His Excellency [Foreign Official 1],” “Executive Governor Anambra State,” proposing

the appointment of IZUEGBU, IBEKIE, and ANIUKWU as “Senior Special Advisers 

to the State.” The signature block of the email includes the following: “Dr. Anthony 

Ibekie,” “Team Member”; “Vincent Izuegbu, PhD,” “Team Leader”; and “Honorable 

Samuel Aniukwu,” “Team Member.” Below are relevant excerpts of background 

information regarding IZUEGBU, IBEKIE, and ANIUKWU provided in the email 

and connections to other information developed during the course of the investigation:

a. IZUEGBU is the “President & CEO” of GLOBAYO. 

i. GLOBAYO is the company to which the UCA was directed

to pay Government Fees via cashier’s check, and IZUEGBU is the registered agent 

for GLOBAYO according to online ILSOS databases, as further described in Section 

II.D.3. The UCA Check was made payable to GLOBAYO and delivered to the Harlem 

Premises through a Controlled Delivery, as further described in Section II.E.1.

b. IBEKIE is the “CEO of African Money Union” and ANIUKWU is 

the “Chief Operating Officer of African Money Union.”

i. African Money Union is referenced and further described 

in Section III.E.2 of the Luciano Affidavit.

121. An unsent email was located in the Drafts folder of the ANIUKWU 

Gmail Account with subject line “LAW FIRM,” dated on or about February 14, 2019. 

The body of the email contained a response letter from DELOUIS stating that 

DELOUIS intended to verify the existence of the inheritance account with the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 187 of 231 PageID #:195
61

Ministry of Finance and visit TD Canada Trust to present himself as the addressee’s 

solicitor. The letter was identical in substantive content to the response received by 

the UCA from DELOUIS, further described in Section II.D.3. Minor variations 

existed relating to dates and personalized information.

122. An unsent email was located in the Drafts folder of the ANIUKWU 

Gmail Account with subject line “APPLICATION FOR LAWYER,” dated on or about 

February 15, 2019. The body of the email contained a letter addressed to “Pierre” 

requesting legal representation in claiming an inheritance that was identical in 

substantive content to the Representation Letter provided to the UCA by PFIZER to 

send to DELOUIS, further described in Section II.D.3. Minor variations existed 

similar in nature to those noted in previous paragraphs.

123. An unsent email was located in the Drafts folder of the ANIUKWU 

Gmail Account with the subject line “NEED A QUESTION,” dated on or about 

February 15, 2019. The body of the email contained a forwarded message from 

pdelouis@hallhallchamber.com to an individual believed to be a victim of the scheme 

(Victim Individual A.S.). The forwarded email was dated on or about August 9, 2018,

and instructed Victim Individual A.S. to sign and return a retainer agreement. It 

further informed Victim Individual A.S. that instructions would be forthcoming on 

account information to pay approximately $12,810 needed to submit a “bundle” to a 

bank for a “funds release.” The forwarded email was signed by DELOUIS. As further 

described in Section II.D.3, the UCA was also instructed by DELOUIS to sign a 

Retainer Agreement and pay fees to release the funds from the Inheritance Account.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 188 of 231 PageID #:196
62

124. An unsent email was located in the Drafts folder of the ANIUKWU 

Gmail Account with subject line “answers in the questionnaire,” dated on or about 

July 25, 2019. The body of the email contained a list of answers that were identical 

in substantive content to the answers provided to the UCA by PFIZER in response to 

the Bank Questionnaire, further described in Section II.D.3. Minor variations existed; 

however, a comparison of the content of the documents is as follows:

Email Located in Draft Folder of the 

ANIUKWU Gmail Account

Email Received by the UCA

Ref:TDL05/2019/D3B0908

Mr.SXXXX &Mrs.XXXX GXXXXXX

1 Mr SXXXX GXXXXXX

2 USA

3 29/April/19XX

4 Extended Relative

5 70 years old (19XX-2009)

6 9th December 2009, Cardiac Arrest

7 Oil & Gas Engineer

8 No, he didn’t own a company

9 Not Applicable

10 US Dollar Daily interest Checking 

Account

11 71485448

12 London UK

13 Branch code and Institution number: 

609104

14 52-54 Stamford Street, London SE1 

9LX, United Kingdom

15 Yes, he was married to Mrs. RXXX

who died with their only daughter in a 

car crash

16 Yes, they had only one child, she died 

with her mother in the car crash.

Ref:TDL05/2020/D3B0908

Mr.SXXXX &Mrs.RXXX BXXXX

1. Mr SXXXX BXXXX

2. USA

3. 29/April/19XX

4. Extended Relative

5. 70 years old (19XX-2010)

6. 9th December 2010, Cardiac Arrest

7. Oil & Gas Engineer

8. No, he didn’t own a company

9. Not Applicable

10. US Dollar Daily interest Checking 

Account

11. 71485448

12. London UK

13. Branch code and Institution number: 

609104

14. 52-54 Stamford Street, London SE1 

9LX, United Kingdom

15. Yes, he was married to Mrs. RXXX

who died with their only daughter in a 

car crash

16. Yes, they had only one child, she died 

with her mother in the car crash.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 189 of 231 PageID #:197
63

125. On or about September 21, 2019, the ANIUKWU Gmail Account

received an email from aristoblake@gmail.com with the subject line “STANDARD.”

“HELLO” was typed in the body of the email, which included a Microsoft Word 

attachment titled “FM SC PFIZER.” The attachment included a letter bearing the 

Standard Chartered logo, dated on or about June 12, 2019, signed by “Mr. Peter 

Pfizer.” The addressee was instructed to reply to email address ppfizer@yandex.com. 

The substantive content of the letter was substantially the same as the one to which 

the UCA responded, further described in Section II.D.2.b and Section II.D.3. Minor 

variations existed between the two letters including the date of the letter, the 

addressee, the name and year of death of the purportedly deceased customer of 

Standard Chartered, and the email address of the sender. The first name of the 

purportedly deceased customer of Standard Chartered was, however, the same as the 

letter to which the UCA replied.

a. Based on my training and experience, as well as the training and 

experience of other agents with whom I have spoken, I know that Yandex is an 

Internet-services company headquartered in Russia, which maintains servers outside 

the United States; therefore, subpoenas could not be issued to Yandex to obtain 

further information pertaining to ppfizer@yandex.com.

b. Subscriber records for aristoblake@gmail.com obtained from 

Google show that the account is subscribed to “Aristo Blake,” with a recovery-email 

address of emekarn@yahoo.com. Subscriber records were also obtained from Google 

for aibekie@gmail.com, as noted previously, which show that account is subscribed to

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 190 of 231 PageID #:198
64

IBEKIE, with the same recovery-email address of emekarn@yahoo.com. Further, a

Lease Application Agreement obtained from Continental Properties—the propertymanagement company of the Weber Premises—submitted by ANIUKWU listed 

IBEKIE as ANIUKWU’s emergency contact and prior landlord, with a contact email 

address for IBEKIE at aristoblake@gmail.com.

126. On or about September 21, 2019, an email with the subject line “Fwd: 

STANDARD” was sent from the ANIUKWU Gmail Account to an unidentified 

recipient at seselambo@yahoo.com, with the following text in the body of the email:

Date: Sat, Sep 21, 2019 at 3:21 PM

Subject: STANDARD

To: <saniukwu1@gmail.com>

HELLO

The email appeared to be a forwarded copy of the email described in paragraph 125,

above, received by the ANIUKWU Gmail Account from aristoblake@gmail.com. The 

email included a Microsoft Word attachment titled “FM SC PFIZER.” The attachment 

included a letter bearing the Standard Chartered logo dated on or about June 12, 

2019, signed by “Mr. Peter Pfizer,” and appeared to be identical to the letter further 

described in paragraph 125, above. 

127. On or about December 19, 2019, an email with the subject line “Re. 

email” was sent from the ANIUKWU Gmail Account to an unidentified recipient at 

seselambo@yahoo.com. The body of the email contained the following text: “EMAIL 

ID. Peterpf172@gmail.com.” The email included a Microsoft Word attachment titled 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 191 of 231 PageID #:199
65

“FM SC PFIZER.” The attachment included a letter bearing the Standard Chartered 

logo dated June 12, 2019 signed by “Mr. Peter Pfizer,” and appeared to be identical 

to the letter further described in paragraph 125, above, received by the ANIUKWU 

Gmail Account from aristoblake@gmail.com.

128. On or about December 19, 2019, an email with the subject line “Re. 

Format” was sent from the ANIUKWU Gmail Account to an unidentified recipient at 

seselambo@yahoo.com. The body of the email contained the following text: “Lets start 

from here.” The email included a Microsoft Word attachment titled “FM SC PFIZER.”

The attachment included a letter bearing the Standard Chartered logo dated on or 

about June 12, 2019, signed by “Mr. Peter Pfizer,” and appeared to be identical to the 

letter further described in paragraph 125, above, received by the ANIUKWU Gmail 

Account from aristoblake@gmail.com.

129. On or about December 23, 2019, an email with the subject line “Re. 

format” was sent from the ANIUKWU Gmail Account to an unidentified recipient at 

seselambo@yahoo.com. The body of the email contained the following text: “Mmuo.”

The email included a Microsoft Word attachment titled “FM SC PFIZER.” The 

attachment included a letter bearing the Standard Chartered logo dated on or about 

June 12, 2019, signed by “Mr. Peter Pfizer,” and appeared to be identical to the letter 

further described in paragraph 125, above, received by the ANIUKWU Gmail Account

from aristoblake@gmail.com.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 192 of 231 PageID #:200
66

130. On or about December 23, 2019, an email with the subject line “Fwd: Re. 

email” was sent from the ANIUKWU Gmail Account to “Peter Pfizer” at 

peterpf172@gmail.com. The body of the email contained the following text: 

---------- Forwarded message---------

From: sese lambo <seselambo@yahoo.com>

Date: Mon, Dec 23, 2019 at 9:02 AM

Subject: Re: Re. email

To: SAMUEL ANIUKWU <saniukwu1@gmail.com>

On Thursday, 19 December 2019, 19:06:04 GMT, SAMUEL ANIUKWU 

<saniukwu1@gmail.com> wrote:

EMAIL ID. Peterpf172@gmail.com

The email included a Microsoft Word attachment titled “DXXXX AXXXXXXXX print.”

The attachment included approximately 198 letters addressed to various recipients 

in alphabetical order, all with last names starting with the letters A and B. All of the 

letters appeared identical with the exception of the addressee names. All of the letters 

bore the Standard Chartered logo and were dated on or about December 23, 2019,

signed by “Mr. Peter Pfizer.” The addressees of the letters were instructed to reply to 

email address ppfizer@yandex.com. The substantive content of the letters was 

substantially the same as the one to which the UCA responded, further described in 

Section II.D.2.b and Section II.D.3. Minor variations existed among the letters 

including the date of the letter, the addressee, the name and year of death of the 

purportedly deceased customer of Standard Chartered, and the email address of the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 193 of 231 PageID #:201
67

sender. The first name of the purportedly deceased customer of Standard Chartered 

was, however, the same as the letter to which the UCA replied.

131. On or about January 7, 2020, an email with the subject line “Fwd: 

Re.format” was sent from the ANIUKWU Gmail Account to an unidentified recipient 

at peterpf172@gmail.com. The body of the email contained the following text:

---------- Forwarded message---------

From: sese lambo <seselambo@yahoo.com>

Date: Tue, Jan 7, 2020 at 6:28 AM

Subject: Re: Re.format

To: SAMUEL ANIUKWU <saniukwu1@gmail.com>

Nnam print

On Friday, 27 December 2019, 12:10:41 GMT, sese lambo 

<seselambo@yahoo.com> wrote:

NEW ONE NNAM PRINT

On Monday, 23 December 2019, 13:45:53 GMT, SAMUEL ANIUKWU 

<saniukwu1@gmail.com> wrote:

Mmuo.

The email included a Microsoft Word attachment titled “RXXX CXXXXXX new year.”

The attachment included approximately 199 letters addressed to various recipients 

in alphabetical order, all with last names starting with the letters C and D. All of the 

letters appeared identical with the exception of the addressee names. All of the letters 

bore the Standard Chartered logo and were dated on or about January 7, 2020, signed 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 194 of 231 PageID #:202
68

by “Mr. Peter Pfizer.” The addressees of the letters were instructed to reply to email 

address peterpf172@gmail.com. The substantive content of the letters was 

substantially the same as the one to which the UCA responded, further described in 

Section II.D.2.b and Section II.D.3. Minor variations existed among the letters 

including the date of the letter, the addressee, the name and year of death of the 

purportedly deceased customer of Standard Chartered, and the email address of the 

sender. The first name of the purportedly deceased customer of Standard Chartered 

was, however, the same as the letter to which the UCA replied.

132. On or about January 16, 2020, an email with the subject line “Fwd: 

STANDARD” was sent from the ANIUKWU Gmail Account to an unidentified 

recipient at ekwyaniukwu4ever@gmail.com. The body of the email contained the 

following text:

---------- Forwarded message---------

From: SAMUEL ANIUKWU <saniukwu1@gmail.com>

Date: Sat, Sept 21, 2019 at 4:00 PM

Subject: Fwd: STANDARD

To: <seselambo@yahoo.com>

Date: Sat, Sep 21, 2019 at 3:21 PM

Subject: STANDARD

To: <saniukwu1@gmail.com>

HELLO

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 195 of 231 PageID #:203
69

The email appeared to be a forwarded copy of the email further described in 

paragraph 126 above sent by the ANIUKWU Gmail Account to an unidentified 

recipient at the email address seselambo@yahoo.com. The email included a Microsoft 

Word attachment titled “FM SC PFIZER.” The attachment included a letter bearing 

the Standard Chartered logo dated on or about June 12, 2019 signed by “Mr. Peter 

Pfizer,” and appeared to be identical to the letter further described in paragraph 125

above received by the ANIUKWU Gmail Account from aristoblake@gmail.com.

133. On or about January 16, 2020, an email with the subject line “Re,peter 

Nwanne” was sent from the ANIUKWU Gmail Account to an unidentified recipient 

at peterpf172@gmail.com. The body of the email was addressed to “TXXXXX

MXXXXXX” and contained a text version of the Standard Chartered letters described 

in the preceding paragraphs as email attachments. The email was signed “Mr. Peter 

Pfizer,” and directed responses to the email address peterpf172@gmail.com.

134. On or about January 16, 2020, an email was received by the ANIUKWU 

Gmail Account from an unidentified sender at ekwyaniukwu4ever@gmail.com. The 

body of the email was addressed to “TXXXXX MXXXXXX” and contained a text 

version of the Standard Chartered letters described in the preceding paragraphs as 

email attachments. The email was signed “Mr. Peter Pfizer” and directed responses 

to the email address ppfizer@yandex.com.

135. On or about January 25, 2020, an email with the subject line 

“Re.secound Reply” was sent from the ANIUKWU Gmail Account to an unidentified 

recipient at peterpf172@gmail.com. The body of the email contained text, the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 196 of 231 PageID #:204
70

substantive content of which was identical to the email attachment received by the 

UCA further described in Section II.D.3. Minor variations existed between the two 

documents including the addressee, the name and year of death of the purportedly 

deceased customer of Standard Chartered, and the email address of the sender. The 

first name of the purportedly deceased customer of Standard Chartered was, 

however, the same as in the letter to which the UCA replied.

136. On or about February 19, 2020, an email with the subject line “photo” 

was received by the ANIUKWU Gmail Account from an unidentified sender at 

peterpf172@gmail.com. The email was then forwarded from the ANIUKWU Gmail 

Account on the same day to an unidentified recipient at seselambo@yahoo.com. The 

body of the email contained the text “uchenna.” The email included a Microsoft Excel 

spreadsheet attachment titled “Uzo 03.” The attachment included a list containing 

approximately 1,000 names, all with last names beginning with the letters H through 

W, and corresponding mailing addresses located in approximately 49 different states.

137. On or about February 19, 2020, an email with the subject line “stamps” 

was received by the ANIUKWU Gmail Account from an unidentified sender at 

peterpf172@gmail.com, which was forwarded from the ANIUKWU Gmail Account on 

the same day to an unidentified recipient at Hallmark_security@hotmail.com. The 

body of the email contained the text “Emeka canada.” The email included two PDF 

attachments titled “mmagha” and “mmagha 2.” Relevant excerpts of the attachments 

included the following:

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 197 of 231 PageID #:205
71

a. A scan or picture of an envelope addressed to IBEKIE at the 

Lincoln Premises from the DuPage County Circuit Court Clerk with a return address 

of P.O. Box 707, Wheaton, Illinois, 60187-0707. This is the same return address that 

was used on inheritance-scam letters found in the trash pull at the Lincoln Premises,

and inheritance-scam letters that were returned undeliverable to the Office of the 

DuPage County Circuit Clerk, further described in Section II.D.2.

b. A scan or picture of a Nicor Gas bill addressed to Emperor Chills 

Inc. (“EMPERORCHILLS”) at the Lincoln Premises. As described in Section III.B.2 

of the Luciano Affidavit, EMPERORCHILLS—connected to IBEKIE through ILSOS 

records and to ANIUKWU through bank records—was involved in a business-emailcompromise scheme.

2. THE CONSTANT GMAIL ACCOUNT

a. SUBSCRIBER INFORMATION

138. Subscriber information for the Constant Gmail Account obtained from 

Google showed the account is subscribed to “Opia Samuel.”

a. The recovery-email address listed for the Constant Gmail Account

was greatland_uc@yahoo.co.uk. This was the same recovery address used for the 

ANIUKWU Gmail Account, for which ANIUKWU is the listed subscriber.

b. The recovery SMS phone number listed on the Constant Gmail 

Account is (630) XXX-3378. A device using this same phone number was found in 

ANIUKWU’s possession during a CBP inspection conducted on or around November 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 198 of 231 PageID #:206
72

8, 2019, and T-Mobile records obtained for this phone number identify ANIUKWU as 

the subscriber, as further described in Section III.A.1 of the Luciano Affidavit.

c. Google provided a summary of login and failed-login activity for 

the Constant Gmail Account which included, among others, two logins on or about 

December 11, 2019, from IP Address 2600:1700:1fc0:9510:984:60f8:414e:aa52 (the 

“Constant Gmail Account IP”).

139. Subscriber information obtained from AT&T showed the Constant 

Gmail Account IP was registered to ANIUKWU at the Weber Premises.

b. RELEVANT COMMUNICATIONS

140. The complete review and analysis of the Constant Gmail Account has 

not been completed; however, the excerpts below provide a limited sample of some 

communications related to fraudulent activity discovered in the Constant Gmail 

Account. The excerpts listed below do not in any way intend to provide an exhaustive 

compilation of all fraudulent emails in the Constant Gmail Account.

141. On or about June 11, 2017, the Constant Gmail Account received an 

email from aristoblake@gmail.com with the subject line “Emeka Canada.” There was 

an additional unidentified recipient on the email at Hallmark_security@hotmail.com. 

The body of the email contained the following text:

Emeka this is the review of what I did with respect to this format, 

kindly let me know your views, I believe you have sent to Sama the 

email and password, you can still include it here in you response.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 199 of 231 PageID #:207
73

I remember you mention that you already have the addresses, you 

will need to send them to me, so I can complete the merging and 

setting of the mail as it will be sent out to the recipient in a single 

window envelope.

The second attachment is how the direct mail will appear to the 

recipient when they receive and open the mail

Tony

Director

Green Visions International

The email contained two Microsoft Word attachments titled “Emeka Canada” and 

“Emeka Canada 2.” Both attachments included template letters, one formatted and 

one not formatted, purportedly from an account manager, Walter Viva (“VIVA”), with 

National Bank in Ontario, Canada. The substantive content of the letters was similar 

to the Standard Chartered letter to which the UCA responded, further described in 

Section II.D.2.b and Section II.D.3. The letters inform the addressee that VIVA 

obtained their contact information while searching for the next of kin to a deceased 

customer of National Bank, with a similar name as the addressee, who died intestate 

leaving his/her bank account, containing approximately $9.2 million, with an openbeneficiary status. The letter offered to present the addressee to the bank as the next 

of kin to claim the dormant account and to share the funds with the addressee.

142. On or about June 11, 2017, the Constant Gmail Account received 

another email from aristoblake@gmail.com with the subject line “Idea.” The 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 200 of 231 PageID #:208
74

unidentified recipient at Hallmark_security@hotmail.com was also included on this 

email. The body of the email contained the following text:

Emeka,

On another thought, since you have the direct mail addresses and 

I have sent you a sample of the merged email, i suggest you do the 

merging yourself and send me the already merged letter in a bulk 

of 100 each, then i can print it, place the stamp in the single 

window envelope and put them in the mail, i know you said you 

have 1500 direct mail addresses, that fine, when we exhaust it we 

can start using the 3000 (selective pre screened direct mail)I just

ordered.

God will have mercy on us one day.

Please forward our correspondences to Onowu

Here is our number

Tony 630XXX0699

Sama 630XXX5959

Onowu 080XXXX11430

143. On or about June 19, 2017, an unidentified sender at email address 

Hallmark_security@hotmail.com sent an email to the Constant Gmail Account and 

aristoblake@gmail.com with the subject line “see the attach....” The email included 

two attachments, one of which was a Microsoft Excel spreadsheet titled “1500.” The 

spreadsheet included a list of approximately 1,500 names and addresses. This email 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 201 of 231 PageID #:209
75

appeared to be a response to the email sent by aristoblake@gmail.com requesting 

addresses from “Emeka” to “complete the merging and setting of the mail.”

144. On or about July 13, 2018, the Constant Gmail Account received an 

email from Bank of America stating that the debit card associated with account 

(XXXXXXXX7376) in the name of ESIJEMINE Lucky Inc. has been mailed. On or 

about July 21, 2018, the Constant Gmail Account received an email from Bank of 

America stating that the online-banking password had been reset for the account 

(XXXXXXXX7376). This same account was connected to the receipt of fraudulently 

obtained funds from Victim Individual A.W. and is further described in in Section 

III.B.10.b of the Luciano Affidavit.

145. On or about July 26, 2018, the Constant Gmail Account received an 

email from JP Morgan Chase Bank notifying the recipient that a new debit/ATM/Prepaid card had been ordered for a bank account in the name of ESIJEMINE. On or 

about August 13, 2018, the Constant Gmail Account received an email from JP 

Morgan Chase notifying the recipient of an account adjustment made to the account 

(XXXXX2296) in the name of ESIJEMINE. This same account was connected to the 

receipt of fraudulently obtained funds from Victim Individual R.A. and is further 

described in Section III.B.10.c of the Luciano Affidavit.

146. On or about October 24, 2018, the Constant Gmail Account sent an email 

to an unidentified recipient at email address jacksonifeko@yahoo.com. The body of 

the email contained a chain of previous email communications between the Constant 

Gmail Account and jacksonifeko@yahoo.com. One of those previous emails included 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 202 of 231 PageID #:210
76

banking information for an account in the name of MEKAS Construction Inc. at Bank 

of America (XXXXXXXX1240). This same account was connected to the receipt of 

fraudulently obtained funds from Victim Business M.W. and is further described in 

Section III.B.3.b of the Luciano Affidavit.

147. On or about June 6, 2019, an email was sent from the Constant Gmail 

Account to an unidentified recipient at blackcatswith@gmail.com. The email informs 

the recipient that his/her “fund was deposited with TD Trust bank here in Canada.”

It further instructs the recipient to contact Nikki AVIS at ued@tdcanadagroup.com. 

The UCA also received communications from AVIS at ued@tdcanadagroup.com, as 

further described in Section II.D.3 above. The email was signed by “Sam Maxwell”—

believed to be an alias of ANIUKWU—who has received fraudulently obtained funds 

from Victim Individual C.L. as further described in Section II.C.2, above.

148. On or about June 6, 2019, the Constant Gmail Account sent an email to 

ued@tdcanadagroup.com with the subject line “Re...bank.” The body of the email 

contained the text, “Hello.” Several victims cited in the Luciano Affidavit (see Sections 

III.B.3.c, III.B.6.b, III.B.7.b therein), as well as the UCA (see Section II.D.3, above),

were also instructed to correspond with ued@tdcanadagroup.com.

149. On or about December 9, 2019, the Constant Gmail Account received an 

email from “Peter Pfizer” at email address peterpf172@gmail.com with the subject 

line “Re.ONE LOVE FOR OLU BANK.” The body of the email contained the following 

text: “This is for the money....anambrastate.” 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 203 of 231 PageID #:211
77

a. Based on my online research, I know that Anambra is a state in 

Nigeria. As further described in Section III.A of the Luciano Affidavit, several coconspirators involved in this scheme, including ANIUKWU and IBEKIE, are 

Nigerian nationals.

3. SURVEILLANCE AT THE WEBER PREMISES

150. Physical surveillance indicates that ANIUKWU resides at the Weber 

Premises. A summary of surveillance activity is as follows:

a. On or about April 5, 2020, law-enforcement personnel saw a red 

Toyota Corolla (the “Corolla”) bearing Illinois license plate BV89675 parked inside 

the garage at the Weber Premises. A search of law-enforcement databases disclosed 

that Illinois license plate BV89675 is registered to ANIUKWU and IBEKIE for a red 

2010 Toyota 4-Door with an expiration date of on or about September 30, 2020. The 

status of the registration is valid. 

b. On or about April 10, 2020, law-enforcement personnel observed 

the Corolla arrive and park at the Weber Premises.

c. On or about April 21, 2020, law-enforcement personnel saw the 

garage door open at the Weber Premises and a black male exit the garage. Based 

on their general familiarity with ANIUKWU’s appearance from photographs and 

driver’s license records obtained from law-enforcement databases, law-enforcement 

personnel were able to positively identify the male exiting the garage as ANIUKWU. 

ANIUKWU walked to the Corolla and got inside. ANIUKWU backed the Corolla up 

to the open garage door and exited the Corolla. ANIUKWU opened the trunk of the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 204 of 231 PageID #:212
78

Corolla and appeared to either load or unload unknown items to or from the trunk. 

ANIUKWU then got back in the Corolla and was seen leaving the Weber Premises

heading northbound on Weber Road.

d. On or about June 23, 2020, law-enforcement personnel saw the 

Corolla exit the garage at the Weber Premises. Law-enforcement personnel also 

saw the individual driving the vehicle. Again, based on general familiarity with 

ANIUKWU’s appearance from photographs and records obtained over the course of 

the investigation, the individual driving the Corolla appeared to be ANIUKWU.

Further, law-enforcement personnel confirmed that the license plate on the vehicle 

was Illinois license plate BV89675, registered to ANIUKWU and IBEKIE. Later, on 

or about the same date, law-enforcement personnel saw the Corolla return to the 

garage at the Weber Premises.

e. On or about June 29, 2020, law-enforcement personnel saw an 

open garage door at the Weber Premises. Law-enforcement personnel saw a black 

male exit the Weber Premises into the attached garage and enter the Corolla 

parked inside the garage. Law-enforcement personnel saw the individual driving the 

vehicle as it exited the main entrance of the apartment complex for the Weber 

Premises. Again, based on general familiarity with ANIUKWU’s appearance from 

photographs and records obtained over the course of the investigation, the individual 

driving the Corolla appeared to be ANIUKWU. Further, law-enforcement personnel 

confirmed that the license plate on the vehicle was Illinois license plate BV89675, 

registered to ANIUKWU and IBEKIE.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 205 of 231 PageID #:213
79

f. On or about July 7, 2020, law-enforcement personnel saw the 

Corolla exit the garage at the Weber Premises. Law-enforcement personnel also 

saw the individual driving the vehicle. Again, based on general familiarity with 

ANIUKWU’s appearance from photographs and records obtained over the course of 

the investigation, the individual driving the Corolla appeared to be ANIUKWU.

Further, law-enforcement personnel confirmed that the license plate on the vehicle 

was Illinois license plate BV89675, registered to ANIUKWU and IBEKIE.

4. RECORDS/COMMUNICATIONS WITH PROPERTY MANAGEMENT AT 

THE WEBER PREMISES

a. LEASE RECORDS OBTAINED FROM CONTINENTAL 

PROPERTIES

151. Information obtained from Continental Properties, the propertymanagement company for the Weber Premises, showed that the Weber Premises

is leased to ANIUKWU with a lease term of on or about November 15, 2019 through 

November 14, 2020. Continental Properties also provided a copy of ANIUKWU’s 

Illinois driver’s license that was obtained during the leasing process.

152. On or about November 14, 2019, ANIUKWU submitted an online 

application to Springs at Weber Road (i.e., the apartment complex where the Weber 

Premises is located). In this application, ANIUKWU provided the following 

information further solidifying other connections developed throughout the course of 

the investigation:

a. Email address: saniukwu1@gmail.com (i.e., the ANIUKWU 

Gmail Account further described in Section II.G.1, above);

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 206 of 231 PageID #:214
80

b. Phone number: (630) XXX-3378 (further described in Section 

III.A.1 of the Luciano Affidavit);

c. Current Address: the Alyssa Premises (further described in 

Section II.D.3, above);

d. Previous Address: the Lincoln Premises (further described in 

Sections II.C.2, II.C.3, and II.D.2, above);

e. Emergency Contact and Previous Landlord: IBEKIE with 

references to the Alyssa Premises and the Lincoln Premises. The phone number listed 

for IBEKIE is (630) XXX-4947 (discussed further in Section III.A.2 of the Luciano 

Affidavit). The email address listed for IBEKIE is aristoblake@gmail.com (further 

described in Section II.G.1.b, above);

f. Email address listed for ANIUKWU’s current employer shows 

constantconsultant200@gmail.com (the Constant Gmail Account further described in 

Section II.G.2, above); and

g. Vehicle Information:

i. 2010 red Toyota Corolla with Illinois license plate BV89675

(further described in Section II.G.3, above).

b. EMAIL COMMUNICATIONS FROM THE ANIUKWU GMAIL 

ACCOUNT TO SPRINGS AT WEBER ROAD

153. On or about April 3, 2020, an email with subject line “Springs at Weber 

Rd – COVID-19 Hardship Form” was received by the ANIUKWU Gmail Account from 

the Assistant Community Manager of Springs at Weber Road (i.e., the apartment 

complex where the Weber Premises is located). The ANIUKWU Gmail Account

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 207 of 231 PageID #:215
81

subsequently forwarded that email to “Peter Pfizer” at peterpf172@gmail.com on or 

about the same date. The email contained a PDF attachment, which included a form 

to be completed by ANIUKWU requesting certain relief in relation to his April 2020 

rent payment, due to ANIUKWU’s income allegedly being impacted by COVID-19.

154. On or about April 9, 2020, an email was sent from the ANIUKWU Gmail 

Account to the Assistant Community Manager of Springs at Weber Road with the 

subject line “Re.Samuel.” The email included a PDF attachment of the completed 

hardship form referenced in the preceding paragraph. On the form, ANIUKWU 

requested to make a reduced rent payment on or about April 1, 2020. 

155. On or about April 11, 2020, an email was received by the ANIUKWU 

Gmail Account from the Assistant Community Manager of Springs at Weber Road 

with the subject line “Springs at Weber Rd – COVID-19 Payment Plan.” The email 

included a payment plan for rent due in or around April 2020 for ANIUKWU to sign.

156. On or about April 16, 2020, an email was sent from the ANIUKWU 

Gmail Account to the Assistant Community Manager of Springs at Weber Road. The 

body of the email contained the following text: 

Good Morning JXXX.

I came to your office yesterday to drop my rent and I knocked hard at the 

door but no one answered, 

Kindly call me to schedule an appointment to drop the rent. 630-XXX3378 [further described in Section III.A.1 of the Luciano Affidavit]. 

Samuel.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 208 of 231 PageID #:216
82

5. ADDITIONAL INFORMATION REGARDING THE WEBER PREMISES

157. A review of Accurint indicates that ANIUKWU is associated with the 

Weber Premises. Data obtained from Accurint shows various utility-connection 

records in the name of ANIUKWU at the Weber Premises.

158. Records obtained from Nicor Gas show ANIUKWU is the subscriber for 

utility services at the Weber Premises. ANIUKWU contacted Nicor on or about 

November 15, 2019, to establish utility service for the Weber Premises. 

a. Nicor records list ANIUKWU’s phone number as (630) XXX-3378. 

During a CBP border inspection on or about November 8, 2019, ANIUKWU was in 

possession of a device using phone number (630) XXX-3378, as further described in 

Section III.A.1 of the Luciano Affidavit. T-Mobile records identify ANIUKWU as the 

subscriber for this phone number.

b. Nicor records list ANIUKWU’s email address as 

saniukwu1@gmail.com (i.e., the ANIUKWU Gmail Account further described in 

Section II.G.1, above). 

H. EVIDENCE OF FRAUD WILL BE FOUND AT THE OXBOW PREMISES, THE 

WEBER PREMISES, AND THE HARLEM PREMISES

159. Based on the foregoing facts, the facts set forth in the Luciano Affidavit, 

as well as my training and experience, my knowledge of this investigation, and my 

consultation with other agents, I believe that bank accounts associated with NUMEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, SAMCORD, 

ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, JENANT, SETRACO, 

EMETECH, GLOBAYO, and others are being used to facilitate mail and wire fraud, 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 209 of 231 PageID #:217
83

money laundering, and conspiracy to commit the foregoing offenses, through 

business-email compromise, romance-fraud, and investment-fraud schemes. As noted 

in this affidavit and in the Luciano Affidavit, each of the foregoing entities is 

associated with IBEKIE, ANIUWKU, GOSHA, EGBUNAM, and other coconspirators known and unknown.

160. Based on my training and experience, as well as the training and 

experience of other agents with whom I have spoken, I am aware that individuals 

engaged in financial activity—whether legitimate or fraudulent—typically maintain 

some form of accounting to track their transactions. These records can be formal 

books, or can be rudimentary in nature—meant to simply track income earned and 

expenses incurred—and can reflect evidence of the acquisition and disposition of 

criminally derived proceeds.

161. Generally, individuals, especially those who are involved in illicit 

financial transactions, maintain personal and business financial information in 

locations where it would be secure and readily accessible, such as in their residences

or vehicles, and—in the case of financial transactions involving online banking—on 

electronic devices such as computers, cell phones, or tablets near their person. Here, 

in particular, subjects of this investigation have been demonstrated to use vehicles 

registered to other individuals, or bearing what appear to be false or fictitious 

registration information. Such efforts to dissociate particular vehicles from particular 

persons are commonly used by persons involved in illicit financial transactions to 

avoid detection by law enforcement, including during use of a vehicle as part of the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 210 of 231 PageID #:218
84

illicit transactions, such as traveling to and from banks or financial institutions to 

deposit or withdraw fraudulently obtained funds, or traveling to and from residences 

of fellow co-conspirators.

162. Furthermore, based on my training and experience and information 

obtained from other law enforcement officers who investigate mail and wire fraud, 

money laundering, conspiracy to commit the foregoing offenses, and related crimes, I 

know the following:

a. It is common practice for individuals involved in mail and wire 

fraud to use and maintain computers, cellular phones, smartphones, and other digital 

devices. They often employ such devices for, among other things: (1) obtaining or 

storing personal victim profiles, including names, addresses, phone numbers, social 

security numbers, dates of birth, driver’s license or state identification numbers, alien 

registration numbers, passport numbers, employer or taxpayer identification 

numbers, bank account numbers, credit card numbers, email addresses, IP addresses, 

and PIN numbers or passwords for financial institutions or Internet service 

providers; (2) applying for, modifying, or maintaining bank accounts and/or credit 

card accounts to facilitate the receipt, transfer, or use of funds obtained from victims 

through fraudulent means; and (3) keeping records of their crimes.

b. Individuals who participate in fraudulent schemes, including 

those predicated upon online communications with potential victim individuals or 

businesses, often use digital devices to communicate with their co-conspirators by 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 211 of 231 PageID #:219
85

phone, email, and text message. Oftentimes, they also maintain telephone numbers 

of their co-conspirators in their cellular telephones or smartphones.

163. Based on my training and experience, the information disclosed in this 

affidavit as well as the Luciano Affidavit, and information related to me by other lawenforcement agents who specialize in the investigation of mail or wire fraud schemes 

and related offenses, it is likely that the Oxbow Premises, the Weber Premises, 

and the Harlem Premises, and any digital devices therein, contain evidence of the 

offenses described in Attachment B.

III. SPECIFICS REGARDING SEARCHES OF ELECTRONIC STORAGE

MEDIA

164. Based upon my training and experience, and the training and 

experience of specially trained personnel whom I have consulted, searches of evidence 

from electronic storage media commonly require agents to download or copy 

information from the electronic storage media and their components, or remove most 

or all electronic storage media items (e.g., computer hardware, computer software, 

computer-related documentation, and cellular telephones) to be processed later by a 

qualified computer expert in a laboratory or other controlled environment. This is 

almost always true because of the following: 

a. Electronic storage media can store the equivalent of thousands of 

pages of information. Especially when the user wants to conceal criminal evidence, 

he or she often stores it with deceptive file names. This requires searching authorities 

to examine all the stored data to determine whether it is included in the warrant. 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 212 of 231 PageID #:220
86

This sorting process can take days or weeks, depending on the volume of data stored, 

and it would be generally impossible to accomplish this kind of data search onsite.

b. Searching electronic storage media for criminal evidence is a 

highly technical process requiring expert skill and a properly controlled environment. 

The vast array of computer hardware and software available requires even computer 

experts to specialize in some systems and applications, so it is difficult to know before 

a search which expert should analyze the system and its data. The search of an 

electronic storage media system is an exacting scientific procedure which is designed 

to protect the integrity of the evidence and to recover even hidden, erased, 

compressed, password-protected, or encrypted files. Since electronic storage media 

evidence is extremely vulnerable to tampering or destruction (which may be caused 

by malicious code or normal activities of an operating system), the controlled 

environment of a laboratory is essential to its complete and accurate analysis.

165. In order to fully retrieve data from a computer system, the analyst needs 

all storage media as well as the computer. The analyst needs all the system software 

(operating systems or interfaces, and hardware drivers) and any applications 

software which may have been used to create the data (whether stored on hard disk 

drives or on external media).

166. In addition, electronic storage media such as a computer, its storage 

devices, peripherals, and Internet connection interface may be instrumentalities of 

the crime(s) and are subject to seizure as such if they contain contraband or were 

used to carry out criminal activity.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 213 of 231 PageID #:221
87

IV. PROCEDURES TO BE FOLLOWED IN SEARCHING ELECTRONIC

STORAGE MEDIA

167. Pursuant to Rule 41(e)(2)(B) of the Federal Rules of Criminal Procedure, 

this warrant will authorize the removal of electronic storage media and copying of 

electronically stored information found in the premises described in Attachment A-1, 

Attachment A-2, and Attachment A-3 so that they may be reviewed in a secure 

environment for information consistent with the warrant. That review shall be 

conducted pursuant to the following protocol. 

168. The review of electronically stored information and electronic storage 

media removed from the premises described in Attachment A-1, Attachment A-2, and 

Attachment A-3 may include the following techniques (the following is a nonexclusive list, and the government may use other procedures that, like those listed 

below, minimize the review of information not within the list of items to be seized as 

set forth herein):

a. examination of all the data contained in such computer hardware, 

computer software, and/or memory storage devices to determine whether that data 

falls within the items to be seized as set forth in Attachment B;

b. searching for and attempting to recover any deleted, hidden, or 

encrypted data to determine whether that data falls within the list of items to be 

seized as set forth in Attachment B (any data that is encrypted and unreadable will 

not be returned unless law-enforcement personnel have determined that the data is 

not (1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 214 of 231 PageID #:222
88

contraband, (4) otherwise unlawfully possessed, or (5) evidence of the offenses 

specified above);

c. surveying file directories and the individual files they contain to 

determine whether they include data falling within the list of items to be seized as 

set forth in Attachment B;

d. opening or reading portions of files, and performing key word 

searches of files, in order to determine whether their contents fall within the items to 

be seized as set forth in Attachment B. 

169. The government will return any electronic storage media removed from 

the premises described in Attachment A-1, Attachment A-2, and Attachment A-3

within 30 days of the removal unless, pursuant to Rule 41(c)(2) or (3) of the Federal 

Rules of Criminal Procedure, the removed electronic storage media contains 

contraband or constitutes an instrumentality of crime, or unless otherwise ordered 

by the Court.

V. CONCLUSION

170. Based on the above information, I respectfully submit that there is 

probable cause to believe that mail and wire fraud, money laundering, and conspiracy 

to commit the foregoing offenses, in violation of Title 18, United States Code, Sections 

1341, 1343, 1956, 1349, and 371, have been committed, and that evidence, 

instrumentalities, and fruits relating to this criminal conduct, as further described in 

Attachment B, will be found in the Oxbow Premises, as further described in 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 215 of 231 PageID #:223
89

Attachment A-1; the Weber Premises, as further described in Attachment A-2; and 

the Harlem Premises, as further described in Attachment A-3.

171. I therefore respectfully request that this Court issue a search warrant 

for the apartment units located at 797 Oxbow Avenue, Unit 110, Oswego, Illinois 

60543, more particularly described in Attachment A-1; 716 South Weber Road, Unit 

512, Romeoville, Illinois 60446, more particularly described in Attachment A-2; and, 

1419 North Harlem Road, Apartment B, Oak Park, Illinois 60302, more particularly 

described in Attachment A-3, authorizing the seizure of the items described in 

Attachment B, pursuant to the protocol described in the addendum to Attachment B. 

FURTHER AFFIANT SAYETH NOT. 

____________________________

AMY C. MANSKER

Special Agent

IRS Criminal Investigation

Subscribed and sworn 

before me this 8th day of July, 2020

Honorable SHEILA M. FINNEGAN

United States Magistrate Judge 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 216 of 231 PageID #:224
ATTACHMENT A-1

DESCRIPTION OF PREMISES TO BE SEARCHED

The premises located at 797 Oxbow Avenue, Unit 110, Oswego, Illinois 60543 

(the “Oxbow Premises”). The Oxbow Premises is one of several apartment 

buildings located within an apartment complex, Springs at Oswego. The entrance to 

the apartment complex is located on Oxbow Avenue to the west of Fifth Street. Upon 

entering the complex, Oxbow Avenue splits at a Y-intersection and continues in two 

directions, south and west, to complete a continuous loop around the apartment 

complex. The apartment building for the Oxbow Premises is the second building 

when traveling south on Oxbow Avenue from the Y-intersection and is located to the 

east of Oxbow Avenue and west of Fifth Street. The building is clearly marked with 

a large light-colored placard denoting “797” in blue lettering. The Oxbow Premises

is an apartment unit located on the first floor of a two-story building. The apartment 

building is grey and blue with white trim and sections of brick façade. Each unit has 

a separate entry. All entry doors are located on the first floor and accessed 

individually from the outside. The entrance for the Oxbow Premises is a blue door 

clearly marked with a light-colored placard denoting “110” in blue lettering located 

near the southeast corner of the apartment building. The unit includes an attached 

garage. The Oxbow Premises includes the entire property located at 797 Oxbow 

Avenue, Unit 110, Oswego, Illinois 60543, including but not limited to any parking 

spaces, garages, storage spaces, curtilage, and appurtenances that are assigned to or 

associated with 797 Oxbow Avenue, Unit 110, Oswego, Illinois 60543, as well as the 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 217 of 231 PageID #:225
2

following vehicles if parked at the Oxbow Premises: (1) a beige Mercedes Benz sport 

utility vehicle bearing Wisconsin license plate AFX7998; (2) a black Mercedes Benz 

sedan bearing Illinois license plate 455508; and (3) a white Kia Soul bearing Texas 

temporary registration number 4166428.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 218 of 231 PageID #:226
ATTACHMENT A-2

DESCRIPTION OF PREMISES TO BE SEARCHED

The premises located at 716 South Weber Road, Unit 512, Romeoville, Illinois 

60446 (the “Weber Premises”). The Weber Premises is one of several apartment 

buildings located within an apartment complex, Springs at Weber Road. The entrance 

to the apartment complex is located west of Weber Road off of Grand Haven Circle. 

The apartment building for the Weber Premises is located on the east side of the 

apartment complex and sits to the west of Weber Road and the Access Road and south 

of Grand Haven Circle. The building is clearly marked with a large dark-colored 

placard denoting “716” in white lettering. The Weber Premises is an apartment unit 

located on the first floor of a two-story building. The apartment building is dark green 

and light green with brown trim and sections of brick façade. Each unit has a separate 

entry. All entry doors are located on the first floor and accessed individually from the 

outside. The entrance for the Weber Premises is a brown door clearly marked with 

a dark-colored placard denoting “512” in white lettering located near the northwest

corner of the apartment building. The unit includes an attached garage. The Weber 

Premises includes the entire property located at 716 South Weber Road, Unit 512, 

Romeoville, Illinois 60446, including but not limited to any parking spaces, garages, 

storage spaces, curtilage, and appurtenances that are assigned to or associated with 

716 South Weber Road, Unit 512, Romeoville, Illinois 60446, as well as the following 

vehicle if parked at the Weber Premises: a red Toyota Corolla bearing Illinois 

license plate BV89675.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 219 of 231 PageID #:227
2

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 220 of 231 PageID #:228
ATTACHMENT A-3

DESCRIPTION OF PREMISES TO BE SEARCHED

The premises located at 1419 North Harlem Avenue, Apartment B, Oak Park, 

Illinois 60302 (the “Harlem Premises”). The Harlem Premises is a multi-unit, 

two-story building containing townhouses. The building is light-brown in color and 

constructed of brick. The building is marked with a black placard on the west side of 

the building denoting 1419 1421. The building is located south of LeMoyne Parkway 

and north of Greenfield Street on the east side of Harlem Avenue. The Harlem

Premises is an apartment unit located on the first floor of the two-story building. 

Each unit has a separate entry. All entry doors are located on the first floor and 

accessed individually from the outside. The unit includes a detached garage located 

at the east end of the building with entrance gained through the alley that runs 

behind the building. The south entrance to the alley is located off of Greenfield Street 

and the north entrance to the alley is located off of LeMoyne Parkway. The Harlem 

Premises includes the entire property located at 1419 North Harlem Avenue, 

Apartment B, Oak Park, Illinois 60302, including but not limited to any parking 

spaces, garages, storage spaces, curtilage, and appurtenances that are assigned to or 

associated with 1419 North Harlem Avenue, Apartment B, Oak Park, Illinois 60302, 

as well as the following vehicle if parked at the Harlem Premises: a silver BMW 

sport utility vehicle bearing Illinois license plate 38822US.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 221 of 231 PageID #:229
2

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 222 of 231 PageID #:230
ATTACHMENT B

LIST OF ITEMS TO BE SEIZED

Evidence, instrumentalities and fruits concerning violation of Title 18, United 

States Code, Sections 1341, 1343, 1956, 1349, and 371, as follows: 

1. Financial records, including receipts, checks, bank and savings and loan 

records of deposit, withdrawal and wire transfer, statements and other bank records, 

letters of credit, credit card statements, money orders, cashier’s checks, passbooks, 

cancelled checks, certificates of deposit, loan records, customer account information, 

income and expense summaries, cash disbursement journals, financial statements, 

and state and federal income tax returns.

2. Any general ledgers, journals, and accounting records, including 

electronic accounting records, for NU-MEKS Healthcare Inc. (“NU-MEKS”), 

EMPERORCHILLS, MEKAS Construction Inc. (“MEKAS”), HALL & HALL Global 

Inc. (“HALL & HALL”), GODMEKS Inc. (“GODMEKS”), SAMCORD Inc. 

(“SAMCORD”), ESIJEMINE Lucky Nengite Inc. (“ESIJEMINE”), SAMCHINA 

Trucking Inc. (“SAMCHINA”), African Money Union Inc. (“AFRICAN MONEY 

UNION”), JENANT Inc. (“JENANT”), SETRACO Services Inc. (“SETRACO”), 

EMETECH Solutions Inc. (“EMETECH”), GLOBAYO LLC (“GLOBAYO”) or any 

other entity associated with Anthony Emeka Ibekie (“IBEKIE”), Uchenna Samuel 

Aniukwu, aka Samuel Uchenna Aniukwu and Sammy Maxwell (“ANIUKWU”), 

Lasheena Washington (“WASHINGTON”), Williette Asanji (“ASANJI”), Treonda 

Steadman (“STEADMAN”), Lawrence Berry III (“BERRY”), Jennifer Gosha 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 223 of 231 PageID #:231
2

(“GOSHA”), Tonyanika Fogle (“FOGLE”), Ebuka EGBUNAM (“EGBUNAM”), 

Chandler Arnaud (“ARNAUD”), Diego Dario (“DARIO”), Pierre Delouis 

(“DELOUIS”), Jean Drapeaw (“DRAPEAW”), Onuigbo Izuchukwu (“IZUCHUKWU”), 

Fred Lookas (“LOOKAS”), Steven Kelvin Clark (“STEVEN”), Siegel Clark 

(“SIEGEL”), Peter Pfizer (“PFIZER”), Wyashika Sellar (“SELLAR”), or Nikka Avis

(“AVIS”);

3. Credit card statements, bank statements, payment records, application 

forms and all related documentation for any accounts held by NU-MEKS, 

EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, SAMCORD, 

ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, JENANT, SETRACO,

EMETECH, GLOBAYO, IBEKIE, ANIUKWU, WASHINGTON, ASANJI, 

STEADMAN, BERRY, GOSHA, FOGLE, EGBUNAM, ARNAUD, DARIO, DELOUIS, 

DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, SIEGEL, PFIZER, SELLAR, AVIS, 

or any other entity associated with the foregoing individuals;

4. Billing statements, purchase orders, delivery receipts, invoices, 

payment records and any other supporting documentation for any goods or services 

rendered by NU-MEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, 

SAMCORD, ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, JENANT, 

SETRACO, EMETECH, GLOBAYO, or any other entity associated with IBEKIE, 

ANIUKWU, WASHINGTON, ASANJI, STEADMAN, BERRY, GOSHA, FOGLE, 

EGBUNAM, ARNAUD, DARIO, DELOUIS, DRAPEAW, IZUCHUKWU, LOOKAS, 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 224 of 231 PageID #:232
3

STEVEN, SIEGEL, PFIZER, SELLAR, AVIS, or any other entity associated with the 

foregoing individuals;

5. All communications, including written correspondence, mailings, 

letters, emails, or notes concerning sales or invoicing for any goods or services 

rendered by NU-MEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, 

SAMCORD, ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, JENANT, 

SETRACO, EMETECH, GLOBAYO, or any other entity associated with IBEKIE, 

ANIUKWU, WASHINGTON, ASANJI, STEADMAN, BERRY, GOSHA, FOGLE, 

EGBUNAM, ARNAUD, DARIO, DELOUIS, DRAPEAW, IZUCHUKWU, LOOKAS,

STEVEN, SIEGEL, PFIZER, SELLAR, AVIS, or any other entity associated with the 

foregoing individuals;

6. All communications, including written correspondence, mailings, 

letters, emails, or notes exchanged between or among IBEKIE, ANIUKWU, 

WASHINGTON, ASANJI, STEADMAN, BERRY, GOSHA, FOGLE, EGBUNAM, 

ARNAUD, DARIO, DELOUIS, DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, 

SIEGEL, PFIZER, SELLAR, or AVIS concerning: (1) NU-MEKS, 

EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, SAMCORD, 

ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, JENANT, SETRACO, 

EMETECH, GLOBAYO, or any other entity associated with the foregoing 

individuals; (2) the receipt, withdrawal, transfer, expenditure, or use of funds 

deposited at any bank account; (3) requests or demands for payment of funds issued 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 225 of 231 PageID #:233
4

to any third party, including any individual or business; (4) putative inheritances, 

lottery winnings, or investments; (5) 797 Oxbow Avenue, Unit 110, Oswego, Illinois 

60543 (the “Oxbow Premises”); (6) 716 S. Weber Road, Unit 512, Romeoville, Illinois 

60446 (the “Weber Premises”); (7) 1419 N. Harlem Avenue, Apartment B, Oak Park, 

Illinois 60302 (the “Harlem Premises”); (8) 5206 Lincoln Avenue in Lisle, Illinois 

(the “Lincoln Premises”); or (9) 2726 Alyssa Drive, Naperville, Illinois (the “Alyssa 

Premises”). 

7. All communications, including written correspondence, mailings, 

letters, emails, or notes exchanged between or among IBEKIE, ANIUKWU, 

WASHINGTON, ASANJI, STEADMAN, BERRY, GOSHA, FOGLE, EGBUNAM, 

ARNAUD, DARIO, DELOUIS, DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, 

SIEGEL, PFIZER, SELLAR, AVIS, and any third party on any online dating website, 

including but not limited to OKCupid.com.

8. Any and all federal and state corporate tax records to include 1099, W2, 1120, 1120S, 1065, 940, and 941 forms for NU-MEKS, EMPERORCHILLS, 

MEKAS, HALL & HALL, GODMEKS, SAMCORD, ESIJEMINE, SAMCHINA, 

AFRICAN MONEY UNION, JENANT, SETRACO, EMETECH, GLOBAYO, or any 

other entity associated with IBEKIE, ANIUKWU, WASHINGTON, ASANJI, 

STEADMAN, BERRY, GOSHA, FOGLE, EGBUNAM, ARNAUD, DARIO, DELOUIS, 

DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, SIEGEL, PFIZER, SELLAR, or 

AVIS;

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 226 of 231 PageID #:234
5

9. Payroll records for NU-MEKS, EMPERORCHILLS, MEKAS, HALL & 

HALL, GODMEKS, SAMCORD, ESIJEMINE, SAMCHINA, AFRICAN MONEY 

UNION, JENANT, SETRACO, EMETECH, GLOBAYO, or any other entity 

associated with IBEKIE, ANIUKWU, WASHINGTON, ASANJI, STEADMAN, 

BERRY, GOSHA, FOGLE, EGBUNAM, ARNAUD, DARIO, DELOUIS, DRAPEAW, 

IZUCHUKWU, LOOKAS, STEVEN, SIEGEL, PFIZER, SELLAR, or AVIS;

10. Any evidence of past or current indebtedness, contracts, promissory 

notes, mortgage records, vehicle loans, business loans, or student loans for NUMEKS, EMPERORCHILLS, MEKAS, HALL & HALL, GODMEKS, SAMCORD, 

ESIJEMINE, SAMCHINA, AFRICAN MONEY UNION, JENANT, SETRACO, 

EMETECH, GLOBAYO, IBEKIE, ANIUKWU, WASHINGTON, ASANJI, 

STEADMAN, BERRY, GOSHA, FOGLE, EGBUNAM, ARNAUD, DARIO, DELOUIS, 

DRAPEAW, IZUCHUKWU, LOOKAS, STEVEN, SIEGEL, PFIZER, SELLAR, AVIS, 

or any other entity associated with the foregoing individuals;

11. Indicia of occupancy, residency, control or ownership of the Oxbow 

Premises, the Weber Premises, the Harlem Premises, the Lincoln Premises, or 

the Alyssa Premises, such as utility bills, telephone bills, loan payment receipts, rent 

documents, canceled envelopes, keys, photographs, and bank records; 

12. Cash in excess of $500; 

13. Any evidence of past or current purchases or use of Virtual Private 

Network services or software;

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 227 of 231 PageID #:235
6

14. Any digital device, printer, or electronic-storage media used to facilitate 

the above-listed violations, and forensic copies thereof, that is: (1) located in any 

common areas of the Oxbow Premises, Weber Premises, or Harlem Premises; 

(2) located inside rooms or containers at the Oxbow Premises, Weber Premises, 

or Harlem Premises that are associated with IBEKIE, ANIUKWU, EGBUNAM, or 

GOSHA; and (3) concealed on the person of IBEKIE, ANIUKWU, EGBUNAM, or

GOSHA if they are present during execution of the warrant at the Oxbow Premises, 

Weber Premises, or Harlem Premises.

15. With respect to any digital device or electronic-storage media used to 

facilitate the above-listed violations or containing evidence falling within the scope of 

the foregoing categories of items to be seized:

a. evidence of who used, owned, or controlled the device at the time 

the things described in this warrant were created, edited, or deleted, such as logs, 

registry entries, configuration files, saved usernames and passwords, documents, 

browsing history, user profiles, e-mail, e-mail contacts, chat and instant messaging 

logs, photographs, and correspondence;

b. evidence of the presence or absence of software that would allow 

others to control the device, such as viruses, Trojan horses, and other forms of 

malicious software, as well as evidence of the presence or absence of security software 

designed to detect malicious software;

c. evidence of the attachment of other devices;

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 228 of 231 PageID #:236
7

d. evidence of counter-forensic programs (and associated data) that 

are designed to eliminate data from the device;

e. evidence of the times the device was used;

f. passwords, encryption keys, and other access devices that may be 

necessary to access the device;

g. applications, utility programs, compilers, interpreters, or other 

software, as well as documentation and manuals, that may be necessary to access the 

device or to conduct a forensic examination of it;

h. records of or information about Internet Protocol addresses used 

by the device;

i. records of or information about the device’s Internet activity, 

including firewall logs, caches, browser history and cookies, “bookmarked” or 

“favorite” web pages, search terms that the user entered into any Internet search 

engine, and records of user-typed web addresses;

j. records, documents, programs, applications or materials, or 

evidence of the absence of same, sufficient to show address book information, 

including all stored or saved telephone numbers;

k. records, documents, programs, applications or materials, or 

evidence of the absence of same, sufficient to show call log information, including all 

telephone numbers dialed from the any digital devices and all telephone numbers 

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 229 of 231 PageID #:237
8

accessed through any push-to-talk functions, as well as all received or missed 

incoming calls;

l. records, documents, programs, applications or materials, or 

evidence of the absence of same, sufficient to show SMS text, email communications 

or other text or written communications sent to or received from any digital device;

m. Global Positioning System (“GPS”) coordinates and other 

information or records identifying travel routes, destinations, origination points, and 

other locations.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 230 of 231 PageID #:238
ADDENDUM TO ATTACHMENT B

Pursuant to Rule 41(e)(2)(B) of the Federal Rules of Criminal Procedure, this 

warrant authorizes the removal of electronic storage media and copying of 

electronically stored information found in the premises described in Attachment A-1, 

Attachment A-2, and Attachment A-3 so that they may be reviewed in a secure 

environment for information consistent with the warrant. That review shall be 

conducted pursuant to the following protocol: 

The review of electronically stored information and electronic storage media 

removed from the premises described in Attachment A-1, Attachment A-2, and 

Attachment A-3 may include the following techniques (the following is a nonexclusive list, and the government may use other procedures that, like those listed 

below, minimize the review of information not within the list of items to be seized as 

set forth herein):

a. examination of all the data contained in such computer hardware,

computer software, and/or memory storage devices to determine

whether that data falls within the items to be seized as set forth in

Attachment B;

b. searching for and attempting to recover any deleted, hidden, or

encrypted data to determine whether that data falls within the list of

items to be seized as set forth in Attachment B (any data that is

encrypted and unreadable will not be returned unless law-enforcement

personnel have determined that the data is not (1) an instrumentality

of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4)

otherwise unlawfully possessed, or (5) evidence of the offenses specified

above);

c. surveying file directories and the individual files they contain to

determine whether they include data falling within the list of items to

be seized as set forth in Attachment B; and

d. opening or reading portions of files, and performing key word searches

of files, in order to determine whether their contents fall within the

items to be seized as set forth in Attachment B.

The government will return any electronic storage media removed from the 

premises described in Attachment A-1, Attachment A-2, and Attachment A-3 within 

30 days of the removal unless, pursuant to Rule 41(c)(2) or (3) of the Federal Rules of 

Criminal Procedure, the removed electronic storage media contains contraband or 

constitutes an instrumentality of crime, or unless otherwise ordered by the Court.

Case: 1:20-cr-00352 Document #: 2 Filed: 07/10/20 Page 231 of 231 PageID #:239