FORTUNE — A luxury suite at the W Hotel in Dallas is as good a place as any to conquer the world. At least it seemed that way in 2007 when Tobechi Onwuhara got the crew together. They’d meet there often, seven or eight of them. Some had nicknames from the Ian Fleming lexicon: C, Q, and E. Others were called Mookie, Orji, Uche. They would spread out on designer sofas and at the wet bar, open three-ring binders, and fire up laptops with hard-to-trace wireless cards. On a nearby table there’d be prepaid cellphones with area codes taped to them. A phone for Southern California. A phone for Northern Virginia. A phone for any place Onwuhara had found the “good money.”
In those days, the good money wasn’t hard to find. The housing boom had flooded the country with capital. Lenders were making promiscuous loans to unsophisticated borrowers. It was an ideal environment for Onwuhara, 27, a brilliant, pug-faced visionary who favored True Religion jeans and Ed Hardy shirts. Looking out over the neon skyline of downtown Dallas, it was easy for the crew to believe his assurances: He’d make them rich. When the sun glinted off one of his $100,000 diamond-encrusted Audemars Piguet watches, who could doubt it? Every few months he would buy a new Maserati or Bentley. He owned expensive properties in Miami, Dallas, and Phoenix. He even had a secret love condo in the W, where scantily clad women visited in such numbers that one bellhop became convinced that the first-generation Nigerian-American was a porn director.
The truth was very different. In his ancestral homeland, Onwuhara might have been a chief. In America he became one of the world’s most successful cyberscammers, a criminal genius who used his talents to filet a poorly regulated banking and credit system. In less than three years Onwuhara stole a confirmed $44 million, according to the FBI, which believes the total may be anywhere from $80 million to $100 million. All he needed was an Internet connection and a cellphone.
Onwuhara called it “washing.” He’d set up a boiler room in a fancy hotel (the Waldorf-Astoria was another favorite) to wash information on wealthy victims. Then he’d wash bank accounts. One group in his crew would do online research using databases and websites to harvest names, dates of birth, and mortgage information. They’d build profiles of victims for a second group, who would call banks posing as account holders. The callers cadged security information and passwords. Then Onwuhara would breach the accounts and wire funds from them to a network of money mules he had established in Asia. The money would be laundered and wired back to his accounts in the U.S.
“I call it modern-day bank robbery,” says FBI special agent Michael Nail. “You can sit at home in your PJs and slippers with a laptop, and you can actually rob a bank.”
Onwuhara specialized in hitting home equity lines of credit (HELOCs), the reservoirs of cash that banks make available to homeowners. Once Onwuhara gained access to a HELOC, he could siphon out vast sums in seconds. His weapon was persuasion. It got him enough money to start building a colonnaded fortress in Nigeria; enough to gamble at the high-stakes tables in Vegas casinos all night. Even his accomplices appear not to have known how much he was really pulling down — not even his beautiful fiancée, Precious Matthews.
Related: NewsRescue– Credit Card, ID Theft Ring Busted in Queens
“He was playing all of us,” says Paula Gipson, a member of the crew. “The banks, us, Precious, everybody.”
Conversations with Gipson and other Onwuhara associates, interviews with his family and with investigators, and hundreds of pages of court documents reveal a digital scavenger of extraordinary creativity and guile. Onwuhara orchestrated his swindles using information about homeowners that is widely available online. In fragments, this information is innocuous. When assembled properly, it can be used like an electronic skeleton key to get into almost any credit account. Onwuhara needed only a few short years to rack up an illicit fortune. And he’s still at large.
The son of an entrepreneur
The state of Abia in Nigeria stretches from the plains in the north to the riverine flats in the south and resembles, on a map, a giraffe’s head. It is a swath of farmland filled with yam fields, cashew orchards, and the sorrowful memories of the Igbo people. The Igbo are Christian, but they jokingly call themselves “black Jews” because so many leave home to establish themselves in business. Abia is their heartland. In the late 1960s it was part of Biafra, a secessionist state with the misfortune of sitting atop vast oil deposits. When the Nigerian civil war erupted, more than a million Biafrans were killed or starved to death. Onwuhara’s parents survived.
His father, Doris, was an entrepreneur, one of the first people in Nigeria to import satellite TVs. He built the first major hotel in Abia’s capital, Umuahia. Visitors came from miles away to dance in the hotel’s nightclub. As Umuahia expanded and land values appreciated, so did Doris’s influence. He moved into politics, held office, and managed a successful campaign for a governor of Abia.
Onwuhara’s mother, Katherine, was equally accomplished. A lawyer and literary critic, she served as chairwoman of Abia’s board of education. The four daughters she had with Doris would go on to be nurses and ministers. But her fifth child, her only son, would be different. He would be American. Katherine was five months pregnant with Tobechi when she left Nigeria to attend school in Houston. “Tobe” was born there in 1979.
Katherine returned to Nigeria when Tobe was still a boy, leaving him with an uncle in Houston. She thought the tight-knit diaspora would look after him. But once Tobe reached his teenage years he started skipping school and getting into trouble. The family shipped him back to Nigeria at age 15 and enrolled him in a boarding school run by the Marist Brothers, a Catholic order known for educational discipline. Onwuhara graduated and enrolled in medical school at Abia State University. He was by all accounts an exceptionally clever, shy boy who spoke infrequently but eloquently. He longed to return to the U.S.
In 1999, Onwuhara moved back to Texas. He rented an apartment in Dallas and took classes at Brookhaven College. He found a job as a loan officer at Capital One. He learned how banks worked from the inside, studying documents and procedures. (Capital One declines to discuss Onwuhara.) Then he turned to crime. With the help of a friend who had connections at Discover Financial Services, Onwuhara cooked up driver’s licenses and credit cards under the names of real customers, according to court documents. He bought electronics at CompUSA. He hit up restaurants and clubs. That was how he met Precious Matthews, a pretty Baylor student majoring in speech communication. Matthews worked as a waitress; Onwuhara was a regular, flirtatious customer. When Precious warned him the establishment was suspicious of his transactions, Onwuhara was smitten. The two started dating and were soon engaged.
In 2002, Onwuhara was arrested three times in Texas for credit card fraud. The police raided his apartment and found incriminating evidence. Onwuhara had mastered some techniques of identity theft and stolen more than $100,000 with an accomplice, according to a statement he gave to the authorities, but he was still a fledgling criminal making silly mistakes. Chief among them was going into a store or a bank in person to commit fraud. He would learn later to distance himself from a crime and leave few traces of his involvement. But not yet.
[ad#medium]
When the heat in Texas got too great, Onwuhara left for Seattle to meet Abel Nnabue, a Nigerian friend known as “Q.” On Dec. 12, 2002, the two men drove to a bank in Lynwood, Wash., their wallets packed with fake IDs and unauthorized credit cards. Nnabue waited in their gold Plymouth Neon rental car while Onwuhara entered the bank to try for a $5,000 cash advance. When the bank called the police, Onwuhara bolted outside and into the Neon, just as a cruiser arrived. Nnabue sped away on wet streets, gunning the Neon through stop signs. Two more cop cars joined the chase; Onwuhara threw his wallet out the window. The police cornered the men in the parking lot of a Korean church. Onwuhara fled on foot, and a K-9 unit found him hiding in a pond. In May 2003 he was sentenced to 12 months in prison.
“I’m deeply and sincerely sorry,” he told a federal judge. “You’ll never again see me in any kind of trouble with the law or hear anything negative about me from this day forward.”
By the time Onwuhara got out of prison, the housing market was bubbling.
“He made it thunderstorm.”
The Dallas Gentlemen’s Club is one of Texas’s bawdiest fleshpots, a highway-side warehouse of grinding booty and slack-jawed marks. The club attracts big spenders — athletes, rap stars — but Onwuhara made them look like flunkies. When he walked in, the strippers would beeline for him, their cellphones lighting up as they called their off-duty friends: “Get over here! T just showed up!” They knew what to expect — $650 bottles of Cristal, $2,000 stacks of ones for his entourage, $50,000 in a briefcase he’d empty out. During a single song, he’d drop so much money the girls needed two more songs to scoop all the bills off the floor. He’d repeat this performance several times a week.
“He didn’t just make it rain,” one dancer would later tell the authorities. “He made it thunderstorm.”
At the end of the night, Onwuhara liked to idle outside the club in his $300,000 Rolls-Royce Phantom waiting for the girls to exit, according to interviews with FBI investigators. When he saw one he liked, he’d simply point. She was coming back to the W. If women were his weakness, strippers were his vice. But Precious would eventually find out. Still engaged, she and Onwuhara had moved in together.
The studious, soft-spoken Tobe had disappeared. Onwuhara, now known as “T,” was the owner of S.W.A.T. Up Entertainment, a rap label; a deluxe apartment in Dallas and a mansion in Miramar, Fla.; and a diamond chain the size of a tow rope that he wore around his neck. Dangling at the end of the chain was a grinning mini-T clutching sacks of money like a cartoon bank robber, which is what Onwuhara increasingly resembled.
In hindsight, it seems obvious that a savvy cybercriminal would target HELOCs. From 1998 to 2007, the percentage of homeowners with HELOCs jumped from 10.6% to 18.4%. Credit balances soared. All the information a scammer needed was available online. The trick was cobbling it together. Onwuhara taught himself how.
Using ListSource, a direct-marketing company, he’d collect mortgage information on married couples with million-dollar homes. They qualified for high HELOCs. He’d find lease or loan papers through public databases and pay sites, then use Photoshop to grab homeowners’ signatures off documents. Next, he’d build a profile of the victim by paying for a background search through skip-tracing sites. That would give him birth dates, Social Security numbers, names of relatives, previous addresses, employment histories, and more. To get a mother’s maiden name he would use Ancestry.com.
Profile in hand, he would run a credit check on victims through annualcreditreport.com, a website set up by the big three credit-reporting agencies. Onwuhara had discovered a flaw in the Experian portion of the site, which screened users with a personalized security question and several multiple-choice answers. Users had to click on the correct answer to proceed. But when Onwuhara refreshed his browser, he found that the site replaced certain answers with new ones. Clearly, these were red herrings. Onwuhara knew the correct answer to the security question would appear persistently on screen as he refreshed. Enough refreshing would eventually reveal the true answer and allow Onwuhara to access reports. (A spokesman for Experian says that the company is cooperating with law enforcement authorities and that “since this case we have refined our security protocol.”) The reports provided Onwuhara with details about the victim’s HELOC. He preferred credit union HELOCs: They were soft targets.
At this point artistry came into play. Onwuhara used a phone service called SpoofCard to make any number he wanted appear in a caller ID. This was key to his scam. With SpoofCard, Onwuhara could fool financial institutions into thinking his call originated from the victim’s phone. Onwuhara knew the system. He knew the questions he’d get. Usually he had the answers, along with account numbers, balances, and passwords. Altering his gravelly voice like a professional actor, he could switch ethnicity, age, and accent on a whim. A customer service rep was easy prey.
Once in, Onwuhara would wire HELOC money out of the country. Financial institutions faxed wire transfer requests to his e-fax account, which converted faxes to e-mails. After attaching Photoshopped signatures and phony headers, he would send the forms back. The money would be wired to banks in Asia where mules that Onwuhara had recruited would withdraw the money, take a cut, and redeposit the funds into other accounts or with hawalas, informal money brokers who ask few questions.
Finally, the money would be wired back to the U.S. into accounts Onwuhara controlled. At one point he received a 40-million-euro transfer. He would further launder the money by depositing it in casinos and cashing out in checks days later. He would also buy ultra-expensive luxury cars, drive them for a few months, then ship them to Nigeria, where they would be resold at a steep markup. Onwuhara was clearing about $7 million every two weeks, according to the FBI.
The mastermind shared few details of the scam, even with his inner circle. Precious Matthews and Paula Gipson knew the most, mainly because Onwuhara couldn’t impersonate women on the phone. He needed them to pose as female account holders and had to give them more information. Nnabue gathered mortgage information and loan documents. Ezenwa (“E”) Onyedebelu, a promising young student from Dallas whom Onwuhara had tapped as his protégé, laundered money. Henry Obilo, a hulking pre-med student who doubled as Onwuhara’s bodyguard, specialized in Bank of America information.
Onwuhara doled out profits according to a person’s role. Callers received more than researchers, and members of the crew competed to work the phones. If they weren’t slick enough, Onwuhara bumped them back to online scutwork. All the money, all the information, ran through him. He never stored sensitive data on his computer, keeping it instead on a flash drive he could easily destroy. But no matter the precautions he took to cover his tracks, something was bound to go awry. Sometimes you just hit the wrong man.
The net tightens
On Dec. 8, 2007, Robert “Duke” Short sat down in front of his PC. It was around 10 a.m., a few hours before Short was to take his wife to their regular weekend lunch near their home in Alexandria, Va. Short wanted to check his accounts at the U.S. Senate Federal Credit Union. A former U.S. Treasury agent, Short arrived in D.C. from South Carolina as the Treasury Department’s national chief of investigations. He got into politics and became Strom Thurmond’s chief of staff. He spent 30 years on Capitol Hill. He was, in other words, the wrong man to hit.
That morning, Short couldn’t log into his account. His password had been changed, and the credit union was closed. Short called in on Monday. When he accessed his account, he saw that $280,000 was missing, most of it from his high-limit HELOC account.
“They said this money was transferred to Korea,” he recalls. “They said, ‘Are you sure you didn’t do that?’ I said, ‘Listen, if that amount of money was transferred to Korea, I would know.'”
The credit union would protect Short from any losses — in fact, almost all of Onwuhara’s victims eventually had their monetary losses covered by their financial institutions, although they still had to cope with the shock of identity theft and ruined credit ratings.
Short called the Alexandria police department, the Secret Service, and the FBI. Within days an investigation was underway.
The investigators’ first clue came from the IP addresses used to log in to Short’s account. The FBI determined that someone had called the credit union to reset Short’s password, sounding like an older white man. The caller claimed that the auto login to his account had vanished after his son had set up a new computer for him. He was convincing. But after the password was reset, the caller logged in to Short’s account while still on the phone. The FBI now had a precise IP address to track. It belonged to a Verizon Wireless Internet card registered to a fictitious name and a real address in Miramar, Fla., just a few doors down from Onwuhara’s mansion, a fact the FBI would discover later.
Onwuhara bought wireless Internet service with prepaid debit cards, making him virtually untraceable. But he still had to go to a Verizon (VZ, Fortune 500) store to make purchases. Two deposits had been made to the Verizon account tied to the Short crime. Both occurred in Plano, Texas. When investigators pulled security video from the store, they saw three men at a kiosk. One was wearing an Ed Hardy hoodie covered in rhinestone skulls. Investigators began looking for names.
They knew their thief had intercepted a call from the credit union to Short to confirm the wire transfer. Onwuhara had duped Short’s phone company into remotely forwarding calls to Onwuhara’s cell, a tactic he used often. But it backfired when investigators obtained a list of phones to which customers’ home numbers were being forwarded. On the list, they found numerous prepaid phone numbers. Calls were being made from these numbers to banks across the country and to 1-800 numbers belonging to SpoofCard. These were the scammers’ virtual fingerprints.
An FBI search warrant produced 1,500 recorded calls connected to the suspicious SpoofCard accounts. (SpoofCard says that it doesn’t routinely record calls made over its system, but that callers may opt to do so.) The tapes were a jackpot for investigators. “There were so many different voices,” says FBI special agent Hadley Etienne. “They all knew what to say. They all had it down.”
For months investigators listened to the tapes, hoping for a break. “You know how it is when you’re reading a good book and you’re just reading and reading and reading,” says Michael Nail, the lead FBI investigator. “It was like that. I was at home one weekend listening to calls. And this one call came up.”
In it, Onwuhara does a pitch-perfect impersonation of a middle-aged white doctor calling in a prescription to a CVS pharmacy. The prescription was for Valtrex, a herpes medication. The patient was Tobe Onwuhara. At last, investigators had a name. They pulled a Texas DMV photo of Onwuhara. It matched the image of the man in the hoodie from the Verizon video. Their quarry was in reach, but they needed more evidence.
In April 2008, agents detained Onwuhara, Nnabue, Matthews, and Obilo at J.F.K. International Airport in New York. The group was flying home after a vacation in Nigeria. They had stayed at the Ritz in London during their stopover. Onwuhara had even brought his diamond chain. Investigators told the scammers they were being stopped as part of a routine travel check. Their real purpose was to confirm the voices and nicknames they’d heard on the tapes and the phone numbers used in the calls. Now they would begin to monitor Onwuhara’s phone and station cars in the street outside his Miramar mansion to conduct surveillance.
The crew starts to unravel
If the airport stop rattled Onwuhara, he didn’t show it. He still ate fish and rice at Pappadeaux’s in Dallas. He still threw parties at the chic Ghost Bar on the roof of the W. But nerves were fraying within his crew, according to Paula Gipson. Nnabue complained about his pay. Gipson agonized over her crimes yet justified them by saying she was only hurting the banks. Matthews spiraled into a depression. She enjoyed the finer things Onwuhara provided her — shopping sprees at high-end stores, weekends in the best hotels, a house with a new pool — but their relationship had grown combustible. She and Onwuhara fought. After one argument he stormed through the Miramar house and smashed the screens of the plasma TVs.
It was around this time that Onwuhara grew suspicious that law enforcement might be on to him. FBI agents had placed both a pen register and a trap-and-trace device on his phone, which let them record all outgoing and incoming numbers. Onwuhara somehow found out. When he called Cingular/AT&T , his cellphone carrier, the company “accidentally” revealed the name and number of the FBI technician tracking him, according to an FBI affidavit in support of a criminal complaint. But people who know Onwuhara don’t think it was an accident.
“He has a way of getting people to tell him everything,” Gipson says.
On July 30, 2008, he destroyed his cell and switched to another phone the FBI wasn’t monitoring.
The FBI didn’t know where he’d gone. Was he making an escape? Emergency arrest warrants were obtained. Two days later, on a perfect South Florida night, the agents watching Onwuhara’s house noticed a commotion. Matthews ran outside, followed by a familiar-looking man. Matthews sped away in her Acura. The man followed in a black BMW X6 registered to Onwuhara. The agents gave chase as the cars rocketed down the highway at more than 100 mph.
[ad#medium]
“I got some calls,” Nail says. “They were like, ‘Hey, they’re speeding. Should we stop them now?'”
Nail consulted Etienne and the assistant U.S. attorney on the case. They decided to make the arrest. The agents on the ground followed the speeding cars to the Hard Rock Casino in Fort Lauderdale. The Acura and the BMW screeched to a halt at the curb in front of the casino. The drivers rushed inside, where local police detained them. The man from the BMW wasn’t Onwuhara but rather his protégé, Ezenwa Onyedebelu. In the seconds before the FBI arrived with handcuffs to make the arrest, Matthews whipped out her cellphone and fired off a text: “Leave now. They got us.”
Somewhere inside the Hard Rock, maybe at one of his beloved craps tables, one of the greatest cyberscammers in history looked up from his phone, calmly headed for a back door, and hailed a cab. Then he melted into the night. He hasn’t been seen since.
Floating between worlds
“I was taught by my dad not to be a follower,” Onwuhara once said.
He is following his own treacherous path now, one that few have charted. A most-wanted fugitive, he has a $25,000 bounty on his head.
Almost all of Onwuhara’s co-conspirators were indicted and pleaded guilty. Precious Matthews was sentenced to 51 months in prison. Daniel “Orji” Orjinta got 42 months. Abel Nnabue had his sentence reduced to 27 months after cooperating with prosecutors. Paula Gipson and Ezenwa Onyedebelu helped prosecutors and had their sentences reduced to 15 months and 14 months, respectively. Only Henry Obilo pleaded not guilty. He was sentenced to 88 months in prison.
As for Onwuhara, the FBI claims to have no clue where he is. One accomplice swears he’s still in America. Maybe he’s floating between worlds in cyberspace, probing for new cracks in new systems. “The boy is an enigma,” says one of his sisters. “What can I tell you?”