Auckland Man Runs 59 myIR Accounts

Nigel
Nigel is the founder, editor-in-chief, and lead writer at Pavlova Post, a New Zealand satire publication covering national news, local chaos, weather drama, politics, transport mishaps, and everyday Kiwi life – usually with a generous layer of exaggeration.

An Auckland man has been sentenced to five-and-a-half years in prison after turning Inland Revenue fraud into what appears to have been a highly committed, deeply illegal, admin lifestyle.

According to Inland Revenue, Nicholas Ngwun pleaded guilty to 10 charges covering tax and Covid fraud, plus two charges for perjury and fabricating evidence. Over almost two years, he submitted 121 fraudulent documents, tried to obtain more than $2 million, and received $251,035.74.

Which is already a lot.

But the detail that really makes the nation sit back and stare is this: Inland Revenue says at least 59 myIR accounts were compromised and used in the scheme.

That is not ordinary offending.

That is project management.

New Zealand’s least relatable admin achievement

Most people in this country interact with myIR the way they interact with dental appointments or calling their insurance company.

Reluctantly.

Late.

And only when absolutely cornered.

For many Kiwis, managing one myIR account already requires a password reset, a deep sigh, and a brief period of staring at the screen as if the system might sort itself out from embarrassment.

This man, however, appears to have looked at that same environment and thought, ‘What if I scaled this up dramatically and also committed several crimes?’

It is hard not to be impressed by the stamina in the same way you might be impressed by somebody digging a tunnel with a teaspoon.

Not because it is admirable.

Because it is alarmingly committed.

The dark web has met Inland Revenue

IRD says Ngwun bought people’s personal information from online dark-web marketplaces, including usernames and passwords for services ranging from myIR to Facebook, Gmail, Netflix, banks and telecommunications providers. Using that information, he logged into the myIR accounts of innocent individuals and businesses, then filed fraudulent applications and returns in their names.

The fraudulent documents included Covid support applications, GST returns, income tax returns and amendments.

So while the average New Zealander was using the internet to compare petrol prices or watch a bloke review power tools on YouTube, this operation was apparently using it to build a parallel tax universe.

A cursed one.

But still.

A universe.

Fraud stops sounding casual at around account number 12

There is a point in any fraud story where the numbers stop sounding like ‘bad decision’ and start sounding like ‘admin department’.

This case flew past that point wearing a lanyard.

Fifty-nine accounts is not opportunism.

It is workflow.

One fraudulent document might be desperation.

A hundred and twenty-one is a filing system with criminal intent.

At some point, the main question stops being ‘how did he think he’d get away with it?’ and becomes ‘how did he find the time?’

Did he have colour-coded folders?

Was there a spreadsheet?

Was there a weekly review meeting with himself?

Because this has all the energy of someone who could have used their powers for legitimate employment but instead chose to become the final boss of tax admin.

Inland Revenue has seen enough weirdness to notice

IRD says its systems blocked the vast majority of the attempted fraud and that it was also helped by banks and other organisations in identifying him.

That is the comforting part.

The less comforting part is that somebody still got far enough into the process to receive more than a quarter of a million dollars.

There is also a nasty little detail later in the case. Inland Revenue says Ngwun filed a sworn affidavit and a fake certificate claiming he had completed a rehabilitation programme in an apparent attempt to reduce his sentence, but routine checks showed the certificate was fabricated.

So even the sentencing discount allegedly came with forged paperwork.

At that point, the commitment to documents is no longer tactical.

It is spiritual.

The real emotional damage here may be to every honest New Zealander who has ever spent 15 minutes trying to enter a verification code before it expired.

Those people now know that while they were struggling through one legitimate portal, somebody else was allegedly out there running dozens.

That feels rude.

Not just criminal.

Rude.

It also reinforces a very modern truth: fraud increasingly looks less like a balaclava and more like somebody with too many tabs open, a bag of stolen credentials, and the confidence of a man who thinks every system is just waiting to be gamed.

Inland Revenue says digital offending is a growing challenge and warned that its systems are designed to detect this sort of fraud.

Which is good.

Because if this country has learned anything, it is that when one man can weaponise 59 myIR accounts, the rest of us deserve at least one quiet evening where our own login works first go.