The Investigative Journal’s daily survey of federal enforcement activity. All items below are drawn from public Justice Department records; direct links to the underlying releases accompany each entry.
The Justice Department’s first enforcement docket of September opened at a brisk pace. Between Sept. 1 and Sept. 3, the department unsealed a superseding indictment alleging a $57 million multistate tax refund fraud, announced the seizure of more than $560,000 in cryptocurrency bound for Hamas, sent an admitted agent of China’s Ministry of State Security to federal prison, and settled a whistleblower cybersecurity case against a major defense contractor. Below, TIJ walks through eight actions that merit attention — and flags the threads we intend to keep pulling.
Seven charged in $57 million tax refund scheme
A superseding indictment unsealed Sept. 2 charges seven defendants — Andrea and Kent Shannon of Kuna, Idaho; Monika Skinger of Chicago; Sherita Chandler of Port St. Lucie, Florida; Saule Moshkanova of Roseville, California; Tiffany Nichols of Suwanee, Georgia; and Stacey Rice of Manteca, California — with conspiracy to commit wire fraud, and, for some defendants, false claims and money laundering counts, according to the Justice Department. Prosecutors allege that from 2023 through 2024 the group, along with unindicted conspirators, filed more than 100 false individual and trust tax returns and fictitious financial instruments seeking over $57 million in refunds from the IRS.
The filings indicate the scheme was partially successful: the department says the conspirators actually received more than $8 million in taxpayer funds. The Shannons are additionally charged with laundering proceeds through purchases that included luxury cars. “Fraudsters should never be allowed to rip off the United States of America,” said Assistant Attorney General Colin M. McDonald of the National Fraud Enforcement Division, the unit DOJ stood up on April 7 in support of the administration’s government-wide anti-fraud task force. The conspiracy count carries a maximum of 20 years; IRS Criminal Investigation is handling the case, prosecuted out of the District of Idaho. The indictment contains allegations only, and all seven defendants are presumed innocent.
Hamas fundraising network disrupted; $560,000 in crypto seized
The department announced Sept. 1 that court-authorized seizures allowed the FBI to take more than $560,000 in cryptocurrency donations destined for Hamas and to seize domains and servers — including the al-Qassam Brigades’ main website, AlQassam.ps — that the designated terrorist organization used to raise money and recruit online. According to unsealed seizure warrants dated March 25, 2025, June 25, 2025, and Oct. 10, 2025, investigators used human sources to trace a rotating set of cryptocurrency donation addresses promoted through an encrypted group chat claiming association with Hamas.
Perhaps the most consequential detail sits near the bottom of the release: by capturing the group’s infrastructure, the FBI says it obtained information on thousands of individuals worldwide who contacted Hamas online to donate or attempt to donate — data the bureau says “will be used in the FBI’s future counterterrorism efforts.” Assistant Attorney General for National Security John A. Eisenberg said the seizures “deprive Hamas of resources it relies on to recruit and radicalize individuals online.” The FBI’s Albuquerque Field Office led the operation with the bureau’s Counterterrorism and Cyber Divisions and the New York Field Office; seizure affidavits are posted with the department’s release.
American who acted as MSS agent gets two years
Thomas Weir Pauken II, 51, a U.S. citizen who lived and worked in China, was sentenced Sept. 1 to two years in prison — followed by 36 months of supervised release with no overseas travel — for acting within the United States as an agent of the Chinese government, per the department’s release. Court documents indicate that from at least 2019 until February 2026, Pauken took taskings from a Ministry of State Security handler he knew as “Cathy”: meeting potential intelligence assets in the United States, supplying them with communication devices, relaying collection requirements, and passing reports back. He received at least $100,000 for the work.
The records also describe a secondary client base: a group of individuals from Wuhan who purchased reports on technology and on the U.S. Department of Justice itself, and who, prosecutors say, wanted Pauken to locate an expert to assist in cyber espionage. The FBI’s counterintelligence chief called the case an illustration of “the lengths to which the Chinese Communist Party will go to undermine our democratic institutions.” The Eastern District of Virginia prosecuted the case with the National Security Division.
Honeywell Aerospace pays $2 million over DoD cybersecurity lapses
Honeywell Aerospace Inc. agreed to pay $2,042,518 to resolve False Claims Act allegations that, between April 2020 and December 2023, a predecessor business unit billed the Defense Department while failing to comply with the NIST SP 800-171 cybersecurity controls required by its contract, the department said Sept. 1. The case originated with a whistleblower suit filed by former employee Rachel Tenney — captioned United States ex rel. Rachel Tenney v. Honeywell International Inc., No. 3:22-cv-129 (W.D.N.C.) — and she will receive $375,823 of the recovery.
The settlement resolves allegations only; there has been no determination of liability. Still, the resolution is a signal to the defense industrial base that contractor cybersecurity attestations remain squarely in civil enforcers’ sights. “Companies that seek and profit off of government contracts have an obligation to ensure sensitive data is protected,” said U.S. Attorney Russ Ferguson of the Western District of North Carolina, whose office handled the matter with the Civil Division and the Defense Criminal Investigative Service.
Nine alleged Makk Ballers charged with RICO conspiracy and murder
A second superseding indictment unsealed Sept. 1 in the Eastern District of Virginia charges nine alleged members of the Cautious District subset of the United Bloods Nation — commonly called the Makk Ballers — with RICO conspiracy, racketeering murder and attempted murder, and firearms offenses, according to the department. The indictment alleges the gang operated across eastern Virginia, Maryland, and Delaware, and describes a February 2024 ambush in Accomack County in which three defendants allegedly lay in wait in the woods and fatally shot a man they believed was tied to a rival gang, as well as an earlier shooting that left a sleeping victim partially paralyzed after dozens of rounds were fired into a home.
Three defendants face a mandatory minimum of life in prison if convicted of the murder count. Homeland Security Investigations and the Accomack County Sheriff’s Office are leading the investigation. As with all indictments, the charges are allegations, and the defendants are presumed innocent until proven guilty.
Two tax preparers, two very different endings
A pair of Fraud Division tax cases bookended the week. In Las Vegas, former CPA Michael J. Moore drew a 60-month sentence Sept. 2 for what prosecutors described as two successive false-return schemes, the department said. Court records indicate Moore marketed a “Special Tax Shelter Strategy” to clients — his practice advertised a specialty in the adult entertainment industry — fabricating business losses to erase tax bills and generate refunds, with his fees paid out of the refund proceeds. Records suggest the conduct continued even after he was first charged, shifting to false losses booked through defunct corporate entities, and that he filed some returns using a former employee’s identity without permission. Total tax loss: more than $3.5 million. Moore pleaded guilty to tax evasion, aiding a false return, wire fraud, and aggravated identity theft.
In Detroit, Rodney Underwood pleaded guilty Sept. 1 to making a false claim after, according to court documents, “ghost preparing” more than 200 nearly identical false returns — leaving the paid-preparer field blank so the filings appeared self-prepared — with invented dividend income and withholding figures. The returns claimed more than $7 million in refunds and cost the government roughly $6.2 million. Underwood faces up to five years at his Jan. 6, 2027 sentencing.
Guilty plea in EDNY trafficking and kidnapping case
Chad Barclay, 33, a Trinidadian national and lawful permanent resident, pleaded guilty Sept. 2 in the Eastern District of New York to sex trafficking, and admitted as part of his plea to kidnapping six additional women between 2022 and 2023, the department announced. Prosecutors said Barclay enticed a victim to his residence in September 2022, then robbed and sexually assaulted her; the charges accumulated across two superseding indictments that included Hobbs Act robbery, kidnapping, access device fraud, and witness tampering counts.
Barclay faces a mandatory minimum of 15 years. The FBI’s New York Field Office and the NYPD investigated through the Child Exploitation and Human Trafficking Task Force. “Today’s guilty plea holds him accountable for the devastating harm he inflicted on his victims,” said U.S. Attorney Joseph Nocella Jr.
On TIJ’s radar
Three threads from this docket warrant deeper reporting. First, the $57 million refund scheme: filings indicate the IRS actually paid out more than $8 million against fictitious financial instruments before the scheme was interrupted. How more than 100 false returns cleared the agency’s screening — and whether the National Fraud Enforcement Division’s April reorganization is measurably improving recovery rates — is a question TIJ will put to the data. Second, the Hamas takedown’s donor intelligence: the FBI now holds identifying information on thousands of attempted donors worldwide. Whether that produces material-support prosecutions, including of any U.S. persons, bears watching over the coming months. Third, the Honeywell settlement is the latest in a line of whistleblower-driven cybersecurity False Claims Act resolutions against defense contractors; TIJ intends to examine how widespread NIST 800-171 noncompliance remains across the defense industrial base, and how much of it surfaces only through qui tam suits.
A note on the record: indictments and civil complaints described above contain allegations only, and every defendant in a pending case is presumed innocent unless and until proven guilty. This digest is compiled from Justice Department releases and public court records; where defendants or their counsel have responded on the public docket, those responses will be reflected in TIJ’s follow-up coverage.
Sources
- DOJ: Seven Charged in $57M Tax Refund Fraud Scheme (Sept. 3, 2026)
- DOJ: Justice Department Continues to Disrupt Hamas Terrorist Financing Schemes (Sept. 1, 2026)
- DOJ: American Citizen who Worked as an Agent for the PRC Sentenced (Sept. 1, 2026)
- DOJ: Honeywell Aerospace FCA Settlement (Sept. 1, 2026); U.S. ex rel. Tenney v. Honeywell International Inc., No. 3:22-cv-129 (W.D.N.C.)
- DOJ: Nine Gang Members Charged with RICO Conspiracy and Murder (Sept. 1, 2026)
- DOJ: Nevada Man Sentenced for False Tax Return Schemes (Sept. 2, 2026)
- DOJ: Michigan Man Pleads Guilty in $7M Tax Fraud Scheme (Sept. 2, 2026)
- DOJ: Trinidadian Foreign National Pleads Guilty to Sex Trafficking (Sept. 2, 2026)
Featured image: Robert F. Kennedy Department of Justice Building, Washington, D.C. Photo by Tony Webster via Wikimedia Commons, CC BY 2.0.
.jpg){kind=link}