Who Was Running This Operation
Nicholas Ngwun was behind the scheme. He bought stolen personal information and credit card records from dark web marketplaces, then used them to take over at least 33 myIR accounts, which is Inland Revenue’s online portal. He filed fake GST claims, income tax refund applications, and COVID-19 relief requests, trying to steal more than $2 million.
Ngwun was sentenced to five and a half years in prison on July 14, 2026, after being found to be the ringleader. At Andrew Shipton’s sentencing, District Court Judge Yelavich said that Ngwun was the mastermind who brought Shipton into the scheme.
The link to the dark web is clear and proven. Ngwun didn’t guess his victims’ identities—he bought them. He purchased names, dates of birth, addresses, and account information from criminal marketplaces that sell stolen personal records. As we’ve discussed before, stolen identity packages are often put together from several data breaches and sold on underground forums, usually with enough details to let someone pretend to be another person in government and financial systems.
Andrew Shipton’s Role: The Physical Face
Shipton’s role was different from his brother’s. While Ngwun worked online by buying data, accessing government portals, and filing fake claims, Shipton was the one who appeared in person.
Ngwun made fake driver licenses with Shipton’s photo but other people’s names. Using these forged documents, Shipton went into bank branches five times between February and May 2023. He used the fake licenses, false Community Services Cards, and fake utility bills to open and verify accounts in stolen identities.
After the fake payouts came from Inland Revenue, Shipton withdrew cash at bank counters and ATMs, taking out $28,000 during the scheme.
This case stands out because of the clear split between digital and physical crime. Ngwun handled the digital side, including buying data on the dark web, taking over myIR accounts, and filing fake government claims. Shipton took care of the physical side, such as visiting bank branches, using forged documents, and making cash withdrawals. This mix of online and real-world crime is a trend that security researchers have noticed. We’ve also seen similar cases where fraudsters use empty homes and postal services as part of their schemes, combining online research with actions in the real world.
He Was on Home Detention at the Time
This detail is from the court record and should be stated clearly. When Shipton went to bank branches with fake documents, he was either on electronically monitored bail or serving home detention for other reasons.
This means he was wearing an ankle bracelet, so Corrections had a record of where he went. Looking back, this was exactly the evidence investigators needed.
Investigators used CCTV footage from bank branches, mobile phone tracking data, and electronic monitoring records from Corrections to show that Shipton was at each bank at the right time. The ankle monitor, which was supposed to limit his movements, ended up proving he made those trips.
When Judge Yelavich sentenced Shipton to three years, he said Shipton was less responsible than his brother because he was brought into the scheme instead of planning it. However, the court also considered that Shipton kept offending while already under a court order and electronic monitoring.
What myIR Accounts Are and Why They Matter
For readers outside New Zealand, myIR is the online portal where New Zealand taxpayers manage their tax matters with Inland Revenue. It lets people access GST registration, income tax accounts, and, during Covid-19, different government relief and subsidy applications.
By taking over at least 33 myIR accounts, Ngwun was able to file fake claims as if he were those taxpayers. He got into the accounts using stolen identity information bought on dark web markets. Shipton then used the same information to open bank accounts in those stolen names, setting up a way to receive the fake payouts.
Ngwun tried to steal $2 million through fake GST, income tax, and Covid relief applications. Shipton managed to withdraw $28,000 before the scheme was stopped.
New Zealand’s Covid-19 relief schemes were especially tempting for fraudsters because they were set up to pay out quickly during the 2020-21 economic emergency. Like similar programs in other countries, the fast payment process helped real recipients but also reduced the friction that would otherwise flag suspicious applications.
The Sentence and What Comes Next
Shipton admitted to four charges of receiving over $1,000 and 13 charges of using fake documents. He got a three-year sentence, which is much shorter than his brother’s five-and-a-half-year term, because the court saw his role as less serious.
Ngwun’s much longer sentence shows he was the main planner. He got the stolen identities from the dark web, made the fake documents, controlled the myIR accounts, and set up the whole scheme. Shipton handled the in-person banking tasks.
This case shows how modern identity fraud splits up the work. One person handles the technical and digital side, like buying data on the dark web, taking over accounts, and filing fake government claims. Another person does the physical work, such as showing up in person, handling cash, and dealing with bank checks. Dividing the roles also spreads out the legal risk, but in this case, both men were sentenced.
For people in New Zealand, it’s important to know that identity theft doesn’t need a local data breach. Stolen New Zealand identity records can be bought on global dark web markets, put together from many breaches around the world. As we’ve mentioned, 2.5 billion records were traded on dark web markets in the first half of 2026 alone, and New Zealanders’ data shows up in international criminal databases no matter where the breach happened.
Inland Revenue hasn’t said publicly whether they made any changes to myIR’s authentication after the scheme. The fraud happened during 2022 and 2023.
If you think your myIR account or identity might have been stolen, call the New Zealand Police non-emergency line at 105. You can also report identity theft to the New Zealand Privacy Commissioner and CERT NZ for cyber incidents. Our guide on what to do if your personal data is exposed has a full checklist, no matter where the breach happened.
Frequently Asked Questions
Who is Andrew Shipton?
Andrew Shipton, who is also known as Adrian Ngwun, is an Auckland man in his thirties. He was sentenced to three years in prison on November 3, 2026, for his part in a tax and COVID relief fraud scheme that used the dark web.
What did Andrew Shipton do?
He went to Auckland bank branches five times using fake driver licenses and forged identity documents made by his brother. He opened accounts in stolen identities and withdrew $28,000 in fake tax and COVID payments.
Who was the ringleader?
His brother, Nicholas Ngwun, was sentenced to five and a half years on July 14, 2026. Ngwun bought stolen identity records on dark web marketplaces, took over 33 myIR accounts, and filed more than $2 million in fake tax and COVID relief claims.
How did investigators catch them?
Investigators used CCTV footage from bank branches, mobile phone location data, and electronic monitoring records from Corrections. Shipton was wearing an ankle bracelet during the crimes, so his movements were recorded.
Was Shipton already under a court order when he offended?
Yes. He was on electronically monitored bail or home detention for unrelated matters when he visited bank branches.