Spirikaitis is wanted by the FBI on charges of embezzlement in the failure of the $23.6 million Cleveland credit union. The FBI said it has received a "handful" of new leads since releasing last week a photo of  Spirikaitis  without his goatee. A previously released driver's license photo showed him with a goatee.

Court documents, filed by Assistant U.S. Attorney James L. Mumford on July 26, show the construction of Spirikaitis' home was first paid for with two checks totaling $100,000 from his TLCU personal account.

"All remaining checks – totaling approximately $1,555,132 – came from Spirikaitis in the form of Taupa Lithuanian Credit Union official checks," court documents state. "While working at the Taupa Lithuanian Credit Union, Spirikaitis never made in excess of $50,000."

During a review of TLCU's computer systems after it was liquidated July 12, NCUA auditors discovered Spirikaitis used a software program on his computer identified as "Phantom Font." 

That allowed him to electronically download documents and then alter them on his computer, according to court documents. In doing so, he was able to print out a new version with the information he keyed in that exactly mirrored the look and style of the original document from Corporate One Federal Credit Union in Columbus, Ohio, federal authorities allege.

Corporate One FCU provides correspondent banking services to 1,000 credit unions across the country, including TLCU.

Court papers also revealed documents provided by the NCUA had been altered and modified by Spirikaitis, including the Corporate One account statements for TLCU.

"Spirikaitis printed out numbers he wanted to report to auditors and the NCUA, and (then he) taped them over the real numbers from the true Corporate One Federal Credit Union account statement," court documents state. "Spirikaitis then photocopied the altered document resulting in a document that mimicked the appearance of the statement coming directly from Corporate One Federal Credit Union."

The true Corporate One statements showed that TLCU had balances of $229,894, $10,000 and $319,574 – a total of $559,469 as of Jan. 1, 2012, according to court documents. However, TLCU's December 2011 Call Report falsely listed $16,165,288 in assets deposited with correspondent credit unions, authorities said.

The FBI search for Spirikaitis began on July 16 when local police thought they were in a standoff after arriving at his Solon home to arrest him at around 8 p.m. However, when authorities entered the home the next morning, he was not there.

FBI Special Agent Vicki Anderson when police approached the home that evening, Spirikaitis' relatives gave every indication he was inside.

"Family members left the house with us and we thought, from the information we gathered, that he was not going to willingly come out," she said.

For safety's sake for the residential neighborhood, Anderson said authorities waited until daybreak for tactical teams to move in. Additionally, Anderson said, the size of the large home played a part in the decision to wait until daylight before entering.

The official charge the FBI has brought against Spirikaitis, making false credit institution entries, is an unusual one. Anderson said the charge falls under the embezzlement category, and because it is one that could be quickly proven, FBI officials utilized the charge so authorities could quickly execute an arrest warrant.

Still, Anderson said, authorities did not expect Spirikaitis to pose a flight risk.

The FBI now reports he may flee to Canada and was last seen in Cleveland as well as the suburbs of Solon and neighboring Twinsburg.

The former credit union CEO also may go by the aliases, "Michael R. Hess, Rudy Hess or Richard Spirikaitis," authorities said.

Anyone with information about the whereabouts of Spirikaitis is asked to call the Cleveland FBI at (216) 522-1400 or at [email protected].

The FBI agent also said Spirikaitis may have not acted alone.

"This is a very early on investigation, so we have a lot more work to do," she said. "If people have information about Mr. Spirikaitis and his whereabouts, but also about any dealings that occurred [at the credit union], and wish to come in and talk about it, we're more than open to that."

The drama followed the July 12 liquidation of the $23.6 million credit union, which was seized by the Ohio Department of Financial Institutions and handed over to the NCUA after determining the 1,154-member cooperative was insolvent and had no prospect for restoring viable operations.

Fraud was suspected after a review of the credit union's financial performance reports posted on the NCUA's website revealed 10.31% net worth, 0.78% delinquencies, no charge-offs and 0.42% ROA as of March 31. One abnormal financial statistic was cost of funds, which at 0.87% was much higher than the peer average of 0.36%.

While the failed credit union's website revealed it was paying above-average dividends to members, 0.01% to 0.10% APY for checking, 0.15% APY for savings and as much as 0.40% APY on a $25,000 or larger certificate, the amounts did not justify the cost of funds.

And, liquidity was not an issue, indicating the credit union did not have outstanding borrowings that were driving up cost of funds. The credit union's loan-to-share ratio as of March 31 was less than 35%, far below peer averages.

Taupa Lithuanian did report a considerable amount of cash on its books, more than $15 million as of March 31, with just $729,595 in investments. Total loans were $7.4 million during that period.

The standoff, widely reported by local Cleveland news outlets, did not appear to trigger a run on deposits. A Credit Union Times correspondent visited the credit union's headquarters July 17 and encountered an armed security guard standing behind a glass door of the office, housed in a non-descript brick building on Cleveland's east side.

The guard said the credit union had been closed. He was handing out single-page informational leaflets to members.