“We never expected all of this to come out from what we did,” she said.

During Wednesday's press conference, Hickton and others such as Patrick Fallon, assistant special agent in charge of the FBI's Pittsburgh field office, acknowledged Widget Financial's crucial fraud detection work that broke the case wide open.

“You have to really be attuned to connecting the dots, and that's what they did,” Fallon said.

“Perhaps they were thinking that if they opened accounts at credit unions they could fly under the radar and we wouldn't catch them as easily as a bank would,” Cook speculated. “They were wrong.”

In addition to Widget Financial and PNC Bank in Pittsburgh, the conspirators, using false IDs and documents, opened accounts at the $169 million Treasury Department Federal Credit Union in Wash., D.C.; the $361 million Air Force Academy Credit Union in San Antonio, Texas; the $4.1 billion Pennsylvania State Employees Credit Union in Harrisburg, Pa.; the $581 million Red Canoe Credit Union in Longview, Wash.; the $78 million Rutgers Federal Credit Union in New Brunswick, N.J.; the $3 billion Lake Michigan Federal Credit Union in Grand Rapids, Mich.; and, the $83 million Winward Community Credit Union in Oahu, Hawaii, court documents show.

“The actors involved opened accounts anywhere they could at both credit unions and banks,” said Gregory A. Heeb, an FBI supervisory special agent in Pittsburgh. “However, more often than not, the banks/credit unions they used were small. They sought out places that allowed them to use the Internet to open the account and money orders for the initial deposit.”

Cook said in December a Widget Financial branch manager noticed an account had been opened by someone in the New York City area. The branch manager thought that was unusual because another account from someone in the New York City area had been opened about two weeks earlier.

The branch manager took her concerns to the credit union's internal audit/compliance and IT departments.

“At the same time, my vice president of branches got a phone call from someone in New York City who had received mail from us, but he told us he did not open an account with us. I took it from there realizing there was something peculiar here.”

Cook asked her IT department to run a report on all accounts that were opened over the last two years from New York, Rhode Island and Connecticut because it was suspected that some of the accounts were opened from Rhode Island and other accounts were accessed from Connecticut. Widget Financial began offering online account openings in 2012.

“At that point, we unveiled 10 accounts that were similar, so we started looking at the applications,” she said. “The utility bills were the same and looked like a cut and paste type of thing, some of the IDs and some of the phone numbers were the same as well.”

Although the credit union's field of membership includes people who live or work in Erie and Crawford counties in northwest Pennsylvania, Widget Financial FCU offers high-dividend checking accounts and have opened many out-of-state accounts.

“We have accounts in all 50 states including some in international countries,” Cook said. “We changed our name last year from Erie General Electric FCU to Widget Financial, thus explaining the broad membership base.”

Cook said the defendants used common names and in their account applications they claimed they were eligible for membership because of relatives who were also members.

Widget Financial's IT department looked at the IP addresses to see from where and when the accounts were being accessed.

“We could see that from the same IP address, they would log on to one account and then two minutes later would log on to another account and then (minutes later) they would log on to other accounts checking balances,” she said. “At that point I knew we didn't have legitimate accounts opened here.”

Most of the accounts had no or little activity. The transactions included money-ordered deposits, and ACH deposits from a Visa cash advance or from another financial institution, Cook said. In one or two cases, IRS refund direct deposits were made, but the checks did not match the names on the accounts.

Some of the conspirators also had also used Widget Financial debit cards.

“We couldn't figure out how they pulled that one off, other than they may have been stealing from somebody's mailbox at an apartment complex somehow,” Cook speculated.

The accused used these accounts to deposit more than $10 million in federal tax refunds after filing 2,400 fake federal income tax returns over nine years. The defendants also used credit cards with fake IDs to support their criminal enterprise. Some of the tax refund money was wired to Nigeria. Four out of the five conspirators are naturalized citizens believed to be of Nigerian descent, and the fifth defendant holds American and Nigerian citizenship, according to the FBI and court records.

David J. Hickton, U.S. Attorney for Pennsylvania's Western District in Pittsburgh, said the FBI and IRS are continuing their criminal investigation and that the losses are expected to reach tens of millions of dollars.