The IRS mailed him $3.6 million in checks. He deposited them like paychecks.

Elaine sat in her car outside the CVS on Derry Street and refreshed the page.

Where's My Refund. She had checked it every Monday since May. It was now the middle of July. The bar had been stuck on Return Received for eleven weeks. Her refund was $2,143. She was a bookkeeper. She had filed on time, filed clean, filed the way she filed for the small dental practice she kept books for on the side. The IRS owed her the money. The IRS was busy.

While she refreshed, according to a federal indictment unsealed on July 21, 2026 in the Middle District of Pennsylvania, roughly $3.6 million in United States Treasury checks had already been mailed to a man about forty minutes south of her, in York. The checks were made out for pandemic tax credits on two businesses that, prosecutors allege, no longer existed.

Elaine did not know that yet. Nobody in the CVS parking lot did.

This is the story of the pipe. What went into it. What came out. And who was standing at the other end holding a bag.

I.

The Justice Department calls it a conspiracy. The named defendants are Christopher Slater of California and Mark Keagel of York, Pennsylvania. A federal grand jury in Harrisburg returned the indictment. Slater was arrested on July 20, 2026. The charges were announced the next day by U.S. Attorney Brian D. Miller and Assistant Attorney General Colin M. McDonald of the Justice Department's National Fraud Enforcement Division.

The counts include conspiracy, mail fraud, money laundering, and theft of government property.

The numbers, from the indictment.

$52.7 million claimed.

$32.2 million paid.

290 false tax returns.

35 businesses.

Read those slowly. Two hundred and ninety returns. Thirty-five businesses. That is not a mistake. That is a factory.

The credits at the center of this case have polite names. The Employee Retention Credit. The Paid Sick and Family Leave Credit. Congress created them in 2020 to keep workers on payroll during the shutdowns. If a business kept paying wages while its doors were closed by government order, the government would refund a chunk of those wages as a tax credit. If the business had already filed its quarterly payroll return, it could file an amended one. Form 941-X. That is the form that reaches back in time and says, we forgot to claim something.

That form is the valve.

II.

Here is how the pipe worked, according to the indictment.

Slater is alleged to have recruited business owners. He gathered their business information. Then he or his co-conspirators filed amended payroll returns claiming the credits. The returns went to the IRS. The IRS, buried under a backlog, mailed Treasury checks.

Keagel is alleged to have supplied two businesses of his own. Both defunct. Both without the payroll a real claim would require. The checks came anyway. About $3.6 million worth. He is alleged to have laundered the proceeds.

That is the whole machine. Recruit. File. Deposit. Launder.

The reason it worked is the reason so many pandemic fraud cases worked. The IRS was not built to manually process a tidal wave of amended returns during a national emergency. The credits were retroactive. The eligibility rules were complicated and changed twice. The agency processed on the honor system, then audited later. Later is where we are now.

By the IRS's own count, its Criminal Investigation division has opened 323 investigations involving over $2.8 billion in potentially fraudulent Employee Retention Credit claims for tax years 2020 through 2023. The Justice Department inspector general has said the total COVID relief fraud is clearly in the tens of billions and may exceed $100 billion. An Associated Press analysis put the potential theft north of $280 billion, with another $123 billion wasted or misspent.

Elaine's $2,143 was in that same queue.

III.

I have sat in rooms like the one the indictment describes. Not this one. I do not know Slater and I have never been to York. But I have sat in rooms where a guy walks in with a list of small business owners and a stack of forms and says, we can get you money from the government you did not know you had coming.

The pitch is always the same shape. You qualify. Most people do not know they qualify. We do this for a fee, or a percentage, or a flat cut. Sign here. We will handle the paperwork.

The mark, if there is one on the recruiting side, is a real business owner who is told a lie about eligibility. Sometimes the mark is complicit. Sometimes the mark is a name and a tax ID and nothing else, because the business is defunct and the owner is in on it. The indictment against Keagel is the second kind. The two businesses he allegedly supplied did not have the qualifying payroll. They existed on paper. That was the point.

The refund pipe does not care which kind of business goes in. It cares about the Form 941-X coming out.

IV.

Picture the mailbox in York.

A Treasury check arrives. Then another. Then another. The envelopes have the Department of the Treasury return address. The paper is real. The signature is real. The routing number is real. A bank will cash it without question.

That is the part civilians do not understand about this kind of fraud. There is no fake check. There is no forgery. The check is genuine. The IRS printed it. The IRS mailed it. The bank clears it because it should clear. Everything about the instrument is correct except the underlying claim.

The lie is upstream. The lie is on Form 941-X, in a line item saying this business paid these wages during this quarter and is owed this credit. Once that lie is accepted, everything downstream is government-issued.

That is why the money laundering count matters. Once the check clears, the money is clean-looking. Moving it through personal accounts, business accounts, purchases, and back out is what the government calls concealment. The check was the loud part. Everything after is the quiet part.

V.

Elaine finally got her refund in October. Five months late. She never wrote to her congressman. She just went back to work.

She does not know about the Harrisburg indictment. She has not read the DOJ press release. If she did, she would recognize the shape of it. Every bookkeeper does. The businesses that closed in 2019 do not file amended payroll returns in 2022. The ones that do are not businesses. They are wrappers.

The maximum sentences, if convicted: up to twenty years for each of Slater's mail fraud counts. Up to ten years each on the money laundering and theft of government property counts. The charges are allegations. The defendants are presumed innocent. That is the law and I will honor it.

But there is something worth saying about the pattern.

Within the last thirty days, federal prosecutors have announced a Nevada tax preparer and eleven others indicted for pandemic loan fraud. A man sentenced to three years for a $32 million business tax refund. Nine defendants convicted in a $4.5 million pandemic relief conspiracy. A Placer County man sentenced for stealing nearly $1.5 million in relief loans.

That is one month.

The pipe did not close when the pandemic ended. The pipe closed when the IRS finally paused new ERC claims in September 2023. Every case being announced now is the sediment settling from what already flowed through.

VI.

Elaine kept her copy of the return in the top drawer of her kitchen desk. Behind it, a folder of pay stubs for the dental office, organized by quarter. She has never filed an amended payroll return in her life. She would not know how to do it wrong.

That may be the saddest part. The honest ones read the instructions. The pipe did not need instructions. The pipe needed a form and a mailbox.

The indictment alleges $32.2 million was mailed out.

Somebody had to wait five extra months for two thousand dollars so that could happen.

Not because the IRS chose it that way. Because the pipe was faster than the audit.

The Treasury check is not the crime. The Treasury check is the crime scene.