Adam Iza, a 26-year-old who calls himself “The Godfather,” was sentenced on Oct. 5 to 78 months in federal prison, a little over six years. Prosecutors say he made about $37 million selling access to hijacked Meta business ad accounts, then hid enough of it that the IRS lost $13,286,152 in taxes. He was also ordered to pay $23,402,766 in restitution.

How the ad account scheme worked

The U.S. Attorney’s Office for the Central District of California announced the sentence. Iza admitted that he took over business advertising accounts on Meta’s platforms and sold access to them. The announcement says he received about $37 million from the scheme from 2020 to 2022. Meta refunded the advertisers who were billed. Crypto Briefing reported that the buyers of the access were advertising firms, and that the scheme ran from December 2020 to September 2024. The announcement’s own $37 million figure covers 2020 through 2022.

The tax side: $13.3 million

Iza’s gross income for 2020 through 2023 was at least $36,360,844, according to the announcement. He admitted in his plea that he evaded $13,286,152 in federal taxes on that income. Crypto Briefing reported that he moved the money through crypto custodians and shell companies, which made it harder for the IRS to see it.

The $13.3 million is the tax loss he admitted. The restitution order, $23,402,766, is a separate figure in the announcement, and both sit alongside the 78-month prison term.

Income that does not arrive on a paycheck still has to be reported. Money from selling access to ad accounts, from crypto custodians or from shell companies is income, and the case shows what happens when millions of it go unreported over several years: the IRS counted the loss at more than $13 million.

The tax years in this case are 2020 through 2023, and the sentence was handed down on Oct. 5, 2026.

Get the deadline alerts before they pass →

Crypto Briefing, which covered the sentencing, reported that Iza pleaded guilty in January 2025, that he has been in federal custody since September 2024 and that his federal term will run at the same time as a 15-year sentence in a separate Connecticut case. That case involved a planned violent kidnapping aimed at the parents of a Bitcoin thief, according to the same report.

Deputies on the payroll

The “Godfather” label comes from the other half of the case. Iza admitted paying off-duty Los Angeles County sheriff’s deputies to harass his rivals. Five former deputies were convicted in connection with the operation, according to the announcement. Crypto Briefing reported that the crew cost him about $100,000 a month at its peak.

His former girlfriend, Iris Rabaya Au, was sentenced to 18 months for failing to report more than $2.6 million in gains from the scheme, the same outlet reported. The announcement describes the deputies as off-duty and paid by Iza.

What advertisers were billed, and what they got back

For small businesses that buy ads on Facebook and Instagram, the part of the case that matters is the billing. When an ad account is taken over, the charges can land on the payment method tied to the account. In this scheme, according to the announcement, advertisers were billed and Meta refunded them. The announcement does not say how many advertisers were hit, and it does not say what share of the $37 million was returned.

A business owner who sees ad charges nobody authorized can look at the account’s list of people with access and can raise the charge with the card issuer. The steps below come from a Meta-account management company that tracks how these takeovers happen.

Locking down a business ad account

PinMeto, a company that helps businesses manage Meta accounts, describes how business admins get targeted. Attackers often go after the admin’s personal account with messages that look legitimate, including links that imitate Facebook. Once inside, they can lock out other admins and run fake ads. The fix it recommends starts with two-factor authentication on the personal account, then in Business Settings choosing whether the requirement applies to admins only or to everyone. It also suggests naming a backup admin, saving the 10 recovery codes Meta offers and regularly reviewing which people and apps have access.

If an account is taken over, the same guide says to change the password, follow any security alert emails from Meta, use the recovery links, secure the email account tied to the profile and remove unfamiliar devices and apps.

The tax side has its own free route. The IRS says people can use Form 3949-A to report alleged tax law violations by an individual, a business or both, and a copy can be filled out online. For the criminal case, the Justice Department’s announcement is the record of what was admitted.

More Financial Reading

• 24 Ways to Stretch a $2,087 Social Security Check
• 17 Places to Find Your Share of the $4.25 Billion States Give Back
• 20 Medicare Money Moves Now That Part D Caps at $2,400

This article was produced with AI assistance and edited for accuracy against the sources linked above.