The $13.3 Million Wake-Up Call: What the ComplYant Fraud Teaches Angel Investors About Due Diligence

TL;DR: Shiloh Luckey, founder of the Los Angeles tax-compliance startup ComplYant App Inc., was arrested on September 6, 2026 at a Fort Lauderdale cruise terminal as she prepared to board a ship. Federal prosecutors allege she raised $13.3 million from investors by claiming monthly revenue as high as $250,000, when the company's actual monthly revenue never exceeded $620. A single bank statement would have exposed the gap. She also falsely claimed a CPA license she never held.

A Founder Arrested at the Dock

On September 6, 2026, federal agents stopped Shiloh Luckey, 42, at a Fort Lauderdale cruise terminal as she prepared to board a ship. She was charged with 15 federal counts: nine counts of securities fraud, three counts of wire fraud, one count of bank fraud, and two counts of money laundering, according to the U.S. Attorney's Office for the Central District of California. She has since been released on bond and is expected to appear in Los Angeles federal court.

Luckey founded ComplYant App Inc. in 2019. The Los Angeles startup offered software to help small business owners track state-by-state tax obligations. It was a real product addressing a real problem. Venture capital firms including Craft Ventures, Mucker Capital, and Techstars backed the company. Business Insider profiled Luckey as an emerging founder to watch. From the outside, ComplYant looked like a startup working through the hard early years.

From the inside, prosecutors allege, the company Luckey pitched to investors bore almost no resemblance to the company she actually ran. The alleged gap between those two versions cost investors $13.3 million, all of it lost when ComplYant ceased operations in September 2023.

For angel investors and accredited investors evaluating pre-seed and seed-stage startups, this case is one of the clearest instructive fraud examples in recent years. Not because it is unusual, but because it illustrates a failure mode that is both common and entirely preventable.

The Number That Defines This Case: $620 Versus $250,000

The core of the fraud was a revenue fabrication so extreme it is almost difficult to process. Between late 2020 and late 2022, Luckey's pitch decks showed monthly recurring revenue growing from roughly $2,500 to more than $250,000. She presented claimed annual recurring revenue of $3.1 million to at least one prospective investor in October 2022, implying roughly $258,000 per month.

The SEC's civil complaint, filed against Luckey on October 20, 2025 in the Central District of California (Case No. 2:25-cv-10026-RGK-JC), tells a different story. From November 2020 to September 2022, the company's monthly subscription income averaged around $250. It never exceeded $620 in any single month. ComplYant never had more than 131 total paying subscribers across its entire operating history.

That is a roughly 400-to-1 gap between what investors were told and what was real. One investor's scorecard from October 2022, cited in the SEC complaint, described Luckey as having "gotten the business to $3.1M in ARR." That investor was relying entirely on what Luckey told them. Nobody appears to have asked for a Stripe screenshot or a bank statement.

I want to be direct about what this means. A company doing $3.1 million in annual recurring revenue has hundreds of active paying subscribers, consistent monthly inflows visible in any payment processor, and a cash profile that shows clearly in three months of bank statements. A company doing $620 per month looks completely different. You do not need a forensic accountant to tell the difference. You need one document.

Financial educators have made this point repeatedly. As one 2026 due diligence guide for angel investors notes, confirming a monthly recurring revenue figure "can be confirmed or disproven in two minutes by reviewing Stripe or bank statements." Two minutes. The fact that investors consistently fail to request this documentation is, the guide notes, "a known pattern that some founders exploit."

The pattern Luckey allegedly exploited was not a sophisticated loophole. It was a gap in process. Many angel investors treat pitch deck financials as trustworthy rather than as unverified claims requiring independent confirmation. They are marketing materials. Treat them that way.

The Credential That Was Never Real

Luckey's second alleged misrepresentation compounded the first. Throughout her investor interactions, she presented herself as a licensed Certified Public Accountant. The CPA credential was central to her pitch: it explained why she had identified the problem ComplYant was solving, and it positioned her as a domain expert in tax compliance. At least one investor, per the SEC complaint, cited her CPA background directly in their investment rationale, describing her as "an accountant by trade" who had "served 300 small businesses in Los Angeles as a career CPA."

Prosecutors say she never held a CPA license in California or in any other state.

Verifying a CPA license in the United States is not difficult. The National Association of State Boards of Accountancy operates CPAverify.org, a free public database covering license records from 54 of the 55 state boards of accountancy. As NASBA explains, any member of the public can search by name or license number and immediately see current license status, issue dates, and any disciplinary actions. The search takes under a minute. FINRA also maintains a resource page for investors on professional designation verification, directing anyone who needs to confirm a CPA's credentials to contact the appropriate state board of accountancy directly.

A LinkedIn profile is not credential verification. A founder's bio in a pitch deck is not credential verification. A press profile is not credential verification. The only check that counts is a direct lookup against the relevant licensing body's public records. For CPAs, that means CPAverify.org or the state board. For attorneys, the state bar directory. For physicians, the state medical board. These checks are free, take minutes, and cannot be faked by a polished PDF.

A Diligence Framework Built on This Case

The ComplYant fraud is not a lesson in detecting sophisticated deception. It is a lesson in executing basic diligence. The failures that allowed this scheme to run for three years are all correctable with a consistent process applied before you commit capital.

Verify revenue through a primary source, not through a pitch deck.

Before you write a check, request three to six months of actual bank statements or direct read-only access to the company's payment processor account. Stripe, Square, Braintree, and similar platforms all allow founders to generate account reports showing actual inflows. Neither bank statements nor payment processor exports can be fabricated as easily as a slide. If you cannot reconcile what the primary source shows against the MRR figure the founder is claiming, you have an unresolved discrepancy that must be explained before money moves.

The onlyCFO newsletter, which analyzes startup finance and reporting practices, analyzed the ComplYant case and recommended that investors require bank statement access on a recurring basis, ideally through a software integration that lets investors view balances directly. For angel investors writing $25,000 to $150,000 checks, a simpler version works: ask for three months of statements, match inflows to claimed MRR, and ask for written explanations of any discrepancies before you proceed.

Founders who refuse this request are declining to participate in diligence. That refusal is not a negotiating posture. It is a result.

Verify professional credentials against the licensing body's records, not against materials the founder supplies.

Every professional credential a founder uses to establish domain expertise (CPA, JD, MD, PE, or any other licensed designation) should be verified against primary-source public records before you invest. This is a 60-second task. Build it into your process as a non-negotiable step that runs in parallel with your first conversation, not as an afterthought.

Treat deadline pressure as a reason to slow down, not to commit faster.

Luckey's scheme ran for three years in part because investors moved at the pace she set. Legitimate early-stage rounds do have real timelines. But a founder who tells you the round closes Friday and you must decide today is either poorly managing an oversubscribed moment or applying deliberate pressure to limit your homework time. Ask for 72 additional hours. If you lose the deal because you requested three days to verify financials, you did not lose a good deal.

Why Experienced Investors Got Fooled

I want to be direct about something: ComplYant attracted investment from venture firms with experienced teams. Craft Ventures, Mucker Capital, and Techstars are not unsophisticated organizations. They have conducted hundreds of investments between them. And yet the alleged fraud ran from 2020 to 2023, raising over $13 million across multiple rounds.

Confidence is persuasive. A founder who speaks fluently about TAM and MRR and unit economics, who arrives with professionally designed materials and a coherent market narrative, reads as credible in ways that are difficult to override with intuition alone. The investors who backed ComplYant did not fail because they are gullible. They failed because they skipped a process step.

Process is what saves you when confidence misleads. The SEC has stated clearly that startup founders "cannot fake it until they make it by falsifying revenue metrics." That statement points to an obligation: the burden is on investors to create verification conditions that make falsification detectable. A confident founder and well-produced pitch materials are not those conditions. Bank statements and a CPAverify.org search are.

If you invest in 10 startups over five years as an angel, you will meet at least one founder who is more impressive in conversation than in the underlying numbers. The ComplYant case is an extreme version of that gap. But the diligence framework that would have stopped this scheme is exactly the same one that protects you against the less dramatic version: a founder who genuinely believes her projections but is giving you optimism rather than data. Verify the revenue. Verify the credentials. Slow down when someone tells you to speed up.

Frequently Asked Questions

How do I verify a startup's monthly recurring revenue before investing?

Request read-only access to the company's payment processor account (Stripe, Square, or similar) or ask for three to six months of bank statements showing actual cash inflows. Match those inflows against the MRR figure the founder is claiming. If the numbers do not reconcile, ask for a written explanation before committing capital. Screenshots of dashboards are easier to alter than read-only account access or original bank statements, so prefer primary-source access over documents the founder controls.

How do I verify that a founder actually holds the professional credentials they claim?

For CPAs, search CPAverify.org, the free public database run by the National Association of State Boards of Accountancy, covering records from 54 of the 55 state boards. For attorneys, check the state bar's public directory. For physicians, check the state medical board's license lookup. These searches are free, take under two minutes, and return current license status and any disciplinary history. A LinkedIn profile is not a substitute for a primary-source license check.

What should I do if a founder tells me the round is closing in days and I need to decide now?

Ask for 72 hours to complete basic financial and credential verification. A founder running a legitimate raise will accommodate a short extension from a serious investor. A founder applying pressure to prevent diligence will either grant the extension reluctantly or refuse outright. Either response tells you something important about who you are dealing with. Deadline pressure is not a reason to skip verification; it is a reason to be more deliberate about it.

Does this level of diligence apply to small angel checks, like $10,000 to $25,000?

Yes. The ComplYant investors who lost money did not all write seven-figure checks. The revenue gap in this case was so large it would have been visible in a single bank statement regardless of check size, and a CPAverify.org credential search takes the same two minutes whether you are writing $10,000 or $500,000. Apply the core steps consistently: verify revenue through a primary source and verify credentials against the licensing body's records. Reducing diligence because your check is smaller reduces your protection at the same rate.

Author Disclosure: Jeff Barnes, MBA has no personal position in any company, fund, or platform named in this article. Angel Investors Network has no current commercial relationship with any party mentioned. AIN provides marketing and education services, not investment advice. Past performance does not guarantee future results. All investments involve risk, including loss of principal.