No PO Box needed, just use a foreclosed home's mailbox as a dead drop. Bank accounts held by trusts held by trusts receive the IRS direct deposit. Stolen wifi to perform the e-file.
Electronic Funds Transfer = prepaid debit cards = cash = prepaid debit cards (x2) = cash = deposit in real bank account held by person.
Add a couple chained off-shore corporations get involved in that equation, it's impossible to trace without US AG subpoenas. Even then it's iffy and requires a lot of diplomatic posturing. Read: Holder doesn't have the nuts.
We in the US have created a system that caters to this type of fraud, why is everyone surprised that it's still happening?
(Disclaimer, this kind of thing is watched, and arrests are made every single week. Don't think I'm giving you a recipe.)