Two former members of the United States Air Force have been sentenced to federal prison for their involvement in a multi-year scheme of business email compromise (BEC) and phishing campaigns. Chijioke Timothy Odimegwu, 25, received a sentence of 111 months, while Harafat Mogaji, 26, was sentenced to 78 months. Both individuals will also serve a three-year term of supervised release following their prison sentences.
The defendants carried out these cyberattacks while stationed at Dover Air Force Base in Delaware. Their methods included stealing employee email credentials through spamming and phishing, then using "spoofed" email addresses that mimicked those of legitimate business partners. With these compromised credentials and deceptive emails, they redirected payments to bank accounts controlled by their co-conspirators, both within the United States and internationally.
In addition to diverting wire transfers, Odimegwu and Mogaji also conducted unauthorized financial transactions using stolen financial information, including account details, personal identification numbers, and credit and debit card numbers. Some of this data was acquired from their partners in crime.
The Department of Justice confirmed that the duo fraudulently diverted a wire transfer exceeding $1.68 million from a victim in Iowa City, Iowa, to a Chicago bank account controlled by the conspiracy. They also diverted over $720,000 from an Ohio victim to another controlled account. These incidents were part of numerous attempts made by Odimegwu and Mogaji to divert wire transfers from businesses across the country.
Odimegwu has been ordered to pay $366,617.59 in restitution, while Mogaji is required to pay $995,680.45.
BEC scams typically involve cybercriminals using compromised email accounts to trick billing departments into updating banking information, thereby redirecting legitimate corporate payments to accounts under the attackers' control. Once funds are received, they are rapidly moved through money mules or transferred to other accounts to circumvent freezing orders.
The FBI's 2025 Internet Crime Report highlighted BEC as a significant cyber threat, recording 24,768 complaints and over $3 billion in losses in the previous year. This case follows other recent prosecutions, such as that of Ghanaian national Derrick Van Yeboah, who was sentenced in July to 85 months in prison after pleading guilty in March 2026 to his role in a fraud ring that stole over $100 million through BEC attacks and romance scams.
