Two former U.S. Air Force members were sentenced to a combined 189 months in prison for their roles in a years-long fraud campaign that targeted email data and diverted business payments worth more than $2.4 million to accounts controlled by accomplices.
A U.S. court sentenced Chijioke Timothy Odimegwu and Harafat Mogaji, two former U.S. Air Force members, to a combined total of 189 months in prison for their roles in a series of phishing and business email compromise (BEC) attacks carried out over several years.
The two men carried out the attacks while serving at Dover Air Force Base in Delaware. According to court documents, they obtained employees’ email credentials through phishing campaigns and spam messages, then used spoofed email addresses that mimicked those of legitimate business partners. This enabled the group to direct accounting departments to transfer payments to bank accounts controlled by accomplices inside and outside the United States.
Millions of Dollars in Financial Transfers
The U.S. Department of Justice said the defendants and their accomplices fraudulently transferred more than $1.68 million that had been sent by a victim in Iowa City, Iowa, to a bank account in Chicago controlled by the network. They also transferred more than $720,000 from a victim in Ohio to another account belonging to the conspiracy, in addition to other attempts to target financial transfers involving companies in Iowa and different parts of the country.
The activities were not limited to intercepting bank transfers; the defendants also conducted financial transactions without the victims’ knowledge using stolen data, including account information, personal identification numbers, and credit and debit card numbers, along with data they purchased from their criminal associates.
Odimegwu was sentenced to 111 months in prison and ordered to pay $366,617.59 in restitution. Mogaji was sentenced to 78 months in prison and ordered to pay $995,680.45. After completing their sentences, both will be subject to three years of supervised release.
Why Does This Matter?
The case shows that BEC attacks do not necessarily rely on sophisticated malware; combining stolen credentials with the impersonation of a business partner may be enough to persuade accounting employees to change transfer details. Once the money arrives, attackers typically use money-mule accounts or move it among multiple accounts to make it more difficult to freeze or recover.
Financial losses remain the greatest direct impact of this type of attack. According to the 2025 Internet Crime Report issued by the Federal Bureau of Investigation (FBI), 24,768 complaints related to business email compromise were recorded, with losses exceeding $3 billion during the previous year.
The case also indicates that the threat may extend across borders, as the defendants worked with associates inside and outside the United States. However, the source does not specify the mechanisms for recovering the money or the security measures that could have prevented the transfers, so a broader assessment of the effectiveness of the victims’ technical controls cannot be drawn from this case alone.