Air Force Members Convicted in Multi-Year Business Email Compromise Scheme
Two enlisted members of the U.S. Air Force have been sentenced to significant prison terms after pleading guilty to orchestrating a sophisticated business email compromise (BEC) operation that resulted in the theft of more than $2 million from at least 15 victim organizations. Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, were stationed at Dover Air Force Base in Delaware when they conducted the fraud scheme over a period exceeding two years.
The defendants carried out their attacks by sending phishing emails designed to harvest login credentials from employee email accounts. Once they gained access, they monitored internal communications for discussions involving financial transactions. Using stolen credentials and spoofed email addresses, they inserted themselves into ongoing email chains, posing as trusted parties to redirect payments into bank accounts under their control.
Fraudulent Tactics Included Payment Diversion and Data Theft
Prosecutors detailed that the pair manipulated email threads to send falsified wiring instructions, thereby diverting legitimate business payments. In one notable case, they intercepted and redirected a $1.7 million payment intended for a victim organization in Iowa. In another, they diverted a $720,000 wire transfer from a company based in Ohio. These two incidents alone accounted for a substantial portion of the total losses attributed to the scheme.
Beyond payment redirection, Odimegwu and Mogaji also harvested sensitive financial data from compromised accounts, including bank account numbers, credit card details, and debit card information. This stolen data was used both to make unauthorized purchases and to sell access to other cybercriminals. Investigators found evidence that the two traded stolen card information between themselves for personal use.
Court Proceedings and Sentencing Outcomes
Both airmen pleaded guilty in June to charges of wire fraud, identity theft, and access device fraud. During sentencing on Friday, the court imposed differing terms based on their respective roles and the extent of restitution ordered. Odimegwu received a prison sentence of more than nine years and was ordered to pay $366,617 in restitution to victims. Mogaji was sentenced to 6.5 years in prison and must pay $995,680 in restitution.
In addition to their incarceration, each defendant will serve a three-year term of supervised release following their prison sentence. The sentences reflect the severity of the crime, particularly given the defendants’ status as active-duty military personnel who abused their positions to conduct criminal enterprises.
Part of a Broader Trend of Military Personnel Involved in Cybercrime
This case follows closely on the heels of another recent sentencing involving a former U.S. Army soldier who was given more than five years in federal prison last week after pleading guilty to hacking into multiple telecommunications companies and leaking sensitive records. Together, these cases underscore an ongoing concern about cybercriminal activity among current and former service members.
The investigation into Odimegwu and Mogaji’s activities was led by the FBI in coordination with local law enforcement officials. Their arrest ended a scheme that had operated undetected for over two years, highlighting the persistent threat posed by BEC scams, which rely on social engineering rather than technical exploits to compromise business finances.
Source: The Record