Former US Air Force Members Sentenced for BEC and Phishing Fraud

Two former members of the United States Air Force have been sentenced to a combined 189 months in federal prison for their involvement in a multi-year series of business email compromise (BEC) scams and phishing campaigns.

Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, carried out the attacks while stationed at Dover Air Force Base in Delaware. The pair utilised spamming and phishing campaigns to steal employee email credentials from various victims.

The defendants used spoofed email addresses to mimic legitimate business partners. By combining these fake identities with the stolen credentials, they successfully redirected corporate payments to accounts controlled by accomplices in the United States and abroad.

The Department of Justice stated that the conspiracy diverted more than $1.68 million in a single wire transfer from a victim in Iowa. They also intercepted a wire transfer exceeding $720,000 sent by a victim in Ohio, alongside numerous other attempts targeting businesses across the United States.

Criminal Tactics and Financial Impact

In addition to email interception, Odimegwu and Mogaji used stolen financial information, including account numbers, personal identification numbers (PINs), and credit and debit card data, to make unauthorised transactions. This data was often supplemented by information purchased from criminal partners.

Odimegwu received a prison sentence of 111 months and was ordered to pay $366,617.59 in restitution. Mogaji was sentenced to 78 months in prison and ordered to pay $995,680.45 in restitution. Following their prison terms, both individuals must serve a three-year term of supervised release.

The Scale of BEC Threats

Business email compromise occurs when cybercriminals use compromised corporate accounts to deceive billing departments into approving fraudulent banking changes. Once the fraudulent payment is received, attackers typically use money mules or rapid transfers to move the funds before they can be frozen by authorities.

The FBI’s 2025 Internet Crime Report highlighted that BEC remains a significant threat, with 24,768 complaints resulting in more than $3 billion in losses over the previous year.