Security1 publisher2 min readPublished
Two former Air Force members get 189 months for BEC scams that diverted business wires
Former airmen Chijioke Timothy Odimegwu and Harafat Mogaji got a combined 189 months in federal prison for BEC scams that diverted a $1.68 million wire. Their scheme worked wherever a payer accepted new bank details on the strength of an email.
The Watch · Security desk
What happened
- Court documents say Odimegwu, 25, and Mogaji, 26, carried out the attacks while stationed at Dover Air Force Base in Delaware.
- They phished employee email credentials and paired them with spoofed addresses mimicking business partners to send payments to accomplices' accounts in the US and abroad.
- The Justice Department says they also diverted a more than $720,000 wire from an Ohio victim, among many other attempts on businesses in Iowa and nationwide.
- Odimegwu received 111 months and must pay $366,617.59 in restitution, while Mogaji received 78 months and must pay $995,680.45.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Confirming any change to payee bank details by phone, at a number on file before the request arrived, covers both routes the pair used, since neither a phished mailbox nor a lookalike address controls that call.
- constraint Conspirators drain receiving accounts through mules or onward transfers to outrun freeze orders, so a payer who spots the fraud after the wire leaves has little left to claw back.
- cost Ordered restitution of about $1.36 million is below the more than $2.4 million in the two named wires alone, and the payers carry the difference unless the money was recovered some other way.
The pair's two inputs get past different defenses. Protecting employee accounts addresses the phished credentials [3]. A spoofed address that mimics a business partner needs no access to anyone's account [4], so it gets around controls that only guard the mailbox. Both routes end at the step BleepingComputer describes as the core of BEC: a billing department approving new banking information [10]. The Justice Department's account, as reported, does not say how the Iowa City and Ohio victims came to send money to the conspiracy's accounts [6][7].
The largest diversion landed in a domestic account. "Working with co-conspirators both in the United States and abroad, Odimegwu and Mogaji fraudulently diverted a more than $1.68 million wire sent by a victim in Iowa City, Iowa, to a bank account in Chicago controlled by the conspiracy," the Department of Justice said in a Tuesday press release [6].
For scale, the FBI's 2025 Internet Crime Report logged 24,768 BEC complaints and more than $3 billion in losses [12]. That works out to about $121,000 per complaint [5]. The Iowa City wire alone was roughly 14 times that average [6].
The pair also ran card and account fraud alongside the wire diversions [5]. They made transactions without victims' knowledge using stolen account information, PINs and card numbers, plus data bought from co-conspirators [5].
Both men will serve three years of supervised release after prison [9]. In July, Derrick Van Yeboah was sentenced to 85 months [13]. Extradited in August 2025, the Ghanaian national pleaded guilty in March 2026 to being a high-ranking member of a ring that stole over $100 million through BEC and romance scams [13]. Odimegwu's term is 26 months longer than Van Yeboah's [7].
What to watch
- Filings or testimony showing whether the Iowa City and Ohio payers received bank-detail changes by email, and whether anyone called to confirm them.
- Charges against the co-conspirators in the US and abroad, including whoever controlled the Chicago receiving account.
- The FBI's next Internet Crime Report, set against 24,768 BEC complaints and more than $3 billion in losses for 2025.