SecurityIndependently confirmed3 publishers2 min readPublished Updated
Two former Air Force members get 189 months for BEC scams that diverted business wires
Former airmen Chijioke Timothy Odimegwu and Harafat Mogaji got a combined 189 months in federal prison for BEC scams that diverted a $1.68 million wire. Their scheme worked wherever a payer accepted new bank details on the strength of an email.
The Watch · Security desk
What happened
- Court documents say Odimegwu, 25, and Mogaji, 26, carried out the attacks while stationed at Dover Air Force Base in Delaware.
- They phished employee email credentials and paired them with spoofed addresses mimicking business partners to send payments to accomplices' accounts in the US and abroad.
- The Justice Department says they also diverted a more than $720,000 wire from an Ohio victim, among many other attempts on businesses in Iowa and nationwide.
- Odimegwu received 111 months and must pay $366,617.59 in restitution, while Mogaji received 78 months and must pay $995,680.45.
Why it matters
- decision Confirming any change to payee bank details by phone, at a number on file before the request arrived, covers both routes the pair used, since neither a phished mailbox nor a lookalike address controls that call.
- constraint Conspirators drain receiving accounts through mules or onward transfers to outrun freeze orders, so a payer who spots the fraud after the wire leaves has little left to claw back.
- cost Ordered restitution of about $1.36 million is below the more than $2.4 million in the two named wires alone, and the payers carry the difference unless the money was recovered some other way.
The pair's two inputs get past different defenses. Protecting employee accounts addresses the phished credentials [3]. A spoofed address that mimics a business partner needs no access to anyone's account [5], so it gets around controls that only guard the mailbox. Both routes end at the step BleepingComputer describes as the core of BEC: a billing department approving new banking information [10]. The Justice Department's account, as reported, does not say how the Iowa City and Ohio victims came to send money to the conspiracy's accounts [8][9].
The largest diversion landed in a domestic account. "Working with co-conspirators both in the United States and abroad, Odimegwu and Mogaji fraudulently diverted a more than $1.68 million wire sent by a victim in Iowa City, Iowa, to a bank account in Chicago controlled by the conspiracy," the Department of Justice said in a Tuesday press release [8].
For scale, the FBI's 2025 Internet Crime Report logged 24,768 BEC complaints and more than $3 billion in losses [12]. That works out to about $121,000 per complaint [17]. The Iowa City wire alone was roughly 14 times that average [18].
The pair also ran card and account fraud alongside the wire diversions [7]. They made transactions without victims' knowledge using stolen account information, PINs and card numbers, plus data bought from co-conspirators [7].
Both men will serve three years of supervised release after prison [6]. In July, Derrick Van Yeboah was sentenced to 85 months [14]. Extradited in August 2025, the Ghanaian national pleaded guilty in March 2026 to being a high-ranking member of a ring that stole over $100 million through BEC and romance scams [14]. Odimegwu's term is 26 months longer than Van Yeboah's [19].
What to watch
- Filings or testimony showing whether the Iowa City and Ohio payers received bank-detail changes by email, and whether anyone called to confirm them.
- Charges against the co-conspirators in the US and abroad, including whoever controlled the Chicago receiving account.
- The FBI's next Internet Crime Report, set against 24,768 BEC complaints and more than $3 billion in losses for 2025.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption
- Insufficient
- Hype gap0
- Incentives30
- Confidence78
Perspective Coverage
4 publishers- Builder
- Builder 11%
- Operator
- Operator 68%
- Investor
- Investor 21%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Two former members of the US Air Force were sentenced to a combined 189 months in federal prison for roles in a multi-year series of business email compromise scams and phishing campaigns.
- [2]
According to court documents, Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, carried out the attacks while stationed at Dover Air Force Base in Delaware.
ReportedSupportedSource: Court documents, as reported by BleepingComputer4 sources— create a free account to open themView cited source - [3]
The defendants stole victims' employee email credentials in spamming and phishing campaigns.
- [4]
Odimegwu was sentenced to 111 months in prison and ordered to pay $366,617.59 in restitution; Mogaji got 78 months and was ordered to pay $995,680.45 in restitution.
- [5]
The defendants used spoofed email addresses that mimicked business partners' emails, along with the stolen credentials, to redirect payments to accounts controlled by accomplices in the United States and abroad.
- [6]
After completing their federal prison terms, both will serve a three-year term of supervised release.
- [7]
Odimegwu and Mogaji also made financial transactions without victims' knowledge using stolen financial information (account information, personal identification numbers, credit and debit card numbers) and additional data bought from partners in crime.
- [8]
"Working with co-conspirators both in the United States and abroad, Odimegwu and Mogaji fraudulently diverted a more than $1.68 million wire sent by a victim in Iowa City, Iowa, to a bank account in Chicago controlled by the conspiracy,"
ReportedSupportedSource: US Department of Justice, Tuesday press release4 sources— create a free account to open themView cited source - [9]
"They also diverted a more than $720,000 wire sent by a victim in Ohio to a bank account controlled by the conspiracy. These are in addition to many other attempts Odimegwu and Mogaji made to divert wire transfers made by businesses in Iowa and across the country."
ReportedSupportedSource: US Department of Justice, Tuesday press release4 sources— create a free account to open themView cited source - [10]
In BEC scams, cybercriminals redirect legitimate corporate payments to attacker-controlled bank accounts by using compromised email addresses to trick billing departments into approving new banking information.
ReportedSupportedSource: BleepingComputer2 sources— create a free account to open themView cited source - [11]
When BEC attackers receive a payment, they quickly drain the account using money mules or transfer funds to other accounts they control to evade court orders that mandate the funds be frozen.
ReportedSupportedSource: BleepingComputer2 sources— create a free account to open themView cited source - [12]
The FBI's 2025 Internet Crime Report logged 24,768 business email compromise complaints and over $3 billion in losses.
ReportedSupportedSource: FBI 2025 Internet Crime Report, via BleepingComputer2 sources— create a free account to open themView cited source - [13]
The two wires named by the DOJ total more than $2.4 million.
- [14]
In July, Ghanaian national Derrick Van Yeboah, extradited to the US in August 2025, was sentenced to 85 months in prison after pleading guilty in March 2026 to his role as a high-ranking member of a fraud ring that stole over $100 million from US victims through business email compromise attacks and romance scams.
- [15]
Combined restitution ordered for both defendants is $1,362,298.04.
- [16]
Ordered restitution of about $1.36 million is roughly 57% of, and below, the more than $2.4 million in the two named wires.
- [17]
The FBI's 2025 BEC figures average about $121,000 in losses per complaint.
- [18]
The Iowa City wire was roughly 14 times the average 2025 BEC loss per complaint.
- [19]
Odimegwu's 111-month term is 26 months longer than Van Yeboah's 85 months.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comFormer US Air Force members sent to prison over BEC attacks
1 article · September 29, 2026
- helpnetsecurity.comFormer US Air Force members behind million-dollar BEC scheme head to prison
1 article · September 30, 2026
- scworld.comTwo former Air Force members sentenced for BEC scams and phishing
1 article · September 29, 2026
- therecord.mediaUS Air Force members given over 6 years in prison for cyber theft of more than $2 million
1 article · September 29, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- Eugene KowelFollow
- U.S. Air ForceFollow
- FBI Internet Crime ReportFollow
- Dover Air Force BaseFollow
- U.S. Department of JusticeFollow
- Derrick Van YeboahFollow
- Chijioke Timothy OdimegwuFollow
- Harafat MogajiFollow
- Federal Bureau of InvestigationFollow
- Cameron John WageniusFollow