Two former members of the **United States Air Force** have been sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. According to court documents, 25-year-old **Chijioke Timothy Odimegwu** and 26-year-old **Harafat Mogaji** carried out these attacks while stationed at **Dover Air Force Base** in Delaware. ### Modus Operandi The defendants stole victims' employee email credentials through spamming and phishing campaigns. They then utilized "spoofed" email addresses, mimicking legitimate business partners, alongside the stolen credentials, to redirect payments to accounts controlled by their accomplices both domestically and internationally. Beyond email redirection, **Odimegwu** and **Mogaji** also executed unauthorized financial transactions using stolen financial information, including account details, personal identification numbers, and credit/debit card numbers. This data was sometimes supplemented with additional information acquired from their criminal partners. ### Significant Financial Diversions "Working with co-conspirators both in the United States and abroad, **Odimegwu** and **Mogaji** fraudulently diverted a more than $1.68 million wire sent by a victim in Iowa City, Iowa, to a bank account in Chicago controlled by the conspiracy," the **Department of Justice** stated in a Tuesday press release. They also diverted a wire exceeding $720,000 from a victim in Ohio to an account under their control. These incidents are among numerous attempts made by **Odimegwu** and **Mogaji** to divert wire transfers from businesses across the country. ### Sentences and Restitution **Odimegwu** was sentenced to 111 months in prison and ordered to pay $366,617.59 in restitution. **Mogaji** received a 78-month sentence and was ordered to pay $995,680.45 in restitution. Both will serve a three-year term of supervised release following their federal prison sentences. ### The Pervasive Threat of BEC Scams In BEC scams, cybercriminals manipulate legitimate corporate payment processes by using compromised email addresses to trick billing departments into approving new banking information. Once the payment is received, attackers rapidly drain the account using money mules or transfer funds to various other controlled accounts to evade freezing orders. BEC attacks can severely impact victims due to the massive financial losses they can inflict. The **FBI's 2025 Internet Crime Report** highlighted BEC as a major cyber threat, recording 24,768 complaints and over $3 billion in losses last year. Earlier this year, in July, Ghanaian national **Derrick Van Yeboah** was sentenced to 85 months in prison. **Yeboah**, extradited to the U.S. in August 2025, pleaded guilty in March 2026 to his role as a high-ranking member of a massive fraud ring that stole over $100 million from victims across the United States through BEC attacks and romance scams.