Air Force Pair Jailed Over $2.4M Email Scam
Two former United States Air Force members were sentenced to a combined 189 months in federal prison for a multi-year business email compromise and phishing operation run while they were stationed at Dover Air Force Base in Delaware.
Key facts
Who: Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26
Sentences: Odimegwu received 111 months and $366,617.59 in restitution; Mogaji received 78 months and $995,680.45. Both face three years of supervised release
The method: Phishing to steal employee email credentials, then spoofed addresses mimicking business partners to redirect payments
Known losses: A wire transfer of more than $1.68 million from an Iowa victim and more than $720,000 from an Ohio victim
Investigated by: The FBI, with assistance from the Air Force Office of Special Investigations
How did the scam work?
With no advanced hacking at all. The pair ran email spamming and phishing campaigns against business victims across the United States to steal usernames and passwords for employee email accounts.
Business email compromise, or BEC, is fraud in which criminals use a compromised or convincingly faked email account to trick a company's finance staff into sending money to the wrong place.
They then used spoofed email addresses — addresses designed to look like a legitimate business partner's — along with the stolen credentials to redirect payments to accounts controlled by accomplices in the U.S. and abroad. Prosecutors said they also made unauthorized transactions using stolen personal and financial information.
The mechanics are unglamorous: a phishing page, a lookalike domain, and a payment instruction that arrives at the right moment in an ongoing conversation.
How big a problem is BEC?
Larger than ransomware in pure dollar terms. The FBI's 2025 Internet Crime Report logged 24,768 BEC complaints and more than $3 billion in losses in a single year.
It stays effective because it exploits process rather than software. No malware needs to run. No vulnerability needs to exist. Someone in accounts payable receives what looks like a routine note from a known vendor saying the banking details have changed.
How do businesses actually stop it?
With a verification rule, not a technology purchase.
Require out-of-band confirmation for any change to payment details: if an email asks you to update a vendor's banking information, call that vendor on the number you already have on file — never a number in the email — and confirm verbally. Make this mandatory, not discretionary, so no employee has to decide whether a particular request feels suspicious.
Beyond that: enable multifactor authentication on all email accounts, which blocks the credential theft that starts most of these schemes; set your email system to flag messages from outside your organization; and give finance staff explicit permission to delay a payment while verifying, because urgency is the lever these scams pull.
Sources: BleepingComputer; SC Media; FBI 2025 Internet Crime Report.