Former Air Force Members Sentenced to 189 Months for BEC Attacks

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in business email compromise (BEC) scams and phishing campaigns, according to the U.S. Department of Justice.

Court documents say Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, carried out the attacks while stationed at Dover Air Force Base in Delaware. They stole employee email credentials through spam and phishing campaigns, then used spoofed addresses resembling business partners’ emails to redirect payments to accounts controlled by accomplices in the United States and abroad. The pair also made transactions using victims’ stolen financial information.

The Justice Department said the defendants diverted a wire transfer of more than $1.68 million from a victim in Iowa City, Iowa, and another of more than $720,000 from a victim in Ohio. It said these were among many attempts to redirect business wire transfers.

Odimegwu was sentenced to 111 months in prison and ordered to pay $366,617.59 in restitution. Mogaji received 78 months and was ordered to pay $995,680.45. Both must serve three years of supervised release after their prison terms.

In BEC scams, attackers use compromised email accounts to persuade businesses to send legitimate payments to attacker-controlled bank accounts. The FBI’s 2025 Internet Crime Report recorded 24,768 complaints and more than $3 billion in losses from BEC last year.