Former Air Force Members Sentenced for $2.4M Business Email Compromise Phishing Scam

The U.S. Attorney's Office for the Southern District of Iowa has published its own release on the sentencing, so the key facts come from the prosecutors and not only from press reports. One caution before going further: nothing in the public record points to a specific email platform, software vendor or vulnerability. This is a story about stolen passwords, impersonation and payment processes, not a software patch.

What the Two Men Did​

The Justice Department says the scheme ran for almost two years. According to prosecutors, the two men, both of whom were members of the United States Air Force at the time, attacked business victims across the United States with email "spamming" and phishing campaigns to steal usernames and passwords for victims' employee email accounts.

Once they had the passwords, they moved to impersonation. They and their co-conspirators then used these stolen credentials, along with "spoofed" email addresses mimicking emails associated with the victim or its business partners, to communicate with their victims and redirect payments to and from the victims' trusted business partners to accounts controlled by the defendants' co-conspirators.

That wording matters. The crew didn't only send messages from hacked mailboxes. They combined real, compromised accounts with lookalike addresses. Access to a real mailbox tells an attacker which invoices are due, who approves them and how the vendor normally writes. A lookalike address then lets them talk to the payer in a thread the real account owner never sees.

The fraud wasn't limited to redirected wires. BleepingComputer reports that the pair also made financial transactions without the victims' knowledge using stolen financial information (e.g., account information, personal identification numbers, and credit and debit card numbers) and additional data bought from their partners in crime. Western Iowa Today, reporting on the same case, adds that Odimegwu and Mogaji also exchanged stolen financial information and attempted to make unauthorized purchases using information taken from victims across the country.

Section summary:

• Phishing and spam were used to steal employee email passwords.
• Stolen accounts plus lookalike addresses were used to redirect business payments.
• Stolen card and bank data were used for separate unauthorized transactions.

The Money: Two Big Wires and Many Attempts​

The DOJ highlighted two successful diversions. Working with co-conspirators both in the United States and abroad, Odimegwu and Mogaji fraudulently diverted a more than $1.68 million wire sent by a victim in Iowa City, Iowa, to a bank account in Chicago controlled by the conspiracy. A second wire of more than $720,000 came from a victim in Ohio. According to the DOJ release as quoted by BleepingComputer, prosecutors said these were in addition to many other attempts to divert wire transfers from businesses in Iowa and across the country.

The DOJ doesn't name the Ohio victim. Reporting from April does line up closely, though. Engineering News-Record reported that in November 2024, the city of Athens, Ohio made a scheduled payment of $721,976 to Pepper for a new fire station. The trick, according to ENR, was simple: the hackers transposed the U and C in the word construction in a Pepper e-mail address and sent a link that rerouted the payment to themselves. At that point, ENR said, U.S. Attorney David Waterman had charged Odimegwu and Mogaji over cyber theft against more than one dozen victims, also noting that Athens could be added to the total if the fraud was found to be caused by them.

To be clear, the sentencing materials seen here do not confirm that Athens is the Ohio victim. The amount and timing match, but that's all. The Athens case is still useful because it shows what fast action can do. Because Athens filed a lawsuit just days after the erroneous payment was made, the funds were able to be frozen in the Republic Bank account the hackers were using and, after making its case in mediation, was able to retrieve the remainder of what was in the account at the time. ENR's headline puts the recovery at about half of the more than $700,000.

Section summary:

• Prosecutors cite a diverted Iowa City wire of more than $1.68 million and an Ohio wire of more than $720,000.
• A 2024 Athens, Ohio incident matches the Ohio amount, but the DOJ hasn't publicly linked the two.
• Moving quickly helped Athens get part of its money back.

The Sentences​

Odimegwu was sentenced to 111 months in prison and ordered to pay $366,617.59 in restitution, while Mogaji got 78 months and was ordered to pay $995,680.45 in restitution. After completing their federal prison terms, they will both have to serve a three-year term on supervised release.

KILJ Radio reports that both men were taken into custody following sentencing September 25. The case was investigated by the FBI with assistance from the Air Force Office of Special Investigations. Assistant U.S. Attorney Joseph Lubben prosecuted the case.

Some quick math. The two restitution orders add up to about $1.36 million, which is less than the $1.68 million Iowa City wire alone. Restitution isn't the same as total victim loss. It depends on what was recovered, how losses were assigned to each defendant, and how co-conspirators were handled. The public record doesn't break that down, so the gap shouldn't be read as proof of any particular recovery amount.

Nothing in the record suggests that Air Force systems or Dover's networks were involved. The men were service members while they ran the scheme. That doesn't mean they used military infrastructure to do it.

Why BEC Keeps Working​

BleepingComputer's description of the playbook is accurate: cybercriminals redirect legitimate corporate payments to attacker-controlled bank accounts by using victims' compromised email addresses to trick billing departments into approving new banking information. When they receive the payment, the attackers quickly drain the account using money mules or transfer the funds to various other accounts they control to evade court orders that mandate the funds be frozen.

The national numbers are large. The FBI's 2025 IC3 Annual Report recorded 24,768 BEC complaints in 2025, up from 21,442 in 2024 and 21,489 in 2023. Reported losses were about $3.05 billion in 2025, against roughly $2.77 billion in 2024 and $2.95 billion in 2023. These are complaints filed with the FBI's Internet Crime Complaint Center (IC3), not a full count of every incident. Many victims never report, so the real figures are probably higher.

This isn't a new pattern. In 2016 an FBI Salt Lake City agent described the same scheme: after compromising an account, criminals could send wire transfer instructions using the victim's e-mail or a spoofed e-mail account. Nearly ten years later, the Dover case follows the same outline. The scam lasts because it attacks how people trust each other at work, not a flaw in software.

What IT and Finance Teams Should Take From This​

The following is general industry practice, not anything the court or DOJ prescribed in this case. The main point: a request to change payment details is a business-process risk first. Email filtering helps, but it can't be the only control.

Verify outside the email thread

1. When a vendor asks to change bank details, call them back using a phone number already on file. Never use a number from the message asking for the change.
2. Require a second person to approve any change to bank details and any wire over a set threshold.
3. Put a short hold on the first payment to newly changed bank details, so the real vendor has time to notice.

Harden the mailbox layer

• Use strong multifactor authentication, and prefer phishing-resistant methods where your platform supports them. In this case, stolen passwords were the way in.
• Watch for mailbox rules that auto-forward or hide messages, and for sign-ins from unusual locations. Attackers use both to stay hidden.
• Look out for lookalike domains that swap or change characters, like the reported "constuction"-style swap in Athens. Train accounts payable staff to read the full sender address, not just the display name.

If money has already gone out

• Call your bank right away. The FBI's advice is that victims should call their financial institution immediately and report the crime to the FBI.
• File a report with IC3 as soon as you can. The FBI says its IC3 Recovery Asset Team has helped freeze more than $1 billion for cybercrime victims, and that reporting quickly improves the chances of getting money back.
• Talk to a lawyer about emergency court action. The Athens case suggests that acting within days, not weeks, can decide whether any money is left to recover.

Bottom Line​

The two men used phishing, stolen passwords and misspelled domain names. That was enough to move more than $2.4 million across two wires, and they tried for more. The prison terms are long, but for the victims the more important lesson is how often BEC attackers are ordinary scammers exploiting ordinary processes. The best protection is to check any bank change with a phone call before paying.