Two former U.S. Air Force members who ran a business email compromise and phishing operation while stationed at Dover Air Force Base in Delaware have been sentenced to federal prison, The Record reported Tuesday. Chijioke Timothy Odimegwu, 25, received more than nine years and Harafat Mogaji, 26, received six and a half years.

What Happened

According to BleepingComputer, which cited the Justice Department, Odimegwu was sentenced to 111 months and Mogaji to 78 months in a case prosecuted in the Southern District of Iowa. Each will serve three years of supervised release after prison. The court ordered Odimegwu to pay $366,617 in restitution and Mogaji to pay $995,680.

Both men pleaded guilty in June to charges including wire fraud, identity theft and access device fraud, The Record said.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The scheme targeted at least 15 victim organizations over more than two years. The pair sent phishing emails to steal employees' email login credentials, then used that access, together with spoofed addresses that imitated business partners, to insert themselves into conversations about payments. Once inside, they redirected wire transfers to accounts controlled by them or by accomplices.

Two diversions account for most of the known losses. A payment of about $1.7 million intended for an Iowa City victim was sent instead to an account in Chicago, BleepingComputer reported, and $720,000 was diverted from a victim in Ohio. There were further attempted diversions in Iowa and elsewhere in the country.

The two also stole financial account numbers and credit and debit card data, which they used for purchases or sold to other criminals, and they traded stolen card data with each other. BleepingComputer said they worked with a network of domestic and international co-conspirators. The operation continued until the FBI and local police stepped in.

Why It Matters

Business email compromise does not require malware or technical exploits. It relies on a stolen password and a convincing message at the moment money is about to move, which is why it remains one of the most expensive categories of cybercrime reported to the FBI. This case follows that pattern closely: phished mailbox access, lookalike addresses and redirected wire payments.

The case also cuts against the assumption that BEC crews operate only from overseas. The defendants ran the fraud while stationed at a U.S. military base, working with accomplices both in the United States and abroad.

Context

The sentencing follows another recent case in which a former U.S. Army soldier was sentenced to more than five years in prison for hacking and extorting telecommunications companies, The Record noted.

What to Watch

Both men now begin their prison terms, followed by supervised release, and victims are owed the ordered restitution. For organizations, the practical lessons are familiar ones: require out-of-band verification for changes to payment instructions, enforce multifactor authentication on email accounts and watch for new mailbox forwarding rules or lookalike sender domains.