For nearly two years, Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, both of whom were members of the United States Air Force at the time, attacked business victims across the United States with email “spamming” and phishing campaigns to steal usernames and passwords for victims’ employee email accounts, according to court records.
They and their co-conspirators then used these stolen credentials, along with “spoofed” email addresses mimicking emails associated with the victim or its business partners, to communicate with their victims and redirect payments to and from the victims’ trusted business partners to accounts controlled by the defendants’ co-conspirators, according to court records.
They also diverted a more than $720,000 wire sent by a victim in Ohio to a bank account controlled by the conspiracy.
These are just two attacks they conducted in addition to other attempts Odimegwu and Mogaji made to divert wire transfers made by businesses in Iowa and across the country.
Harvested Financial Info
As part of their spamming and phishing campaigns, Odimegwu and Mogaji also harvested financial information from victims, such as financial account numbers and information, personal identification numbers, and credit and debit card numbers, including credit card information for a victim non-profit located in Pella, Iowa.
They also purchased similar stolen information from their co-conspirators.
Furthermore, they would then use the stolen information to make and attempt financial transactions without their victims’ knowledge or authorization. They exchanged this information with one another and attempted to make purchases using that information stolen from other victims across the country.
Odimegwu received 9.25 years (111 months) in prison and ordered to pay restitution of $366,617.59.
Mogaji received 6.5 years (78 months) in prison and must pay $995,680.45 in restitution.
Both were taken into custody following sentencing. After completing their prison terms, Odimegwu and Mogaji will each serve a three-year term on supervised release.
“When cyber intrusion schemes target businesses and nonprofits in our communities, we will aggressively surge resources to protect the American people and their life savings,” said Eugene Kowel, Special Agent in Charge of the FBI Omaha Field Office. “Criminals from all backgrounds attack our digital systems. They strike targets from corporate networks to personal smart phones. No one and no device is immune from the threat.”