Dover AFB airmen BEC case: what the Iowa docket shows behind the 189-month sentences

Executive Summary

On 25 September 2026, a federal judge in the Southern District of Iowa sentenced Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, to 111 and 78 months in prison for a business email compromise (BEC) and card-fraud scheme the Department of Justice describes as an "international cyber intrusion scheme".¹² Both men were members of the United States Air Force at the time.¹ WBOC reports that the November 2025 indictment says they were stationed at Dover Air Force Base, Delaware, while the crimes were committed.³ The US Attorney's Office for the Southern District of Iowa announced the sentences on 29 September 2026. The case was investigated by the FBI with assistance from the Air Force Office of Special Investigations (AFOSI) and prosecuted by Assistant US Attorney Joseph Lubben.¹

According to the DOJ release, for nearly two years the two men ran email spamming and phishing campaigns to steal usernames and passwords for employees' email accounts. They and co-conspirators then used those credentials and "spoofed" addresses to redirect payments between victims and their trusted business partners into accounts the conspiracy controlled.¹ DOJ itemises two completed diversions: a wire of more than $1.68 million sent by a victim in Iowa City, Iowa, to a Chicago bank account, and a wire of more than $720,000 sent by a victim in Ohio.¹ The Ohio victim is the City of Athens, which lost $721,976 in November 2024 while paying what it thought were invoices from its fire-station contractor.⁴⁵ The men also harvested and bought stolen card and account data, traded it with each other, and attempted purchases with it, including against a nonprofit in Pella, Iowa.¹

The court record is more specific than the press release. Each man pleaded guilty, on 1 and 3 June 2026 respectively, to Counts 1, 3 and 4 of the indictment filed on 13 November 2025.²⁶⁷ For Odimegwu, the amended judgment identifies those counts as conspiracy to commit wire fraud, conspiracy to commit access device fraud, and aggravated identity theft; Count 2 was dismissed on the government's motion.² His $366,617.59 restitution obligation is joint and several with Mogaji, so the two restitution figures in the press release should not be added together as separate losses.² On 29 September 2026, the day DOJ announced the sentences, Odimegwu filed a notice of appeal to the Eighth Circuit.⁸ None of the coverage reviewed for this paper mentions the appeal.

Why it matters: the scheme was ordinary vendor-impersonation BEC. What makes it worth a paper is how far the coverage outran the record. Several outlets present "more than $2.4 million" as a DOJ figure. DOJ gave two wire amounts that add up to that, gross and before any recovery.¹⁹¹⁰ "At least 15 victim organisations" appears in no public DOJ document.¹¹ One analysis frames the case as an insider threat, but no source says the men used military systems, access or status against any victim.⁹ Nigerian outlets reported the men as Nigerian nationals; DOJ calls them "Delaware men" and states no nationality.¹¹⁰

Verification of Claims

1. Claim: Odimegwu and Mogaji were sentenced on 25 September 2026 to 111 and 78 months, a combined 189 months. → Verified → The DOJ release gives the date and both terms.¹ Odimegwu's amended judgment records an original judgment date of 25 September 2026 and a term of 111 months: 87 months on Counts 1 and 3, concurrent, plus 24 months on Count 4, consecutive.² Mogaji's docket shows Sentencing and Judgment entries on 25 September 2026.¹² The 29 September date sometimes attached to the sentencing is the date of the DOJ announcement and of the amended judgments, not of the sentencing hearing.¹²¹²

2. Claim: Both men pleaded guilty in June 2026 to wire fraud, identity theft and access device fraud. → Verified, with a precision correction → Magistrate Judge Helen C. Adams's reports record guilty pleas to Counts 1, 3 and 4 by Odimegwu on 1 June 2026 and by Mogaji on 3 June 2026.⁶⁷ For Odimegwu the convictions are conspiracy to commit wire fraud (18 U.S.C. §§ 1343, 1349), conspiracy to commit access device fraud (18 U.S.C. § 1029(a)(5), (b)(2)) and aggravated identity theft (18 U.S.C. § 1028A(a)(1)).² The wire fraud and access device counts are conspiracy counts, not substantive ones. Mogaji's judgment is not publicly available on RECAP, so his statutes are confirmed only as the same count numbers.⁷¹²

3. Claim: The two were active-duty airmen stationed at Dover Air Force Base. → Partially verified → DOJ says only that both "were members of the United States Air Force at the time".¹ WBOC reports that the indictment, which it obtained, says both were stationed at Dover Air Force Base while the crimes were committed.³ KCRG reports they were on active duty there until their arrest.¹³ The indictment itself is not on the public RECAP docket, so this rests on WBOC's account of it.¹⁴

4. Claim: The conspiracy attacked "at least 15 victim organizations". → Unverified against the primary record → The Record attributes the figure to prosecutors.¹¹ It is not in the DOJ release.¹ WOUB, describing the indictment in March 2026, says it accuses the men of fraud against "more than a dozen victims".⁴ The restitution payees are on a sealed victim list.² No accessible filing states 15, or says whether it counts organisations targeted, compromised, or defrauded.

5. Claim: The scheme diverted, or "defrauded victims of", more than $2.4 million. → Partially verified → $1.68 million plus $720,000 is about $2.4 million, and both figures are DOJ's.¹ DOJ never states a total, and both figures are gross amounts wired, before any recovery. Athens recovered $205,000 from the frozen receiving account and $200,000 from insurance.⁴⁵ Restitution, which tracks unrecovered loss to the victims on the sealed list, is $995,680.45 for Mogaji and $366,617.59 for Odimegwu, and Odimegwu's whole amount is joint and several with Mogaji.¹²

6. Claim: The airmen sold stolen account access to other hackers. → Unverified → The Record says the stolen data allowed them "to either steal from the accounts themselves or sell the account access to other hackers".¹¹ DOJ says they purchased stolen information from co-conspirators and exchanged it with one another. It says nothing about selling.¹ Help Net Security's account follows DOJ's wording here.¹⁵

7. Claim: This is an insider-threat case: the men exploited their military position. → Unverified → No source, including DOJ, WBOC's account of the indictment, or the judgment, says the men used Air Force networks, credentials, clearances or status against any victim.¹²³ The victims were outside organisations: an Iowa City payer, an Ohio city, and a Pella nonprofit.¹⁵

8. Claim: Co-conspirators were involved, in the US and abroad. → Verified as alleged; none named or charged in this case → DOJ says the men worked "with co-conspirators both in the United States and abroad", including the holders of the receiving accounts.¹ The case has two defendants only, 4:25-cr-00139-001 and -002, and no co-conspirator is named in any release or filing reviewed.²¹⁴¹² Whether anyone else has been charged elsewhere is unknown.

9. Claim: The defendants are Nigerian nationals. → Unverified → Sahara Reporters calls them "Two Nigerians resident in the United States".¹⁰ DOJ describes them as "Delaware men" and states no nationality or citizenship. No filing reviewed does either.¹²

Timeline

Attack Anatomy

This section reconstructs the charged mechanism from the DOJ release and from press accounts of the indictment. The indictment and the factual basis of the plea agreements are not public, so the details below come from those secondary accounts unless marked otherwise.¹¹⁴

Credential phishing

The men sent email "spamming" and phishing campaigns to businesses across the United States to steal the usernames and passwords of employees' email accounts (T1598).¹ No source describes the lures, phishing pages, kits or infrastructure used.

Mailbox access and payment monitoring

With the stolen credentials the conspiracy logged into victims' business email (T1586.002) and watched correspondence for upcoming payments (T1114.002).¹¹¹ In the Iowa City case, WBOC's reading of the indictment is that the conspirators compromised email accounts at an architecture firm working with an Iowa City nonprofit on a construction project, which puts the compromise on the vendor side.³ In the Athens case the fraudsters "had gained access to email communications between the city and Pepper and monitored conversations about an upcoming payment". WOUB does not say whose mailbox was compromised.⁴

Impersonation and payment redirection

The conspiracy then wrote to the paying party with "updated" wiring instructions, from spoofed addresses that mimicked the victim or its business partner (T1585.002, T1684.001).¹¹¹ In Athens the address "closely resembled a legitimate Pepper address".⁴ No source says whether the lookalike addresses sat on registered lookalike domains or on free webmail accounts. In Iowa City the victim wired more than $1.68 million to a Chicago account controlled by the conspiracy.¹³

Cash-out through conspiracy-controlled accounts

The diverted funds went to bank accounts held by co-conspirators in the US and abroad, not by the two airmen (T1657).¹ When Athens froze the receiving account, it found funds stolen from another fraud victim deposited in the same account. That suggests one mule account was serving several victims.⁴ Athens recovered $205,000 of the $349,522 left in it.⁴

Parallel track: card and account data fraud

The men also harvested account numbers, PINs and credit and debit card numbers from victims, bought more from co-conspirators, swapped the data with each other, and made or attempted unauthorised transactions with it (T1657).¹ WBOC says the indictment describes Mogaji sending Odimegwu the card details and card images of an Iowa organisation, which Odimegwu then allegedly tried to use for purchases.³ DOJ names a Pella, Iowa, nonprofit as one of these card victims.¹ This track corresponds to the access device fraud conspiracy (Count 3) and aggravated identity theft (Count 4).²

Accused

Chijioke Timothy Odimegwu, 25, of Delaware. United States v. Odimegwu, 4:25-cr-00139-001 (S.D. Iowa), before US District Judge Stephen H. Locher.¹² He pleaded guilty on 1 June 2026 to Counts 1, 3 and 4 of the 13 November 2025 indictment and was adjudicated guilty of:²⁶

• Count 1: conspiracy to commit wire fraud, 18 U.S.C. §§ 1343, 1349 (offence ended April 2025)²
• Count 3: conspiracy to commit access device fraud, 18 U.S.C. § 1029(a)(5), (b)(2), (c)(1)(A)(ii) (offence ended April 2025)²
• Count 4: aggravated identity theft, 18 U.S.C. §§ 1028A(a)(1) and 2 (offence ended August 2024)²

Count 2 was dismissed on the motion of the United States. Its charge is not stated in any public document reviewed.² Sentence: 111 months, being 87 months on Counts 1 and 3 concurrently plus 24 months on Count 4 consecutively. Supervised release is three years. Restitution is $366,617.59, joint and several with Mogaji, payable to a sealed victim list, plus a $300 special assessment.² The 24-month consecutive term on Count 4 is the mandatory penalty under § 1028A.¹⁶ He has appealed to the Eighth Circuit.⁸

Harafat Mogaji, 26, of Delaware. 4:25-cr-00139-002 (S.D. Iowa).¹⁷ He pleaded guilty on 3 June 2026 to Counts 1, 3 and 4 of the indictment.⁷ Sentence: 78 months, three years' supervised release, and $995,680.45 restitution.¹ His judgment and amended judgment (filed 29 September 2026) are not publicly available on RECAP, so the split of his sentence across counts, and the disposition of Count 2 in his case, are not confirmed here.¹² No notice of appeal by Mogaji appeared on the docket as last indexed on 29 September 2026.¹²

Procedural status: Both men are convicted on their guilty pleas and were taken into custody at sentencing.¹ Odimegwu's conviction and sentence are under appeal.⁸ Both were on pretrial release from December 2025 until sentencing.¹⁴¹² Their dockets show sealed pretrial-supervision violation reports, filed for Odimegwu in May and September 2026 and for Mogaji in September 2026; their contents are not public.¹⁴¹²

Co-conspirators: DOJ refers to co-conspirators in the United States and abroad. None is named, and no co-defendant appears in this case number.¹²

Attribution and naming basis: The two men are named because both are convicted. Their names, ages and Air Force service come from DOJ.¹ The Dover Air Force Base posting comes from WBOC's account of the indictment.³ No group name or tracked actor label has been attached to the conspiracy by DOJ or in any source reviewed.¹

Motivation: Financial.¹

Sophistication: Low to moderate. Commodity credential phishing and vendor impersonation, with no malware or exploit described in any source.¹

MITRE ATT&CK techniques (IDs checked live on attack.mitre.org, 2 October 2026; Enterprise matrix):

OPSEC: Receiving accounts were held by co-conspirators, not the defendants, and at least one was reused across victims.¹⁴ Beyond that, no source describes their operational security.

Technical Indicators

network_iocs: none disclosed
sender_addresses: none disclosed
file_hashes: none disclosed
malware: none described in any source
bank_accounts: none disclosed (DOJ names only "a bank account in Chicago" for the Iowa City wire)
mechanism:
  - "Email spam and phishing campaigns to harvest employee email usernames and passwords"
  - "Login to compromised victim or vendor mailboxes; monitoring of payment threads"
  - "Spoofed sender addresses mimicking the victim or its business partner, carrying updated wiring instructions"
  - "Payments redirected to accounts controlled by co-conspirators in the US and abroad"
  - "Harvested and purchased card and account data used for attempted purchases"
note: >
  This is a prosecution. DOJ and the public docket publish no technical indicators.
  The indictment, plea agreements, sentencing memoranda, presentence reports and the
  restitution victim list are either not on RECAP or sealed. Nothing above is an
  indicator for blocking; it is the charged method only.

Legal and Regulatory Response

Court and case. United States v. Odimegwu, No. 4:25-cr-00139-SHL-HCA, US District Court for the Southern District of Iowa (Central Division), before District Judge Stephen H. Locher. Plea hearings were before Magistrate Judge Helen C. Adams.²⁶⁷ The indictment was filed 13 November 2025.²

Prosecution and investigation. US Attorney David C. Waterman announced the sentences. AUSA Joseph Lubben prosecuted. The FBI investigated with assistance from the Air Force Office of Special Investigations.¹ The FBI's Iowa City office told Athens that evidence from its investigation linked the city's loss to the indictment.⁴ Athens's mayor credited Athens Police Department Lt. Adam Claar as lead investigator.⁵

Victims in court. Athens was not named as a victim in the indictment. It was told it could be added for restitution, and the court later recognised it as a victim and ordered restitution for its unrecovered loss and attorney's fees.⁴⁵ Athens's deputy service-safety director read a victim impact statement at the 25 September sentencing in Des Moines.⁵

Appeal. Odimegwu filed a notice of appeal to the US Court of Appeals for the Eighth Circuit on 29 September 2026, appealing the 25 September judgment. He is proceeding in forma pauperis with CJA counsel.⁸ The appeal received a case number on 1 October 2026.¹⁴ Whether his plea agreement contains an appeal waiver is not public.

DOJ announcements. The 29 September 2026 sentencing release is the only S.D. Iowa press release about this case. As of 2 October 2026, the office's press-release index from August 2025 onward contains no release on the November 2025 indictment or arrests, or on the June 2026 pleas.¹⁷ A justice.gov keyword search for the defendants' names returned no results on that date. It also did not return the sentencing release, so the search index cannot be relied on to confirm absence.¹¹⁷

Military. This paper found no public statement from Dover Air Force Base or AFOSI. Neither unit's news pages could be loaded for checking, so whether either has commented is unknown. Any military administrative action against the two men is also unknown.

Impact Assessment

• Confirmed: A wire of more than $1.68 million from a victim in Iowa City was diverted to a Chicago account controlled by the conspiracy.¹ Sources disagree on what the victim was: WBOC, citing the indictment, says a nonprofit; KCRG says a company.³¹³
• Confirmed: A wire of more than $720,000 from an Ohio victim was diverted. That victim is the City of Athens, which paid $721,976 in November 2024 for its Stimson Avenue fire station.¹⁴⁵
• Confirmed: Athens has recovered $205,000 from the frozen account and $200,000 from insurance, with court-ordered restitution for the remainder.⁴⁵
• Confirmed: Card and account data were harvested and used in attempted purchases, including against a Pella, Iowa, nonprofit.¹
• Confirmed: Restitution is $995,680.45 against Mogaji and $366,617.59 against Odimegwu. Odimegwu's whole amount is joint and several with Mogaji.¹²
• Reported, not independently confirmed: "At least 15 victim organizations", attributed by The Record to prosecutors.¹¹ "More than a dozen victims" in the indictment, per WOUB.⁴
• Reported: DOJ refers to "many other attempts" to divert wire transfers by businesses in Iowa and across the country, with no count.¹
• Estimated: About $2.4 million gross across the two itemised wires. This is ThreatPaper's arithmetic on DOJ's figures, before any recovery.¹
• Unknown: The total number of victims and what that number counts; total intended loss and total actual loss; the sentencing guidelines loss figure (the presentence reports are sealed); recovery by the Iowa City victim; the identity and fate of the co-conspirators; the exact start date of the scheme.¹⁴¹²

Lessons and Defensive Recommendations

For finance and accounts-payable teams:

• Both diversions DOJ itemises were construction or project payments to a known vendor, redirected by an email from a lookalike or compromised vendor address during an existing payment thread.¹³⁴ Any change to banking details should be confirmed by phone, using a number already on file and not one supplied in the email, before the first payment to new details.
• Speed mattered in Athens. The city sued within days, froze the receiving account, and got back part of the money that was still there.⁴ Know in advance how to reach your bank's fraud desk and the FBI quickly when a wire goes to the wrong account.

For SOC and email security teams:

• The scheme depended on stolen passwords for employee mailboxes.¹ Phishing-resistant MFA on email, plus alerts for logins from unfamiliar locations and for new forwarding or inbox rules, attacks the step everything else depends on.
• The compromise can sit at the vendor, as reported in Iowa City, so the paying organisation's own mailbox may never be touched.³ Flag inbound mail from domains a single character away from known suppliers, and new sender domains that appear inside existing supplier threads.

For leadership and public bodies:

• A municipality and nonprofits were among the victims.¹⁵ Athens adopted a state-recommended policy requiring multiple layers of authentication and signatures for electronic payments after the loss.⁵ Dual authorisation for vendor banking changes is a governance control, not an IT one.

For military and government security programmes:

• The record shows off-duty fraud by service members against outside victims, not misuse of military access.¹² Programmes that want to catch this belong under financial-crime and conduct monitoring, not technical insider-threat controls on government networks. The two problems should not be conflated.

For journalists and researchers:

• Check the docket before repeating a total. DOJ gave two wire amounts, not a $2.4 million figure. The restitution orders overlap, and the 25 September sentencing is not the 29 September announcement.¹²
• Victim counts attributed to "prosecutors" that appear in no release should say where they came from and what they count.¹¹¹

Sources