Federal prosecutors announced prison terms and restitution orders after stolen business email credentials and impersonation helped redirect payments intended for trusted partners.
Federal prosecutors in Iowa announced September 29 that Chijioke Timothy Odimegwu and Harafat Mogaji had been sentenced September 25 to 111 and 78 months, respectively. Both were Air Force members during the conduct.
According to the Justice Department, stolen email credentials and impersonation helped divert wires exceeding $1.68 million from Iowa and $720,000 from Ohio. The FBI investigated with Air Force Office of Special Investigations assistance. Restitution orders were $366,617.59 for Odimegwu and $995,680.45 for Mogaji. The notice does not establish that restitution was paid or all funds recovered.
Layer8’s Cybersecurity offering supports a scoped review of identity controls and agreed remediation. For a business handling supplier payments, we would propose checking multifactor authentication coverage and restricting who can administer email accounts, with named owners and an agreed exception register. Acceptance would require evidence that approved access works and a revoked test account can no longer reach the agreed mailbox.
Payment changes also need a separately agreed business process: verify new bank details through an established contact route before releasing funds. We would propose a rehearsal in which an unverified change remains on hold, the supplier is contacted using existing records, and the approval is documented.
That payment check would remain the finance team’s responsibility and require explicit agreement; it is a proposed process, not an included financial service. Identity controls can reduce unauthorized access, but neither control set guarantees that every fraudulent request will be stopped.