Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns.

According to court documents, 25-year-old Chijioke Timothy Odimegwu and 26-year-old Harafat Mogaji carried out these attacks while stationed at Dover Air Force Base in Delaware.

They stole victims’ employee email credentials in spamming and phishing campaigns. The defendants then used “spoofed” email addresses that mimicked business partners’ emails, along with the credentials, to redirect payments to accounts controlled by accomplices in the United States and abroad.