iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Obinwanne Okeke, whom the FBI described as a Nigerian entrepreneur, was sentenced to 10 years in prison in February 2021 after pleading guilty to wire fraud tied to an $11 million business email compromise (BEC) scheme. The FBI says the operation began with a phishing email in 2018 and targeted the chief financial officer of a London construction equipment distributor.
What happened in the case
According to the FBI’s account published April 26, 2021, Okeke sent a phishing email to the distributor’s CFO in 2018. The message led to a deceptive login page that appeared legitimate but was controlled by Okeke. It captured the CFO’s username and password.
Using those credentials, Okeke accessed the CFO’s email account and sent requests for million-dollar wire transfers to company employees. The instructions directed funds to bank accounts in other countries and were often accompanied by fake invoices. The company ultimately lost $11 million, the FBI reported.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How the phishing attack enabled the theft
1. Credential capture
The fraudulent login page obtained the CFO’s account credentials. This gave the attacker an entry point into a mailbox used for high-value financial communications.
#1 Best Overall
2. Mailbox access and concealment
After gaining access, Okeke created email-filtering rules. Those rules intercepted messages that could have alerted the real CFO, including employee questions or concerns about the transfer requests. FBI Special Agent Marshall Ward explained that changing the password alone would not remove those rules: “If the CFO had changed his password, those filtering rules would still apply to the email. So his email traffic would still be intercepted.”
3. Fraudulent payment instructions
Messages sent from the compromised account appeared to authorize ordinary business payments. As Ward noted, “This was a large company working in million-dollar transactions regularly. The bank didn’t catch it because it seemed normal.”
Rank #2
Timeline
| Date | Event |
|---|---|
| 2018 | The FBI says Okeke sent the phishing email targeting the distributor’s CFO. |
| June 2020 | Okeke pleaded guilty to wire fraud. |
| February 2021 | He was sentenced to 10 years in prison. |
| April 26, 2021 | The FBI published its account of the case. |
What businesses can learn from the scheme
- Verify large transfers out of band: Use a known telephone number to confirm payment instructions rather than relying only on email. “My biggest piece of advice is to pick up the phone and verify any large transfer like that,” Ward said.
- Inspect mailbox rules after a compromise: Resetting a password is not enough if an attacker has added forwarding or filtering rules. Administrators should review and remove unauthorized rules and check related account activity.
- Treat unusual destination accounts and invoices as warning signs: International accounts, changed payment details and unexpected invoices should trigger an independent verification step.
- Protect financial workflows from a single mailbox: Require a separate approval channel for high-value payments, especially when instructions arrive by email.
What to do if a fraudulent transfer is suspected
- Contact the bank immediately and ask whether the transfer can be stopped or recalled. The FBI says quick contact can sometimes prevent completion, but recovery is not guaranteed.
- Secure the affected account, including changing credentials and removing unauthorized filtering or forwarding rules.
- Review sent, received and deleted messages, sign-in records and payment activity for additional fraudulent instructions.
- Report the incident to the FBI’s Internet Crime Complaint Center (IC3) and preserve relevant emails, headers, invoices and transaction records.
What the FBI account establishes
The FBI identifies the victim as a construction equipment distributor in London but does not name the company in the account summarized here. The reported $11 million loss and 10-year sentence are figures attributed to the FBI’s April 2021 case story. That account does not establish Okeke’s current custody or release status.
Recommended Free Tools
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
