Obinwanne Okeke, a 31 year old Nigerian businessman and founder of Invictus Group with businesses said to span various sectors, has been arrested by the FBI while he was visiting the country during August 2019 of charges of conspiracy to commit computer and wire fraud. Based on the affidavit by the Federal Bureau of Investigations (FBI), the arrest relates to how Okeke, during April 2018, was allegedly involved in defrauding Unatrac Holdings Limited off approximately $12 million using phishing and illegally accessing the victim company CFO's e-mail account.
In 2016, Okeke was featured by Forbes in their annual "Forbes Africa's 30 Under 30" list that puts a spotlight on Africa's most promising entrepreneurs.
"OBINWANNE OKEKE, born November 9, 1987, passport number A50254005, is a Nigerian citizen who has been issued a Visa for entry to the United States. He has recently been visiting the United States once or twice per year. As of the date of this application, OKEKE is currently in the United States, and is scheduled to depart the country on August 6, 2019. Therefore, a warrant for his arrest is immediately required to apprehend him and prevent his return to Nigeria, where he would be beyond the reach of U.S. law enforcement," reads part of the affidavit dated 2 August 2019 that led to the arrest of Okeke.
How the FBI caught Obinwanne Okeke
During April 2018, based on the affidavit issued by the FBI on 2 August 2019 requesting the arrest of Okeke, the young Nigerian entrepreneur apparently colluded with other unnamed individuals, whose names have been redacted from the affidavit, to access Unatrac Holding Limited's CFO's e-mail account fraudulently by using a phishing e-mail that claimed to have a link to the login page of Microsoft Office 365.
“Unatrac’s Chief Financial Officer received a phishing email containing a web link purportedly to the login page of the CFO’s online email account hosted by Microsoft Office365. When the CFO opened the link, it instead led him to a phishing website crafted to imitate the legitimate Office365 login page. Believing the page to be real, he entered his login credentials, which were captured by an unknown intruder who controlled the spoofed web page."
Following, the FBI goes on to detail how they monitored the CFO's e-mail account being accessed 464 times from 6 April 2018 to 20 April 2018. It was also picked up that the e-mail and Office 365 account was being accessed using TCP/IP addresses in Nigeria. After that, they traced and tracked the e-mail account used - firstname.lastname@example.org - to various domain names and telephone numbers linked to it.
Okeke and and his co-conspirators are alleged to have then used the CFO's e-mail account to issue invoices and instructions to various staff within Unatrac to make payments totalling approximately $11 million. For the week or so that this happened no one at Unatrac suspected anything as Okeke and company are said to have diverted e-mail responses from staff to the CFO using various "Inbox rules" so that the CFO could not be aware what was happening.
Also interesting is how they obtained records from Microsoft and Google that included session cookies that helped them link the various e-mail addresses with telephone numbers and other individuals who are yet to be named or arrested. According to the FBI's affidavits, there is at least one other Nigerian national who could possibly be involved in the fraud.
Arrested at the airport
Although the FBI had access to the GMail account and the linked telephone numbers, it wasn't until the FBI read some of the chats that they could link the e-mail address to Okeke.
Based on the chats, some people e-mailing the e-mail account referred to him as "Obi," "Chief Obi" and "Obiwanne" and "invictusobi". Using this knowledge, they were able to trace and link this to an Instagram account with the handle @invictusobi which apparently had similar photos posted as was contained in an e-mail sent from email@example.com to firstname.lastname@example.org.
"In order to help further confirm the true identity of the email@example.com account owner, I searched the email content in the firstname.lastname@example.org account for the term "invictusobi," and found two matching emails. One of the emails, dated March 1, 2016, sent from email@example.com to firstname.lastname@example.org, contained an attached picture of a white bathtub next to wooden doors with glass panes. I visited the "invictusobi" Instagram page, and found that on the same date, March 1, 2016, the user had posted the same bathtub picture to his Instagram site."
Following all this, an arrest warrant was filed for the arrest of Okeke and two others.
Okeke was arrested in Dulles, Virginia on 6 August 2019 as he was getting ready to leave the USA at the Washington Dulles International Airport.
Below is the full affidavit.
AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT AND ARREST WARRANTShare this via: