Clement Onuama and Orefo Okeke were arrested on November 1, 2017 in the Western District of Texas after receiving a complaint and warrant from the District of Wisconsin, that the pair were involved in Romance Scams and Business Email Compromise Scams.
This week Okeke was sentenced to 45 months in prison. Onuama was sentenced on October 30th to 40 months in prison.
According to the Criminal Complaint and Indictments from the case, from 2010 until at least December 2016, in the Western District of Wisconsin and elsewhere Clement Onuama and Orefo Okeke knowingly conspired with each other and persons known and unknown to the grand jury, to commit and cause to be committed offenses against the United States, namely: wire fraud, in violation of Title 18, United States Code, Section 1343.
They used Romance fraud scams, developing relations via email, chat apps, and telephonic conversations. Eventually the person that posed as the victim's online partner requested each victim for financial assistance. They told the victims that they needed funds in order to release a much larger sum of money that was frozen by a foreign country.
They also used Business email compromise scams, primarily by sending email messages that altered wire instructions causing funds to be deposited into accounts controlled by the criminals. Often these emails were "spoofed" to appear to come from an employee or officer of their company. During several such scams, the real officer was traveling.
The deposited funds went into bank accounts of "nominees and shell entities" and were quickly converted to cash and cashier's checks, with a portion of the funds wired overseas. The criminals also failed to pay taxes on their proceeds.
$3,259,892 in transfers were attempted and the actual fraud losses were $2,678,328. The proceeds laundered by Onuama totalled $428,346. The proceeds laundered by Okeke totalled $538,100.
$123,747.54 was wired later that day.
On the same day, a wire transfer from Tammy Hausch's Wells Fargo bank account ending in 9492 sent $80,000 to a Wells Fargo bank account ending in 6411 held by Clement C. Onuama of Grand Prairie, Texas. Clement withdrew $10,000 in cash that day, $20,000 in cash the following day, and purchased a cashier's check for $28,885 from the account. On March 11, 2014, a check for $10,000 was sent from Okeke to Onuama, who cashed it.
An Affidavit from a Treasury Agent shares more details. Terrell Outlay was a new real estate agent who had recently relocated from Chicago. Outlay is believed to have had malware planted on his computer in relation to a home sale that he negotiated in January 2014.
After receiving the email from ssmith@title-pros.com, instructing the agent to have his client, Dynasty Holdings, wire $123,747.54 to the TJ Hasuch Wells Fargo account. He was contacted by the REAL Sarah Smith on February 25, 2014 to inform him the funds were never received into the BMO Harris Account which had been agreed to at closing. Outlay reported the situation to his boss, who contacted the Madison Police Department.
Although the email of February 19, 2014 seemed to be from ssmith@title-pros.com, the headers revealed it was sent from 162.144.88.87 and the actual email was ssmith.title-pros@outlook.com.
A second email, confirming to Mr. Outlay that the new account should be used: "Yes!! TJ Hausch Wells Fargo" -- used the email server located at web1.sh3lls.net with IP address 64.32.14.162 and the same outlook account, "ssmith.title-pros@outlook.com"
Four additional pieces of email correspondence used the same "sh3lls.net" IP and return address. Legitimate emails from Sarah Smith were sent from a Charter Communications IP address, confirmed by subpoena to belong to Portage County Title in Stevens Point, Wisconsin.
The sh3lls.net IP belongs to Sharktech in Chicago, Illinois, and that particular IP address was leased from August 13, 2013 to March 24, 2014 by a Singapore-based company called Surat IT Pte. Ltd. It was used to host hundreds of websites. The other IP address, 162.144.88.87, was confirmed to be a Unified Layer IP address operated by Bluehost. The customer of record at that time was Hind Jouini of Dubai, UAE.
The additional funds from the Tammy Hausch account were sent to a Bank of America account ending in 9593 held by P.M. Voss of Costa Mesa, California.
Tammy Hausch was interviewed by the US Secret Service in Madison, Wisconsin. She was unaware of the source of the $123,000. She had actually performed four similar transactions in the past, all at the bequest of her online boyfriend, Brian Ward, with whom she had communicated exclusively online. Brian needed her help because he and his friends had funds that were locked up in Spain and he needed additional funds to pay to have those funds released.
Hausch had previously received a $12,112 check from the IRS addressed to Brian and Patricia Downing. "Brian Ward" said that Patricia Downing was the maiden name of his deceased wife.
Brian Downing was interviewed and reported that when he attempted to file his 2013 taxes, he learned they had already been filed and that an unauthorized tax refund of $12,112 had already been paid to a Wells Fargo account ending in 9492. He confirmed his wife Patricia was not deceased and introduced her to the agent.
Katz true email was "nkatz@apexcap.org" but the email with the wire transfer instructions was from "nkatz@adexec.com" - similar enough that Hazelle did not notice the difference. The funds were sent to a Capital One Bank account ending in 8232.
That Capital One acount was opened by Clement C. Onuama d/b/a D&D Serv, Inc, of 2621 Skyway Drive, Grand Prairie, Texas. Onuama was the sole signatory of the account.
On July 26, 2016, Daniel Yet, the owner of D&T Foods of Santa Clara, California, relayed a similar experience. His personal investment account at TD Ameritrade was managed by Bao Vu. On June 29, 2015, while Yet was traveling overseas on vacation, Vu attempted to contact him to verify a wire transfer request sending $22,000 to a Regions Bank account ending in 6870 for Sysco Serve. Since Vu could not reach Yet, and the matter had been described as urgent, Vu went ahead with the wire. A SECOND request came through asking for an additional $30,000 to be sent.
The Regions Bank account ending in 6870 was opened by Orefo S. Okeke d/b/a Sysco Serve, with the same address as the Capital One account controlled by Onuama above, 2621 Skyway Drive, Grand Prairie, Texas!
The 6870 Regions account made a payment of $15,000 on July 1, 2015 (two days after the deposit from Mr. Yet's TD Ameritrade account) to another Regions Bank account ending in 6452.
The 6452 Regions account was opened by Clement C. Onuama d/b/a D&D Serv, of 2621 Skyway Drive, Grand Prairie, Texas.
The other letters explained how Orefo was kind enough to hire a convicted felon to work for him, and a disabled veteran. One letter, from his Aunty, says he is kind and loves animals. His wife begs the mercy of the courts and explains how much her children miss him. Okeke's brother in South Africa explains to the judge that his brother is an honest God-fearing man and that his pleading guilty demonstrates his honesty, and that this trial caused the death of their father and now their mother's health is also on the line. His uncle writes how sad it is that the judge has incarcerated his nephew for a non-violent first time offense causing him to miss his sister's wedding and his father's funeral. A friend explains Okeke's very good moral character and how he always operates with integrity.
On the other hand, the FBI says that Business Email Compromise has stolen $12 Billion dollars, and that just from June 2016 to May 2018 they have identified 30,787 victims, of which 19,335 of them were in the United States. Records from October 2013 to May 2013 actually show at least 119,675 victims! Hopefully the examples shared above will help us realize more about how these people come to be victims -- often losing their entire life savings, or funds that cause them to no longer be able to buy a house or continue the operation of a business!
This week Okeke was sentenced to 45 months in prison. Onuama was sentenced on October 30th to 40 months in prison.
 |
| Orefo Okeke (image from Dallas News) |
 |
| Clement Onuama, 53 |
According to the Criminal Complaint and Indictments from the case, from 2010 until at least December 2016, in the Western District of Wisconsin and elsewhere Clement Onuama and Orefo Okeke knowingly conspired with each other and persons known and unknown to the grand jury, to commit and cause to be committed offenses against the United States, namely: wire fraud, in violation of Title 18, United States Code, Section 1343.
They used Romance fraud scams, developing relations via email, chat apps, and telephonic conversations. Eventually the person that posed as the victim's online partner requested each victim for financial assistance. They told the victims that they needed funds in order to release a much larger sum of money that was frozen by a foreign country.
They also used Business email compromise scams, primarily by sending email messages that altered wire instructions causing funds to be deposited into accounts controlled by the criminals. Often these emails were "spoofed" to appear to come from an employee or officer of their company. During several such scams, the real officer was traveling.
The deposited funds went into bank accounts of "nominees and shell entities" and were quickly converted to cash and cashier's checks, with a portion of the funds wired overseas. The criminals also failed to pay taxes on their proceeds.
$3,259,892 in transfers were attempted and the actual fraud losses were $2,678,328. The proceeds laundered by Onuama totalled $428,346. The proceeds laundered by Okeke totalled $538,100.
Details of the Wisconsin BEC Fraud Scam
On or about February 19, 2014 at 10:02 am, an email puporting to be from Sarah Smith from the email ssmith@title-pros.com was sent in reply to real estate agent Terrell Outlay of Madison, Wisconsin asking him to update wire instructions that were sent a few days before. The email had an attachment from Portage County Title, on Portage County Title letterhead, updating the details and indicating funds should be sent to a Wells Fargo Bank account in Bettendor, Iowa in the name of TJ Hausch.$123,747.54 was wired later that day.
On the same day, a wire transfer from Tammy Hausch's Wells Fargo bank account ending in 9492 sent $80,000 to a Wells Fargo bank account ending in 6411 held by Clement C. Onuama of Grand Prairie, Texas. Clement withdrew $10,000 in cash that day, $20,000 in cash the following day, and purchased a cashier's check for $28,885 from the account. On March 11, 2014, a check for $10,000 was sent from Okeke to Onuama, who cashed it.
An Affidavit from a Treasury Agent shares more details. Terrell Outlay was a new real estate agent who had recently relocated from Chicago. Outlay is believed to have had malware planted on his computer in relation to a home sale that he negotiated in January 2014.
After receiving the email from ssmith@title-pros.com, instructing the agent to have his client, Dynasty Holdings, wire $123,747.54 to the TJ Hasuch Wells Fargo account. He was contacted by the REAL Sarah Smith on February 25, 2014 to inform him the funds were never received into the BMO Harris Account which had been agreed to at closing. Outlay reported the situation to his boss, who contacted the Madison Police Department.
Although the email of February 19, 2014 seemed to be from ssmith@title-pros.com, the headers revealed it was sent from 162.144.88.87 and the actual email was ssmith.title-pros@outlook.com.
A second email, confirming to Mr. Outlay that the new account should be used: "Yes!! TJ Hausch Wells Fargo" -- used the email server located at web1.sh3lls.net with IP address 64.32.14.162 and the same outlook account, "ssmith.title-pros@outlook.com"
Four additional pieces of email correspondence used the same "sh3lls.net" IP and return address. Legitimate emails from Sarah Smith were sent from a Charter Communications IP address, confirmed by subpoena to belong to Portage County Title in Stevens Point, Wisconsin.
The sh3lls.net IP belongs to Sharktech in Chicago, Illinois, and that particular IP address was leased from August 13, 2013 to March 24, 2014 by a Singapore-based company called Surat IT Pte. Ltd. It was used to host hundreds of websites. The other IP address, 162.144.88.87, was confirmed to be a Unified Layer IP address operated by Bluehost. The customer of record at that time was Hind Jouini of Dubai, UAE.
The additional funds from the Tammy Hausch account were sent to a Bank of America account ending in 9593 held by P.M. Voss of Costa Mesa, California.
Tammy Hausch was interviewed by the US Secret Service in Madison, Wisconsin. She was unaware of the source of the $123,000. She had actually performed four similar transactions in the past, all at the bequest of her online boyfriend, Brian Ward, with whom she had communicated exclusively online. Brian needed her help because he and his friends had funds that were locked up in Spain and he needed additional funds to pay to have those funds released.
Hausch had previously received a $12,112 check from the IRS addressed to Brian and Patricia Downing. "Brian Ward" said that Patricia Downing was the maiden name of his deceased wife.
Brian Downing was interviewed and reported that when he attempted to file his 2013 taxes, he learned they had already been filed and that an unauthorized tax refund of $12,112 had already been paid to a Wells Fargo account ending in 9492. He confirmed his wife Patricia was not deceased and introduced her to the agent.
More BEC Fraud Linked to the Case
On August 23, 2016, Anessa Hazelle, the financial controller of Ocean Grove Development of Basseterre, Saint Kitts, West Indies told the Treasury investigator that on November 30, 2015, an email claiming to be from her supervisor, Nuri Katz, urged her to wire $84,100 to D&D Serv, Inc of Grand Prairie, Texas, to pay an invoice for the purchase of "VxWorks Proll" for $84,100. Hazelle did as she was ordered, and sent the funds. Katz was on a flight to Russia at that time. After she landed, they had a telephone conversation and learned that this email had been fraudulent.Katz true email was "nkatz@apexcap.org" but the email with the wire transfer instructions was from "nkatz@adexec.com" - similar enough that Hazelle did not notice the difference. The funds were sent to a Capital One Bank account ending in 8232.
That Capital One acount was opened by Clement C. Onuama d/b/a D&D Serv, Inc, of 2621 Skyway Drive, Grand Prairie, Texas. Onuama was the sole signatory of the account.
On July 26, 2016, Daniel Yet, the owner of D&T Foods of Santa Clara, California, relayed a similar experience. His personal investment account at TD Ameritrade was managed by Bao Vu. On June 29, 2015, while Yet was traveling overseas on vacation, Vu attempted to contact him to verify a wire transfer request sending $22,000 to a Regions Bank account ending in 6870 for Sysco Serve. Since Vu could not reach Yet, and the matter had been described as urgent, Vu went ahead with the wire. A SECOND request came through asking for an additional $30,000 to be sent.
The Regions Bank account ending in 6870 was opened by Orefo S. Okeke d/b/a Sysco Serve, with the same address as the Capital One account controlled by Onuama above, 2621 Skyway Drive, Grand Prairie, Texas!
The 6870 Regions account made a payment of $15,000 on July 1, 2015 (two days after the deposit from Mr. Yet's TD Ameritrade account) to another Regions Bank account ending in 6452.
The 6452 Regions account was opened by Clement C. Onuama d/b/a D&D Serv, of 2621 Skyway Drive, Grand Prairie, Texas.
Letters from Okeke
The defense entered seven letters to be considered during the sentencing hearing. In the first, Orefo explains that when he first came to America, he made a business of buying used American cars and reselling them in Nigeria. He ended up in financial hardship, which he blames partly on medical bills for his sick father and partly on caring for his wife and two step children. He was approached by others in Nigeria who needed his assistance in converting US dollars to Nigerian Niara.The other letters explained how Orefo was kind enough to hire a convicted felon to work for him, and a disabled veteran. One letter, from his Aunty, says he is kind and loves animals. His wife begs the mercy of the courts and explains how much her children miss him. Okeke's brother in South Africa explains to the judge that his brother is an honest God-fearing man and that his pleading guilty demonstrates his honesty, and that this trial caused the death of their father and now their mother's health is also on the line. His uncle writes how sad it is that the judge has incarcerated his nephew for a non-violent first time offense causing him to miss his sister's wedding and his father's funeral. A friend explains Okeke's very good moral character and how he always operates with integrity.
On the other hand, the FBI says that Business Email Compromise has stolen $12 Billion dollars, and that just from June 2016 to May 2018 they have identified 30,787 victims, of which 19,335 of them were in the United States. Records from October 2013 to May 2013 actually show at least 119,675 victims! Hopefully the examples shared above will help us realize more about how these people come to be victims -- often losing their entire life savings, or funds that cause them to no longer be able to buy a house or continue the operation of a business!
