A North Dakota man is facing federal fraud charges after prosecutors say a nearly identical email address redirected $113,050 owed to an art dealer into his business bank account.
Nicolas Mondani Oleko, 32, from the Democratic Republic of the Congo, was arraigned August 10 on one count of wire fraud and one count of bank fraud. He had been living in North Dakota when the alleged scheme occurred.
The money came from an auction business in Asheville, North Carolina, that had sold furniture, silver and historical artifacts for an 80-year-old art dealer. After the sale, the company emailed the dealer a settlement statement showing what he was owed.
According to Valley News Live, someone then impersonated the dealer with an email address that replaced the letter “o” with the number “0” and sent new wire instructions directing the payment elsewhere.
The Payment Went Into Oleko’s Business Account
The auction company followed the changed instructions and wired $113,050 on December 21, 2023, believing it was paying the art dealer. Instead, the money went into a Wells Fargo account belonging to Mondani LLC, a company prosecutors say was owned by Oleko.
The federal indictment accuses Oleko of participating in and aiding and abetting the business email compromise scheme. The U.S. Attorney’s Office for the District of North Dakota says he participated in and aided and abetted a business email compromise that allegedly defrauded the auction business of $113,050.
The money did not remain in the Mondani LLC account for long. Bank records cited in the indictment show that $112,240.80 was withdrawn from the business account on the same day the $113,050 payment arrived. The same-day movements allegedly included transfers of $40,000, $15,000 and $10,000 into a personal checking account belonging to Oleko and his wife.
He Told the FBI He Had Not Expected the $113,000
FBI agents interviewed Oleko at his Fargo apartment in April 2024. According to the indictment, Oleko acknowledged that he owned Mondani LLC and said he had not expected a payment of approximately $113,000 to arrive in the company’s bank account.
He also allegedly told agents that he was experiencing financial problems and dealing with debt collectors. Prosecutors say Oleko told investigators he used the money to pay debts and did not believe he had done anything wrong.
Investigators Found Searches on His Phone From the Day the Money Arrived
The indictment also points to activity investigators say they found on Oleko’s phone. On December 21, the same day the auction company’s $113,050 payment landed in the Mondani LLC account, the phone was allegedly used to search for information about the auction company’s net worth.
Investigators say another search calculated “15% of 100k.” The following day, December 22, prosecutors say the phone was used to search for the auction company’s name. Another search allegedly asked what happens when a bank account is blocked. Prosecutors included those searches among the evidence underlying the charges.
A WhatsApp Message Said to Take 20% and Send the Rest
The indictment describes another piece of evidence from January 2024. A WhatsApp message sent to Oleko’s phone allegedly instructed him to “Take your 20% and send the rest.”
According to Valley News Live’s account of the indictment, the message was followed by an image showing the $113,050 deposit into the account. An audio message followed as well. Prosecutors characterized the audio as containing apparent threats if money was not paid.
Those communications suggest the government believes other people may have been involved in the broader operation, but the publicly released information does not identify who allegedly sent the messages or establish who created the spoofed email used against the auction business.
The Indictment Was Unsealed at His Arraignment
A federal grand jury returned the indictment against Oleko on June 3. It remained sealed until his August 10 appearance in federal court in North Dakota. Oleko was arraigned on one count of wire fraud and one count of bank fraud.
The U.S. Attorney’s Office said the FBI is investigating the case and Assistant U.S. Attorney Matthew Greenley is prosecuting it. Oleko was being held at the Stutsman County Corrections Center following his arraignment, according to Valley News Live.
He has been indicted, not convicted. The indictment is an accusation, and Oleko is presumed innocent unless and until prosecutors prove the charges beyond a reasonable doubt.
The Two Federal Charges Do Not Carry the Same Maximum Sentence
Valley News Live reported that each of Oleko’s charges carries a maximum sentence of 20 years, but the federal statutes provide different maximum penalties for the two offenses charged.
Under 18 U.S.C. § 1343, ordinary federal wire fraud carries a maximum prison sentence of 20 years, with a higher maximum in certain circumstances involving financial institutions or federally declared disasters.
Federal bank fraud under 18 U.S.C. § 1344 can carry up to 30 years in prison and a fine of up to $1 million. Any eventual sentence would depend on the offense of conviction, federal sentencing law, the applicable guidelines and the judge’s findings.
Verify New Wire Instructions Outside the Email Conversation
The FBI’s business email compromise guidance recommends independently confirming payment requests and scrutinizing email addresses carefully. Businesses should call the customer, vendor or recipient through a telephone number already on file.
A one-character difference should not be dismissed. The FBI warns that spoofing frequently involves changing only one letter, number or symbol in an email address or web address so that a fraudulent communication appears to come from a trusted source.
Large wires should also require a second employee’s approval when possible, particularly when an established customer suddenly supplies new account information. Businesses that discover a fraudulent transfer should immediately contact the sending financial institution and ask whether the wire or ACH payment can be frozen, recalled or traced. The incident should also be reported through the FBI’s Internet Crime Complaint Center at IC3.gov as quickly as possible.