Million-dollar hacker who targeted US businesses from SA jailed in America, faces deportation

James Junior Aliyu was based in South Africa, from where he and some of his associates swindled American businesses and individuals out of millions of dollars through spoof emails.

Police were on to them, and in 2022, Aliyu was arrested in an upmarket estate in the Johannesburg suburb of Sandton.

Originally from Nigeria, he was subsequently extradited from South Africa to the US.

Now, the US Immigration and Customs Enforcement (ICE) has announced that Aliyu, 30, will serve seven-and-a-half years in jail there.

Deportation – millions of dollars involved

In a statement posted to social media on Saturday, 21 March 2026, ICE added that Aliyu “will be removed from the United States when he completes his sentence.”

It also announced that he faces a $1.2-million (more than R20-million) forfeiture order and a $2.4-million (around R41-million) restitution order, relating to losses his victims suffered.

The photograph that ICE posted of a sombre-faced Aliyu was a far cry from his Instagram profile picture that shows him lounging in a tracksuit top, cellphone in one hand and what looks like a champagne flute in the other.

This international saga stretches back several years.

Daily Maverick has managed to piece together some of the legal troubles that Aliyu has faced in both South Africa and the US, leading to his incarceration there.

In 2020, the South African Reserve Bank issued a notice saying it was forfeiting R231,290.36 from Aliyu to the state.

The notice did not say why.

In 2022, the South African Police Service announced that Aliyu had been detained at an upmarket estate in Sandton during a “takedown operation”.

He was “believed to be part of a cybercrime ring involved in phishing, internet scams and money laundering.”

A police statement at the time said: “The cybercrime suspect who has been conducting his criminal activities from South Africa is accused of swindling dozens of US citizens [of] millions in USD through email and text messages.”

‘Ghost’ alias and ‘mystery’ travels

A 2023 high court judgment in Gauteng, in which Aliyu’s bail was revoked, said he had also gone by the names “Old Soldier” and “Ghost”.

It said there was a formal request for his extradition to the US due to the cybercrime case, and that Aliyu, meanwhile, also faced legal issues in South Africa.

“He is a Nigerian citizen,” the judgment said.

“The State has charged him for various contravention[s] of the Immigration Act […] and various counts of fraud in relation to the opening of bank accounts. He has a valid defence and will plead not guilty.”

During the South African legal proceedings, Aliyu had claimed he had “no real ties” in Nigeria, but the high court in Gauteng found this to be “far-fetched”.

It added: “He does not explain his frequent travels, except when his father passed away. The reasons for his extensive travels remain a mystery.”

A 2025 statement from the US Attorney’s Office for the District of Maryland picks up where Aliyu’s legal proceedings left off in South Africa.

Unauthorised email access

He had by then been extradited to the US, and he pleaded guilty to conspiring to commit wire fraud and money laundering.

Aliyu was not the only one linked to this conspiracy – eight others also pleaded guilty, before he did, in separate yet connected cases.

Two other suspects had also lived in South Africa at the time the crimes were committed.

According to his plea agreement, Aliyu had worked with others to carry out a business email compromise scheme that ran from February to at least July 2017.

“Specifically, Aliyu and his co-conspirators, including co-conspirators residing in Maryland, gained unauthorised access to email accounts associated with individuals and businesses that they targeted,” the US Attorney’s Office statement from last year said.

“The co-conspirators sent false wiring instructions to the victims’ email accounts from ‘spoofed’ emails — accounts associated with forged sender addresses — to deceive the victims into sending money to bank accounts controlled by the scheme’s perpetrators, which are called ‘drop accounts.’ ”

Read more: Anatomy of a cybercrime ring — spoof emails, a suspect sent from Canada to the US, and a ‘ghost’ in SA

Daily Maverick reported in April 2023 that among those with whom Aliyu and his associates operated in the US were Nkeng Amin and Aldrin Fon Fomukong, who were based in Maryland.

According to the US Justice Department, both had previously pleaded guilty.

Trail to South Africa

A government memorandum relating to Fomukong had referred to South Africa, saying that several members of the conspiracy he was involved in were in this country.

As for Aliyu, he and his associates had also planned to launder money.

They wanted to disburse the funds they fraudulently obtained into the drop accounts and other accounts.

Their plan to disguise what they were doing, according to the US Attorney’s 2025 statement, included initiating account transfers and withdrawing cash.

Aliyu had been involved in dealing with millions of dollars.

The US Attorney’s 2025 statement summarised this as follows:

“As detailed in the plea agreement, the intended loss for transactions Aliyu was directly involved in was at least $4,162,211.65. The actual loss resulting from these transactions was at least $1,570,475.

“Aliyu directly controlled at least $1,194,565 of the funds they obtained from victims.” DM