US$1.7 Million Stolen From North Carolina County After BEC Scammers Posed as Contractor

The public sector, particularly smaller government institutions, is becoming a frequent target of cybercriminals as of late, and not just for ransomware attacks but also for business email compromise (BEC). This week, Cabarrus County, North Carolina, announced that it lost US$1.7 million to a BEC scam after a series of email exchanges that began in November 2018. US$2.5 million was initially deposited to the scammers’ bank account, but the county was able to recover US$770,000 weeks later after it sought help from its bank.

[Read: A city in Georgia lost over US$800,000 to a BEC scam]

On November 27, 2018, the Cabarrus County staff received an email requesting that the bank account for Branch and Associates Inc. — the general contractor for the building of Cabarrus County’s new high school —  be changed. Upon receiving legitimate-looking documents, which included a signed updated electronic funds transfer (EFT) form and signed bank documentation, the county staff changed the vendor’s banking information.

In time for the county’s scheduled payment to the vendor on December 21, 2018, US$2,504,601 was deposited to the account fraudulently set up by the scammers. Subsequently, the scammers diverted the funds to multiple accounts.

The county’s attempt to recover stolen funds

On January 8, 2019, the Cabarrus school district and county offices were contacted by Branch and Associates’ valid representative to inquire about their missed payment. On the same day, the county reached out to the Cabarrus County Sheriff’s Office, which then launched an investigation and notified the Federal Bureau of Investigation (FBI).

The county also notified its bank, SunTrust, and US$776,518.40 of the $2,504,601 that remained in the scammer’s traceable accounts was recovered. The county also received US$75,000 worth of insurance claim payment. Alongside the investigation, the county also underwent vendor data validation and redesign of its vendor registration and maintenance processes.

[Read: Organizations need to look out for these deceptive BEC schemes]

Security recommendations

According to a report by the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN), the amount BEC attackers attempted to steal reached an average of US$301 million per month since 2016. To stay one step ahead of BEC attackers, here are some best practices to follow:

• Employees should always verify fund transfer and account update requests.
• Emails should always be checked for any red flags. While many BEC attackers try to make their messages appear legitimate, there are many ways to tell if an email is impersonated.
• Organizations should encourage their staff to use two-factor authentication (2FA) to provide an additional layer of security.