Scammers Nab $2.5 Million from North Carolina County through BEC Scam

Cabarrus County, North Carolina was recently targeted in a business email compromise (BEC) scam which resulted in the loss of $2.5 million. 

The attack began in late November 2018 when Cabarrus County employees received emails pretending to be from Roanoke, Virginia-based Branch and Associates, Inc, the contractor responsible for the construction of the new West Cabarrus High School. 

Acting as representatives of Branch and Associates, the attackers sent out a series of emails requesting the update of bank account information. The attackers provided the county with new banking details, with legitimate-looking documentation and signed approvals. 

The attackers waited for county employees to make the next vendor payment ($2,504,601), and as soon as the funds arrived in the new bank account, the attackers began diverting the funds to multiple different bank accounts. 

The scam was discovered on January 8, 2019, after Branch and Associates notified the county of a missed payment. SunTrust, the bank where the funds came from, and Bank of America, the bank where the funds were transferred, were both notified of the incident. 

$776,518.40 if the stolen funds were found in traceable accounts and recovered, but $1,728.082.60 still remains missing. 

Authorities have since been notified and the investigation into the incident is ongoing. 

Over the last couple of years, BEC scams have increased in both volume and value, with data from the Financial Crimes Enforcement Network (FinCEN) claiming cybercriminals make over $300 million per month from BEC scams on US victims alone. The best way to handle BEC scams is to recognize that checks and balances are necessary to stay safe from an attack. File Integrity Monitoring is seen by industry leaders as an essential security defense for that will ensure your environment is secure, hardened, and free of any vulnerabilities.