{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-cabarrus-county-nc-diverts-2-5-million-school-payment-to-bec-actors"},"incident":{"title":"Cabarrus County, NC diverts $2.5 million school payment to BEC actors","date":"2018-11","date_precision":"month","victim_org":"Cabarrus County, North Carolina","sector":"Government","country":"United States","primary_vector":"Vendor / Supply Chain Impersonation","secondary_vectors":["Business Email Compromise"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":2504601,"loss_note":"$2,504,601 paid to fraudsters; $776,518.40 recovered, leaving about $1.7 million unrecovered.","records_affected":null,"threat_actor":null,"summary":"Cabarrus County, North Carolina paid $2,504,601 to accounts controlled by criminals who impersonated Branch and Associates, Inc., the general contractor building West Cabarrus High School. The scammers emailed a request to update the contractor's banking information, supplying supporting documentation and signed approvals. The county discovered the fraud in January 2019. It recovered $776,518.40; roughly $1.7 million was never recovered.","how_it_worked":"The attackers targeted the vendor master-data process rather than a single invoice. Posing as the school construction contractor, they submitted a bank-account change request accompanied by forms and signatures that matched what the county's finance staff expected to see for a legitimate update. Once the fraudulent account details were accepted into the vendor record, the next scheduled construction draw, more than $2.5 million, flowed to the criminals automatically through the county's normal payment run, with no anomaly to catch. The money was then layered through multiple downstream accounts, and only a fraction was traced and clawed back after the county recognized the diversion weeks later.","lessons":"Vendor bank-detail changes should be treated as a privileged change: verified by outbound call to a number from the original contract, confirmed by a second staffer, and followed by a small test payment before the next large draw.","confidence":"Confirmed","sources":[{"title":"Scammers Grab $2.5 Million From North Carolina County in BEC Scam","url":"https://www.securityweek.com/scammers-grab-25-million-north-carolina-county-bec-scam/","publisher":"SecurityWeek"}],"entry_type":"incident","slug":"2018-cabarrus-county-nc-diverts-2-5-million-school-payment-to-bec-actors","year":2018,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-cabarrus-county-nc-diverts-2-5-million-school-payment-to-bec-actors"}}