Connect with us

Hi, what are you looking for?


Email Security

Scammers Grab $2.5 Million From North Carolina County in BEC Scam

Cybercriminals managed to divert $2.5 million in a business email compromise (BEC) scam targeting Cabarrus County, North Carolina. $1.7 million of that has not been recovered and remains missing.

Cybercriminals managed to divert $2.5 million in a business email compromise (BEC) scam targeting Cabarrus County, North Carolina. $1.7 million of that has not been recovered and remains missing.

The attack started at the end of November 2018, when employees of Cabarrus County Schools and Cabarrus County Government received emails pretending to be from Roanoke, Virginia-based Branch and Associates, Inc., the general contractor for construction of West Cabarrus High, a new school for the Cabarrus County Schools District.

Posing as representatives of Branch and Associates, the conspirators sent a series of emails to request the update of bank account information. The attackers provided new banking information, seemingly valid documentation and signed approvals.

Next, the conspirators simply waited for Cabarrus County to make the next vendor payment, which was of $2,504,601. As soon as the funds arrived in their account, the scammers started diverting them through multiple different accounts.

The scam was discovered on January 8, when Branch and Associates sent a courtesy notification of a missed payment. SunTrust, the bank from which the funds were transferred, and Bank of America, the bank to which funds were transferred, were notified. 

While $776,518.40 of the funds remained in traceable accounts and were recovered, $1,728,082.60 of the total remains missing.

Authorities were also notified on the scam, and the investigation into the incident continues. Cabarrus County says that construction of the new high school has not been impacted. 

Advertisement. Scroll to continue reading.

Both the number and sophistication of socially engineered BEC scams have increased over the past several years, reports published by the FBI’s Internet Crime Complaint Center (IC3) earlier in 2019 show. 

Losses associated with BEC scams in the U.S. reached $1.3 billion last year alone, and the number of received complaints also went up, the FBI revealed. Between October 2013 and May 2018, this type of fraud caused potential losses of more than $12 billion globally.

Earlier this year, Agari detailed a new type of BEC fraud, where scammers attempt to divert funds by adding fictional accounts to company payrolls. This allows attackers to siphon off smaller, but continuous, amounts of money.

The fight against BEC has intensified as well, with authorities worldwide joining forces to dismantle large networks of scammers

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Cloud Security

Microsoft and Proofpoint are warning organizations that use cloud services about a recent consent phishing attack that abused Microsoft’s ‘verified publisher’ status.

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...


A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...


Pig Butchering, also known as Sha Zhu Pan and CryptoRom, is an ugly name for an ugly scam.