Cabarrus County loses $1.7 million after being targeted in BEC scam

• Scammers posed as a representative of the Roanoke Branch and Associate and targeted employees of the County's schools and government.
• The scam began in November 2018.

Cabarrus County in North Carolina has lost over $1.7 million in a BEC scam. The scammers pretended to be contractors for the County's new high school and had sent a phishing email in a pretext to obtain money.

How did it happen?

Cabarrus county officials have released details of the BEC scam that diverted nearly $2.5 million to scammers. Out of this, $1,728,082.60 remains missing.

Officials said that the County had intended to send the money to Roanoke, Virginia-based Branch and Associates Inc. Roanoke serves as a general contractor for the construction of West Cabarrus High school.

The investigation revealed that scammers posed as a representative of the Roanoke Branch and Associate and targeted employees of the County's schools and government through a series of phishing emails. The scam had begun in November 2018.

Sending phishing emails for payments

The phishing email that was sent under the name of Roanoke, stated that the bank account for the Branch and Associates had been changed and the County should use it for future invoice payments.

The email also included documents that looked legitimate. This tricked the County officials into believing that updated banking information was real and allowed the scammers to steal a sum of $2,504,601.

"Legitimate requests to update bank account information are routine. In this case, the request to change Branch and Associates' vendor banking information was made by conspirators. They provided County staff with new banking information, seemingly valid documentation and signed approvals. The conspirators then waited for the County to transfer the next vendor payment," said the County in its notification.

Once the amount was deposited into scammers' account, they were diverted to multiple different accounts.

Realizing the mistake

The County became aware of the scam after it received a notification of a missed payment from Branch and Associates on January 8, 2019. The county staff then confirmed that the electronic fund transfer cleared in December.

What has been done about it?

The County has notified SunTrust bank about the fraud transaction. On the other hand, Branch and Associates have also informed Bank of America about the fraudulent wire transfer of $2.5 million. Following this, Bank of America has frozen $776,518.40 of the $2,504,601.

The recovered amount of $776,518.40 was paid to Branch and Associates on March 20, 2019. The County paid the remaining balance on May 22, 2019.