New Hampshire town loses $2.3 million to overseas scammers

Image: George Kedenburg III

Peterborough, a small New Hampshire town, has lost $2.3 million after BEC scammers redirected several bank transfers using forged documents sent to the town’s Finance Department staff in multiple email exchanges.

BEC scammers use various tactics (including phishing and social engineering) to compromise or impersonate their targets’ business email accounts, allowing them to redirect pending or future payments to bank accounts they control.

Town officials discovered the attack on July 26 when the ConVal School District notified them that they didn’t receive a $1.2 million monthly transfer.

On August 18, while investigating this incident, Peterborough’s Finance Department staff discovered that two other bank transfers meant for a general contractor on the town’s Main Street Bridge project were diverted to attackers’ bank accounts.

Stolen funds hard or impossible to recover

“Investigations into these forged email exchanges showed that they originated overseas. These criminals were very sophisticated and took advantage of the transparent nature of public sector work to identify the most valuable transactions and focus their actions on diverting those transfers,” Select Board Chair Tyler Ward and Town Administrator Nicole MacStay said in a press release published on Monday.

Finance Department staff targeted in this BEC scam are now on leave until an ongoing US Secret Service Cyber Fraud Task Force investigation is concluded. However, it is not believed that they were involved in the attack.

“We are now waiting to hear from our coverage provider if these losses will be covered, whether in whole or in part; town administration is exploring all options available and has reached out to our legislative delegation and the Governor’s office for support,” the town staff added.

“We do not believe that the funds can be recovered by reversing the transactions, and we do not yet know if these losses will be covered by insurance.”

The FBI warned in June of scammers impersonating construction companies in ongoing business email compromise (BEC) attacks to defraud their private and public sector clients.

In March, the FBI warned of another series of BEC attacks targeting US state, local, tribal, and territorial (SLTT) government entities, with losses ranging from $10,000 up to $4 million.

In May, Microsoft also detected a large-scale BEC campaign that targeted more than 120 organizations using typo-squatted domains.

Almost $2 billion lost to BEC scammers last year

FBI’s 2020 annual report on cybercrime affecting US victims lists a record number of complaints and financial losses last year, amounting to more than $1.8 billion in adjusted losses in 2020.

“The FBI’s Internet Crime Complaint Center (IC3) notes BEC is an increasing and constantly evolving threat as criminal actors become more sophisticated and adapt to current events,” the FBI said.

“There was a 5 percent increase in adjusted losses from 2019 to 2020, with over $1.7 billion adjusted losses reported to IC3 in 2019 and over $1.8 billion adjusted losses reported in 2020.”

In previous alerts issued last year, the FBI warned of BEC scammers exploiting email auto-forwarding and cloud email services (including Microsoft Office 365 and Google G Suite) in their attacks.