Social engineering is at the heart of this attack, where scammers successfully tricked a town into redirecting not just one but several bank transfers.
Last month, the town of Peterborough, New Hampshire put out a press release stating they were the victims of a Business Email Compromise (BEC) scam in July focused on tricking their finance department into changing banking details on payments intent on being made to the Contoocook Valley School District as well as a general contractor Beck and Bellucci.
Taking advantage of the “transparent nature of public sector work to identify the most valuable transactions and focus their actions on diverting those transfers”, the cybercriminals were able to redirect funds to scammer-controlled bank accounts without raising any red flags with the town of Peterborough. It wasn’t until the ConVal School District called inquiring about their missing $1.2M payment that the town was even aware of a problem.
As of the time of writing this article, the $2.3M overall that was stolen had not been recovered.
This simple story of how social engineering is sometimes all it takes to become a victim is a stark warning for organizations that anyone involved with financial transactions should be taught to be vigilant when interacting with emails. Through Security Awareness Training, stories like this could literally become a thing of the past – all it takes is a single user to recognize that something’s amiss and check the from email address, make a phone call to verify, something other than just unknowingly go along with the fraudulent request.
Are you aware that one of the
