What happened
In September 2022 Boulder County in Colorado paid a vendor $237,241.18 by check. The money went into a fraudulent account. The county soon found out and announced the loss on 30 September. A digital forensics detective at the Boulder County Sheriff's Office traced the funds, with help from the US Secret Service, the fraud team at JPMorgan Chase and the police in Penn Township, Pennsylvania. On 7 December 2022 the full amount was returned. The sheriff's office described the recovery in February 2023. No arrests were announced.
The email
CBS Colorado reported how the request was framed. The fraudster emailed the county claiming to be a vendor whose information had been stolen in a cyberattack. That story explained, in advance, why the payment details had to change. It made the request look like a responsible company cleaning up after a breach.
The county's own account of its fixes hints at the address used. Its email tools now warn staff about messages from newly registered domains, and from domains one or two characters away from those of its partners.
Why it worked
The excuse is clever because it uses the fear of fraud to commit fraud. A vendor that says it was hacked sounds careful. It gives the reader a reason to accept new details and to distrust the old ones. Real companies do send such notices after breaches, which makes the fake harder to tell apart.
The payment was a check, not a wire. Many people think of checks as the safer, slower option. Payment fraud by email works with either, as long as the money ends up in an account the fraudster controls.
What it cost
The county recovered all $237,241.18, so the direct loss was zero. The cost was an investigation by several agencies, and more than two months of uncertainty before the money came back.
What would have helped
The county named its own fixes. It added an independent verification step for any change to a vendor's payment instructions. It also set its mail system to warn on newly registered domains and on near-miss domains. Both measures target the two weak points of this fraud: a request that is never checked outside email, and an address that looks almost right.
What a warning inside the message would have shown. Antilure works in the same direction, inside the message the reader has open. It flags a sender domain that imitates a known one, notes a first message from a new sender, and marks wording that asks to change payment details. Its banner then says: don't reply or pay, check with the sender another way.
Sources
- Almost $238,000 recovered after phishing scam targeting Boulder County, Boulder County Sheriff's Office, 14 February 2023.
- Boulder County recovers $238,000 it lost in scam, Logan Smith, CBS Colorado, 18 February 2023.