What happened
In June 2021 the city of Cottage Grove, Minnesota, signed a contract of about $3.5 million with Geislinger & Sons, a sewer contractor based in Watkins, Minnesota, for its South District Sanitary Sewer Project. On 13 October the city set up a legitimate automatic payment to the company. Five days later, on 18 October, the city's accounting specialist received an email that appeared to come from the company's president, Jeff Geislinger.
By mid-December the city had made two wire transfers to the impostor, totalling $1,276,061.33. According to the federal court filing, they were sent on 26 November and 15 December 2021. On 22 December the real company's office manager asked about missing payments. She said Jeff Geislinger had been in Florida for weeks.
The email
The case is unusually well documented, because a federal forfeiture complaint quotes the emails. The sender was jgeislinger@geislingerandsonsinc.com. The real company used geislingerandsons.com. The fake domain added three letters, "inc", before the dot.
The first email asked about an invoice. A day later the impostor wrote that the company had made financial changes and moved all its banking to a new bank. The Pioneer Press reported that the email named PNC Bank and asked the city to update its vendor profile immediately, to ensure timely payment of invoices. An ACH form and a city electronic funds transfer form were attached. The impostor kept the conversation going for weeks, and before the larger payment supplied a second, different account at JPMorgan Chase.
Why it worked
Every part of the request was plausible. The sender used the president's real name. The domain began with the company's real name. The forms were the city's own. The timing followed a real payment. The tone was patient, polite and businesslike, and the request carried a reason: the company had changed banks.
The added letters are the kind of difference the eye skips. People read a familiar name as a whole word, and "geislingerandsonsinc" starts exactly like "geislingerandsons". Many companies also have "Inc" in their legal name, so the addition looks natural.
What it cost
The two wires totalled $1,276,061.33. In August 2022 a federal magistrate judge approved warrants to seize up to $852,337.55 in six bank accounts, the Pioneer Press reported. In March 2023 the United States filed a civil forfeiture complaint against funds in five accounts. No defendant is named in it.
What would have helped
The city already had the real contractor's contact details. A call to the office on the number in the contract file, before the first payment to new bank details, would have reached the office manager who knew Jeff Geislinger was in Florida. A rule that any change of payment details triggers that call, every time, removes the need to spot three letters in a domain.
What a warning inside the message would have shown. This is the pattern Antilure's sender checks look for: a domain that imitates one the reader already corresponds with, a first message from that new address, and wording that asks to change payment details. When it finds such signs, it draws a banner inside the message with the line: don't reply or pay, check with the sender another way. In this case the difference is on record: geislingerandsonsinc.com is not geislingerandsons.com.
Sources
- United States v. $75,466.10 and other funds, Verified Complaint for Forfeiture In Rem, case 0:23-cv-00520, US District Court for the District of Minnesota, filed 3 March 2023.
- Federal investigation underway into sham emails that led to city of Cottage Grove losing $1.2M, Nick Ferraro, Pioneer Press, 20 August 2022.
- City makes payments totaling $1,276,061.33 after fraudulent email received, Joseph Back, Cottage Grove Journal, 30 August 2022.