What happened
Dickinson Public Schools in North Dakota was renovating Dickinson High School. Between November 2025 and February 2026 the district made two payments it believed were going to the construction company. Both went to an account controlled by someone else. The district noticed irregular activity and announced the loss on 10 February 2026. By its count, $4.92 million had left its Building Fund. It said no further fraudulent activity had been found.
The FBI recovered the money. In August 2026 an indictment charged a California man, Dexter Shondell Love Jr., with wire fraud, conspiracy to commit wire fraud and conspiracy to commit bank fraud. KFYR-TV reported the indictment on 23 October 2026. At that point his arrest warrant was still outstanding. The charges are allegations; he has not been convicted.
The email
According to the indictment, as KFYR reported it, the defendant set up an email account that posed as the construction company. From that address he asked the district to transfer payment for the company's services. The indictment lists two payments, totalling $4,856,578, to a Citibank account. The public record does not show the address itself or the wording of the messages.
The pattern is a common one. A sample of it, with made-up names, looks like this.
- From
- Billing, Prairie Ridge Builders <billing@prairieridge-builders.example>
- Subject
- Pay application 7, high school renovation
Good morning,
Attached is pay application 7. Please remit to the account on the attached form, as our bank details have changed. Let me know once the transfer is scheduled.
Why it worked
A school renovation produces large invoices on a schedule. A payment of millions to the main contractor is normal in such a year, so the amount raised no question. The request arrived during a real project, from an address that looked like the builder's. Staff who handle invoices see the vendor's name first. The address underneath is easy to skip, and a difference of a few characters is easy to miss.
News reports called it a sophisticated email scam. The method itself was simple. It needed public knowledge of the project, an address that resembled the builder's, and one request to pay somewhere new.
What it cost
The district put the loss at $4.92 million. The indictment, as reported, lists $4,856,578. The sources do not explain the difference. Because the FBI recovered the funds, the lasting cost is the investigation and the weeks of uncertainty for a public school budget.
What would have helped
The control that stops this fraud is old and cheap. Before the first payment to new bank details, someone calls the vendor on a number already on file, never one from the email. A second person approves the change. Payments to a builder on a public project are a known target, so the rule matters most there.
What a warning inside the message would have shown. Antilure looks at the sender's domain, at whether it imitates a domain the reader knows, at whether this is the first message from that sender, and at wording that asks to change payment details. When it finds such signs, it draws a banner inside the message with an action line: don't reply or pay, check with the sender another way.
Sources
- North Dakota school district loses nearly $5 million in sophisticated email scam, Valley News Live, 11 February 2026.
- California man accused in million-dollar email scam involving Dickinson schools, KFYR-TV, 23 October 2026.