2021 · New Hampshire, United States

Peterborough, New Hampshire loses $2.3 million to emails that copied its partners

In the summer of 2021 a town of about 7,000 people paid its school district and a bridge contractor into fraudsters' accounts after emails that imitated both.

Published · Sources checked · 2 min read

When
9 July to 13 August 2021
Who
Town of Peterborough
Where
New Hampshire, United States
Way in
Emails imitating the school district, a bridge contractor and an engineering firm
Tactics
Vendor impersonation, copied sender details, a misspelled lookalike name, changed bank details
Loss or impact
$2,347,310.12 paid out in three transfers. $594,331.53 recovered. Net loss $1,752,978.59

What happened

Peterborough is a town of about 7,000 people in New Hampshire. In the summer of 2021 it made three electronic payments that should have gone to two of its regular partners: the ConVal School District and Beck & Bellucci, the contractor on a bridge project. All three went to accounts controlled by fraudsters.

On 26 July ConVal told the town it had not received its payment. On 18 August the town learned that the bridge contractor's payments had gone astray as well. It stopped all electronic transfers and told the public on 23 August 2021. The money had been converted to cryptocurrency. The US Secret Service recovered part of it.

The email

The scheme started in the spring, months before the first payment. The emails looked like ordinary business correspondence. They copied the details of people the town dealt with regularly, from the school district and from the bridge project. They asked staff to change where the payments were routed.

The Monadnock Ledger-Transcript reported one tell. A fake message supposedly from the engineering firm Hoyle, Tanner & Associates spelled the name "Tanerr". The town administrator said the fraudsters had gone after the most valuable transfers.

Why it worked

The fraudsters studied the town before they asked for anything. They knew who it paid, how much, and roughly when. A change of bank details from a known partner, in a familiar format, looks like routine paperwork. A doubled letter in a company name is easy to read past, because the eye fills in the word it expects.

The town's employees were placed on leave during the investigation. CBS Boston reported that no staff member was criminally involved.

What it cost

The town's own figures, presented to the New Hampshire Municipal Association in November 2022:

  • 9 July 2021: $528,513.91 meant for Beck & Bellucci.
  • 23 July 2021: $1,233,558.59 meant for ConVal School District.
  • 13 August 2021: $585,237.62 meant for Beck & Bellucci.
  • 3 September 2021: $594,331.53 recovered.

That leaves a net loss of $1,752,978.59, or roughly $250 for each of the town's residents.

What would have helped

The town's own lessons-learned presentation is a good guide. The core rule is simple. Any request to change where a payment goes is confirmed by phone with the payee, on a number already on file. A second person approves it. The first missing payment, reported on 26 July, is also a signal to freeze similar changes until every one has been checked.

What a warning inside the message would have shown. Antilure marks wording that asks to change payment details and flags a sender whose name or domain imitates someone the reader knows, such as a company name with a doubled letter. Its banner then says: don't reply or pay, check with the sender another way.

Sources

  1. Peterborough, NH Loses $2.3 Million In Email Scam, CBS Boston, 24 August 2021.
  2. $2.3M Peterborough scam started months earlier, Rick Green, Monadnock Ledger-Transcript (via the Concord Monitor), 9 September 2021.
  3. Peterborough: Lessons Learned From a Business Email Compromise, Town of Peterborough, NH Municipal Association Annual Conference, 16 November 2022.