Cabarrus County $1.7M vendor-impersonation BEC (2019)

What happened

Beginning November 27, 2018, criminals posing as representatives of Branch and Associates, Inc., the general contractor building West Cabarrus High School, emailed Cabarrus County Schools and county government staff requesting a change to the vendor's banking details. County reporting said they supplied new banking information, seemingly valid documentation and signed approvals. The county transferred a scheduled $2,504,601 vendor payment to the fraudulent account in December, and investigators found that the funds were then diverted through multiple accounts. The fraud was discovered on January 8, 2019 when a genuine Branch and Associates representative contacted the county about a missed payment. The county notified SunTrust and Bank of America, and Bank of America froze $776,518.40 that remained in traceable accounts. Contemporaneous reporting described the resulting loss as $1,728,082.60 and said the Sheriff's Office and FBI were investigating.

How it worked

This was a vendor bank-account-change impersonation scheme. The attackers exploited a routine business process by posing as a real contractor and supplying new banking information, seemingly valid documentation and signed approvals. They then waited for the county's next vendor payment. The scheme was detected after the real vendor reported the missing payment.

The lure and the tell

Lure: an email from an expected contractor asking to update banking details, accompanied by seemingly valid documentation and signed approvals. Tells include any banking-detail change received by email and a large payment following a recent account change. An appropriate control is independent verification through a known vendor contact before changing payment details.

Outcome

Contemporaneous reporting placed the loss at $1,728,082.60 after Bank of America froze $776,518.40 of the $2,504,601 transfer. The recovered $776,518.40 was paid to Branch and Associates on March 20, 2019, and the county paid the remaining vendor balance on May 22, 2019 so construction continued. Insurance covered $75,000, and commissioners later approved a transfer from the Assigned Fund Balance to restore project funding. In 2019, the Sheriff's Office and FBI were investigating, and the county reported creating a new authentication process.

Why it matters

The case shows that seemingly valid documentation and signed approvals can accompany a vendor-impersonation request. Independent verification of banking changes through a known vendor contact provides a stronger control than relying on submitted documents alone.

Defenses

Require out-of-band verification through a known vendor contact before changing banking details. Treat banking-change requests as high risk even when they include seemingly valid documentation and signed approvals. Use separate authorization, a hold before the first payment to changed details, vendor-master change controls and rapid bank notification when fraud is detected.