Criminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How vendor email fraud works.
Social Engineering Examples·7 sources
In early 2026, Dickinson Public Schools in North Dakota lost about $4.92 million when criminals posing as a trusted vendor emailed new bank details and two scheduled payments went to their account. The money came from the district's Building Fund, set aside for construction including a high school expansion. Federal authorities traced and seized about $4.86 million from a Citibank account in April. Status: Documented incident, funds seized.
On 10 February 2026, the district said it had been hit by a "sophisticated email fraud scheme". Criminals pretended to be a district vendor and redirected two scheduled payments, totalling about $4.92 million, to their own account. The district said classroom budgets, day-to-day running and the construction project weren't affected, and there was no sign student or staff data was accessed. Dickinson Police said the case was beyond local capacity and brought in the FBI and the US Attorney's Office.
| Step | What happens |
|---|---|
| Pick a vendor | The criminals pose as a supplier the organisation already pays |
| Change the details | An email asks for future payments to go to a new bank account |
| Pay as normal | Staff send the expected payments, now to the criminals |
| Move fast | The money is moved on before anyone notices |
Officials described the playbook as "time and distance": hide behind email and push staff to act on a payment change without checking it. This is business email compromise in its most common form, invoice fraud.
Tip: any request to change a vendor's bank details gets a phone call to that vendor, on a number you already had. Not the one in the email.
| Date | Event |
|---|---|
| 10 February 2026 | District discloses the fraud |
| 30 April 2026 | US Attorney Nicholas W. Chase announces about $4,856,578.51 traced to a Citibank account and seized under a civil forfeiture warrant |
| 3 June 2026 | District says the funds are recovered but waiting for final processing and return, expected in 4 to 10 months |
The seized amount is about $60,000 short of the loss, and the April announcement didn't explain the gap. The criminals haven't been named. The district has since tightened its vendor payment checks.
See also how to prevent invoice fraud and how to verify a wire transfer.
About $4.92 million across two redirected vendor payments.
About $4.86 million was seized in April 2026. As of June it was recovered but still waiting to be returned.
The district said there was no evidence student or staff personal data was accessed.
Criminals pose as a supplier and ask for payments to go to a new bank account they control.
Social Engineering Examples. “Dickinson Public Schools loses $4.9M to a fake vendor email (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/dickinson-public-schools-vendor-bec-2026
Attackers in vendor-impersonation BEC typically identify a target organization's real, active vendors and the rhythm of its payment cycles first; for a public K-12 district, this kind of information (vendor names, contract values, project timelines like the high school expansion) is often obtainable from public board-meeting minutes, bid postings, and construction records that districts routinely publish, rather than requiring any technical breach.
Public disclosure of vendor names, contract values, and project timelines is a transparency norm (and often a legal requirement) for public school districts and cannot realistically be suppressed; the practical control sits downstream, at payment verification, rather than in hiding procurement information.
The district's own disclosure does not specify whether the attackers used a look-alike domain registered to resemble the real vendor's, a compromised vendor mailbox, or another spoofing method; either is common in this attack pattern and would let the fraudulent email arrive looking like it came from the trusted counterparty.
Email-authentication enforcement (SPF, DKIM, DMARC) and mailbox-compromise monitoring at both the district and its vendors reduce the odds that a spoofed or compromised sender reaches an inbox undetected; look-alike-domain monitoring adds a further layer against registered spoof domains.
Posing as the known vendor, the attackers emailed district finance staff asking that upcoming Building Fund payments be redirected to new banking details, framed to read as routine correspondence tied to invoices the district already expected to pay.
Treat any inbound request to change payee banking or wiring details as inherently high-risk, no matter how routine or well-timed it appears, and route it into a mandatory verification workflow before it can reach processing.
The fraudulent banking details entered the district's payment-approval process without an independent, out-of-band callback to a phone number already on file; because the vendor and payment were both familiar, the change was not independently challenged before funds moved.
Require callback verification through a phone number sourced independently of the request email, from an existing vendor file, not from the email signature, plus dual approval, before honoring any change to payee bank details; this is the single control prosecutors and the district both pointed to as the one that would have stopped the fraud.
Two scheduled Building Fund payments, totaling $4.92 million, were sent to the attacker-controlled account before the district detected the fraud.
Payment-anomaly monitoring that flags first-time payee-account changes on large disbursements, plus staged or capped release amounts for large wires, can catch the fraud between the first and second payment and limit the loss to a single transaction.
Per the U.S. Attorney's office, the stolen funds were traced to a Citibank account, consistent with the kind of intermediary or mule-account layering commonly used in BEC schemes to distance stolen funds from the original fraudulent wire before further movement.
Once funds clear into an intermediary account, the victim organization has little direct control; the highest-leverage action is speed, reporting the fraud to the originating and receiving banks and to the FBI's Internet Crime Complaint Center (IC3) within hours, which is what let investigators trace the Citibank account before the money moved further.
The district's fast reporting let the FBI and U.S. Attorney's Office trace and, months later, seize roughly $4.86 million of the $4.92 million via a civil forfeiture warrant. On June 3, the district said the funds had been successfully recovered but were awaiting final processing and return, expected within 4 to 10 months according to the FBI.
Recovery once funds reach law enforcement depends on asset-tracing and civil forfeiture proceedings the victim cannot accelerate; the realistic control is upstream, immediate IC3 and FBI notification (Stage 6) is what preserves a traceable path in the first place, since forfeiture and return of funds can still take months with no guaranteed timeline or full recovery.
Browse by what this case has in common with others in the library.
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Russian GRU officers spoofed Google security-alert emails with Bitly-masked links to phish 300+ individuals affiliated with the Clinton campaign, DCCC,…
Researchers from UIUC, the University of Michigan, and Google dropped 297 USB drives across the UIUC campus and found that…
Scammers impersonating a school construction contractor submitted a bank-account-change request with seemingly valid documentation, and Cabarrus County, NC wired $2.5M…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives, first through a recruited…
Between 2006 and 2008 the FTC pursued six civil cases covering 16 data-broker and private-investigation defendants after two dismissals, alleging…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
Chinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe, and dozens of other…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
Spoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas…
Scammers impersonating a school construction contractor submitted a bank-account-change request with seemingly valid documentation, and Cabarrus County, NC wired $2.5M…
A phishing attack resulted in disclosure of 2015 W-2 data for several thousand US employees, exposing SSNs and earnings to…
Attackers hijacked a staff email account and used fake solar-panel invoices to trick the US charity into wiring $997,400 to…
A convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a…
Impersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024.…
A European subsidiary of Toyota parts maker Toyota Boshoku transferred up to about 4 billion yen (~$37M) to criminals in…
Hours before Maharashtra's 2024 assembly election polling, BJP-amplified audio clips purporting to catch two opposition leaders discussing a bitcoin-funded election…
Social Engineering Examples