A respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11 transfers and collapsed the bank. Why dual control didn't save it.
Social Engineering Examples·20 sources
Shan Hanes ran Heartland Tri-State Bank in Elkhart, Kansas. He had chaired the Kansas Bankers Association, sat on the American Bankers Association board and testified before Congress. In December 2022 a stranger messaged him on WhatsApp. By July 2023 he had wired $47,105,000 of the bank's money, in 11 transfers, to a crypto exchange and on to scammers he never met, chasing an investment dashboard that showed $40 million in fake gains. Before touching bank funds he'd taken $40,000 from his church, $10,000 from a local investment club and $60,000 from his daughter's college fund. The bank failed on 28 July 2023, one of five US bank failures that year. Hanes pleaded guilty to embezzlement and got 293 months. Status: the CEO is in prison, the scammers were never found, and the bank is gone.
| When | What happened |
|---|---|
| December 2022 | A WhatsApp contact builds rapport and introduces a crypto investment. A scammer-controlled dashboard shows the balance climbing |
| Early 2023 | Hanes' own money runs out. He takes from his church, an investment club and his daughter's college fund to keep paying "fees" to unlock the gains |
| 17 May 2023 | First bank wire, a $5,000 test. Ten more follow over seven weeks, including two of $10 million or more, funded by a correspondent-bank credit line and Federal Home Loan Bank advances |
| 5 July 2023 | Hanes asks a local businessman for a personal $12 million "loan", showing a phone displaying $40 to $42 million. The man tells him it's a scam. That day Hanes routes $8 million through an investor's account to the exchange |
| 7 July 2023 | Final wire, $4.4 million |
| 21 July 2023 | The CFO alerts the Federal Reserve Bank of Kansas City. The bank is drained |
| 28 July 2023 | Kansas regulators close the bank. Dream First Bank takes on all deposits |
The pattern is textbook pig butchering: a relationship first, an investment second, then an endless loop of payments to "unfreeze", "verify" or "activate" money that never existed. Prosecutors used the term in their own filing. They never found out who was on the other end: "the true identity of the co-conspirator, or conspirators, remain unknown."
Tip: if getting your money out requires sending more money in, there is no money. That one rule beats every dashboard.
Every wire had two approvers, as the bank's policy required. The Federal Reserve's Inspector General found the problem elsewhere. Heartland had a $5 million per-sender daily limit. Three of the first seven wires blew through it by $1.7 million to $5.3 million. On 24 June the board cut the limit to $3 million. All three wires after that exceeded it too.
The CFO doubled as the bank's compliance officer and approved wires alongside colleagues. The bank's own rules called for a suspicious activity report on insider abuse of any amount. The first one was filed on 24 July, after the last wire had cleared.
Here's the lesson that usually gets missed. A second signature from someone who reports to the fraudster is not a check on the fraudster. What was missing was escalation that leaves the building: hard wire limits, and a rule that anything over a threshold, or any exception, goes to the board.
| Party | Outcome |
|---|---|
| Bank funds wired | $47,105,000 across 11 wires, 17 May to 7 July 2023 |
| FDIC Deposit Insurance Fund | Estimated cost of the failure $54.2 million (the DOJ's "$47.1 million absorbed" is the embezzled sum, a different measure) |
| Depositors | Nothing lost |
| Holding-company shareholders | About $9 million in equity. The FBI seized just over $8 million from a Tether Ltd. account; a judge awarded all of it to shareholders on 4 November 2024, ranking the FDIC behind individual victims. Paid out August 2025 |
| Church, investment club, daughter | $40,000, $10,000 and $60,000 respectively, taken before the bank wires |
| Hanes personally | Around $1.1 million of his own savings. Then 293 months in federal prison, and he can never work in banking again |
The federal case moved quickly. Charged by Information on 2 February 2024. Guilty plea on 23 May to a single count of embezzlement by a bank officer. Sentenced 19 August. When the Federal Reserve banned him from banking on 21 November 2024, the order noted he'd agreed to restitution of up to roughly $60.5 million. There was also a 29-count state case in Morton County, reported as heading to trial in 2025; the sources used here don't say how it ended. The FDIC, as receiver, later settled two civil claims: $1,125,000 from a former bank officer who denied liability, and $1,845,000 from the bank's bond insurer.
See also pig butchering, the DOJ $225M USDT forfeiture and the NanoBit WhatsApp case.
Its CEO, Shan Hanes, got pulled into a crypto pig-butchering scam that started on WhatsApp. Between May and July 2023 he wired $47.1 million of the bank's money to the scammers. Regulators shut the bank on 28 July 2023.
No. Dream First Bank assumed all deposits. The FDIC estimated the failure cost its insurance fund $54.2 million.
293 months, about 24 years, after pleading guilty to embezzlement by a bank officer. He is permanently barred from banking.
No. Prosecutors said their identity remains unknown. The FBI did recover just over $8 million from a Tether account, which went to the bank's shareholders.
Social Engineering Examples. “Heartland Tri-State Bank: a CEO's pig-butchering scam wires $47.1M and sinks the bank (2023)”. Accessed 3 November 2026. https://socialengineeringexamples.com/heartland-tri-state-bank-ceo-pig-butchering-2023
Pig-butchering operators are documented (per FinCEN's 2023 pig-butchering advisory and the U.S. sentencing memorandum) as typically initiating contact with targets over personal messaging apps like WhatsApp, often via a seemingly misdirected text or organic-looking introduction; the specific reason Hanes was targeted is not documented, consistent with a wide-net cold-contact approach where scammers invest relationship-building time only in whoever engages.
Unsolicited contact from strangers on personal messaging apps is very hard to block at a network level; the realistic control is individual and organizational awareness that treats any unsolicited investment pitch arriving through a personal contact, however friendly, as a signal to report rather than pursue privately.
Over weeks, the unidentified contact built a personal rapport with the CEO through sustained WhatsApp conversation before introducing any investment opportunity, the grooming phase that gives pig-butchering its name and is documented across FinCEN's and prosecutors' case descriptions as central to the scheme's success.
The multi-week trust-building phase happens on personal channels outside employer visibility and is hard to interrupt technically; the nearest practical control is public and employee awareness campaigns, like FinCEN's pig-butchering alert, that teach people to recognize the grooming pattern itself as a threat signal, independent of any specific pitch.
The scammer introduced a cryptocurrency investment opportunity backed by a scammer-controlled trading app/dashboard, a category of tool documented in pig-butchering cases generally as displaying fabricated, rapidly growing account balances to manufacture social proof of profit.
Any funds moving on the strength of a self-hosted or third-party trading app the victim cannot independently verify should trigger a hard rule to confirm the platform's legitimacy and counterparty identity through an independent channel, ideally a neutral third party such as a financial advisor or fraud hotline, before further funds move.
Per the sentencing memorandum's description of the pattern, each further "investment" was followed by a demand for additional funds framed as necessary to secure, unfreeze, or activate the growing (fake) balance, a cycle designed to prevent the victim from ever cashing out and to escalate financial commitment.
Treat any "send more to unlock, verify, or activate funds already invested" request as a definitive fraud indicator per FinCEN guidance, since no legitimate investment platform requires additional payment to release a client's own existing balance.
Hanes progressed from his own money to embezzling from his church and a local investment club, each additional ask pushing him further past the point of admitting a loss.
Sunk-cost escalation is a psychological trap rather than a technical one, so the most effective realistic control is a mandatory external circuit-breaker, referral to a bank fraud team, law enforcement, or a trusted third party before further large transfers tied to a personal investment story, rather than relying on the victim's own judgment.
Using his authority and reputation as CEO, Hanes directed bank employees to execute the wire transfers and lied to them about the purpose. The control that failed was not dual signature. The Federal Reserve OIG is explicit that "Heartland employees followed the dual control requirements of the bank's wire policy," and that what they did not follow were the daily wire limits: three of the seven wires processed before 2023-06-24 exceeded the $5 million per-sender limit, and all three processed after the board tightened the limit to $3 million exceeded that. Two employees signed, as policy required, and both reported to the man committing the fraud. Staff also filed no SAR until the week of the failure, despite a policy requiring one for insider abuse of any amount.
This is the strongest realistic point of failure to fix, and the fix is not the one people assume. Dual control was in place and was satisfied, and it stopped nothing, because both signers reported to the person committing the fraud. What was missing is escalation that leaves the chain of command: a tiered wire policy routing anything above a threshold to the board, and a hard rule that an exception to a wire limit is itself a board matter. Both are what the Fed OIG's interviewees identified, and the OIG notes that neither the Commercial Bank Examination Manual nor the FFIEC Retail Payment Systems Booklet gives specific guidance on tiered wire approvals. Pair it with mandatory SAR filing on insider-linked and cryptocurrency-destined transfers, which policy already required here and which nobody did until the week the bank failed.
On 2023-07-05 Hanes asked a local businessman and bank customer for a personal $12 million loan, showed him a phone screen displaying a fabricated balance of $40 million to $42 million, and was told flatly that he was in a scam and should walk away. Hanes disregarded the warning and had the bank wire another $8 million that same day, illustrating how sunk-cost commitment can override even a credible real-time warning from a trusted peer.
Give employees, board members, and outside parties a channel to report credible fraud concerns about even the most senior executive directly to the board or a regulator, bypassing the chain of command that executive controls, so a bystander's warning can trigger an institutional response instead of being personally overridden. Here the warning worked only weeks later and only by informal route: the customer who was told nothing eventually spoke to a board member, and the CFO went to the Federal Reserve Bank of Kansas City on 2023-07-21.
Each wire named a cryptocurrency exchange as beneficiary and settled first into a wallet held in Hanes's own name; he then moved the funds on to wallets controlled by the scammers, which is the step that makes this embezzlement rather than a bank defrauded directly. The scammers dispersed the funds before Hanes ever attempted a withdrawal; cryptocurrency's cross-border liquidity is the mechanism FinCEN identifies as pig-butchering's typical final extraction and laundering step.
Once funds reach cryptocurrency exchanges and are moved by the scammer, recovery depends on rapid law-enforcement tracing, as the FBI achieved here by following the funds to an offshore account and seizing just over $8 million; the realistic control is fast detection and reporting at Stage 6 to shrink the window before funds are laundered beyond reach, since after-the-fact recovery is the exception, not the rule. Roughly 83 percent of the money was never recovered.
Browse by what this case has in common with others in the library.
A US Attorney's Office (EDVA) court order seized seven domains spoofing the Singapore International Monetary Exchange that pig-butchering scammers used…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
North Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed…
A deepfaked Martin Lewis Facebook ad led to a fake adviser, a Revolut account, £5,000 of savings and £70,000 in…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
DOJ's first-of-its-kind nationwide takedown charged 61 individuals and entities, including five Ahmedabad, India call-center conglomerates, for an alleged 2012-2016 IRS/USCIS…
Greenpeace alleged in a civil suit, dismissed in both forums without any finding on the merits, that Dow Chemical and…
A fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
The FTC warned in 2023 about fake QR codes on parking meters and in texts. What it said, the Texas…
In late December 2012, attackers rigged the Council on Foreign Relations website to silently exploit an Internet Explorer zero-day and…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
Impersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024.…
A tech-support operator used fake Microsoft/Apple security pop-ups to scare consumers, often older Americans, into calling an India-based support line…
Prosecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took…
Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam…
A Pakistan national in Sydney allegedly ran a vishing scheme impersonating telecommunications support, using maintenance or upgrade pretexts to obtain…
A phishing email tricked Unatrac's CFO into surrendering his Office365 credentials on a fake Microsoft login page; the attacker then…
A Costa Rica-based telemarketing ringleader used VOIP-spoofed Washington D.C. caller ID and fake government-official personas to convince hundreds of mostly…
Social Engineering Examples