Manhattan BEC Ring: Four Defendants Redirect Millions from Two Organizations

What happened

By at least May 2021, the indictment alleges that four defendants obtained unauthorized access to the business email account of the CFO of Brownsville Community Development Corporation. Fraudulent wire instructions caused approximately $3,488,000 to leave Corporation-1's account, with approximately $1,570,000 routed to the recipient account A. The indictment also alleges that a private-equity-owned portfolio company sent approximately $2,008,034.76 to the recipient account B in July 2021 after fraudulent wire instructions. Court records further allege that funds were moved through additional accounts and that some were converted to Bitcoin. A superseding indictment charged the listed fraud, money-laundering, identity-theft, and money-transmitting offenses. Two defendants later pleaded guilty and cooperated as trial witnesses. One defendant went to trial; the supplied record supports the BEC and money-laundering charges but does not establish the full scope of the jury's verdict on unrelated schemes.

The lure and the tell

There was no external lure to spot in the conventional phishing sense: the fraudulent instructions arrived from the victims' own genuine, previously-trusted CFO/employee email accounts, likely obtained via prior credential compromise (indictment materials do not fully detail the initial access vector). The tell available to victims in hindsight was a last-minute change to wire/beneficiary account details on an existing payment rather than a wholly new request, and the destination accounts were newly opened, unfamiliar accounts rather than the counterparty's long-established bank relationship.

Outcome

Charged in a December 2, 2022 indictment later superseded on December 19, 2023. Two defendants pleaded guilty and cooperated as trial witnesses. One defendant was convicted in March 2024 and sentenced in September 2024 to 60 months' imprisonment, supervised release, a $50,000 fine, and $4,545,704 in forfeiture. Another defendant was sentenced in April 2024 to 24 months. Another was sentenced in March 2025 to time served, supervised release, a $10,000 fine, and $10,000 forfeiture. The petition states that one defendant died before sentencing.

Why it matters

This case shows BEC schemes targeting organizations that handle large wire transfers and using compromised business email accounts to redirect payments. It also shows that the charged conduct included movement of funds through additional accounts and Bitcoin conversion. The supplied record does not establish net loss, recovery, or the full scope of any verdict on unrelated schemes.

Defenses

Require out-of-band verification (phone call to a previously-known number, not one supplied in the email) for any change to wire/beneficiary instructions, especially on high-dollar or first-time-to-this-account transfers. Enforce dual control and a waiting/callback period on outbound wires above a threshold. Monitor CFO/finance-team mailboxes for anomalous forwarding rules, new-device logins, and impossible-travel sign-ins that indicate account takeover. Treat mid-thread changes to banking details as a hard-stop event requiring verification through a separate channel, regardless of how convincing the email thread looks.