Impersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024. Found a year later by auditors.
Social Engineering Examples·7 sources
The School District of Philadelphia lost nearly $700,000 to vendor impersonation in early 2024, and didn't find out for over a year. Impersonators posing as two real district vendors asked to be paid by ACH transfer instead of the district's usual paper cheque. Four payments went to fraud accounts between 6 February and 12 March 2024: $563,151 meant for a flood-damage repair contractor and $126,056 meant for a special-education services provider. The real vendors had done the work and never got paid. City Controller Christy Brady disclosed it on 22 May 2025 and referred it to Pennsylvania's Attorney General. Status: Under investigation; funds not recovered.
| Date (2024) | Meant for | Amount |
|---|---|---|
| 6 February | Special-education compensatory services vendor | $126,056 across three transfers |
| 27 February | Same vendor | |
| 8 March | Same vendor | |
| 12 March | Flood-damage repair contractor | $563,151 |
Total per the Controller's referral letter: about $689,207. The district says it didn't pay more than it contractually owed. The vendors are still out of pocket.
| Step | What happened |
|---|---|
| Pose | Someone writes in as a known vendor with a real outstanding invoice |
| Switch | They ask to be paid by ACH direct deposit rather than cheque, and give bank details |
| Pay | Accounts payable updates the record and sends the money |
| Wait | Nothing looks wrong until the real vendor asks where its payment is, or an audit catches it |
How did the impersonators get in? The Controller said they gained unauthorised access to banking data or manipulated existing payment systems. The public records don't pin down the mechanism. What they do show is the control gap: the Inspector General's 2024 report found vendor requests weren't consistently confirmed by phone, and there were no formal ACH procedures.
Tip: a vendor asking to change how it gets paid is the single most reliable BEC warning sign. Call the number already on file. Not the one in the email.
Two official documents describe this differently. The Controller's letter itemises four ACH transfers adding up to about $689,207. The Inspector General's 2024 Annual Report describes two suspected BEC incidents totalling $686,184.39. Both are "nearly $700,000". The records don't explain the gap, so this page doesn't try to.
The matter went to the Pennsylvania Attorney General and the FBI. Nobody has been publicly identified.
See also invoice fraud, the Pine Bluff School District case and the Dickinson Public Schools case.
Nearly $700,000, itemised as about $689,207 across four ACH payments in February and March 2024. None had been recovered at disclosure in May 2025.
Impersonators posing as two real vendors asked to be paid by ACH instead of paper cheque, and supplied their own bank details.
No. Both had completed the work and had not received payment at the time of disclosure.
No. The case was referred to the Pennsylvania Attorney General and reported to the FBI. No one has been publicly identified.
Social Engineering Examples. “School District of Philadelphia: nearly $700,000 lost to vendor impersonation (2024)”. Accessed 3 November 2026. https://socialengineeringexamples.com/philadelphia-school-district-vendor-ach-bec-2024
The attackers posed as two legitimate School District of Philadelphia vendors with genuine outstanding payments, but the available records do not establish how the vendors were selected.
Vendor participation in public procurement and the resulting paper trail is difficult to hide and is not itself the gap to close. The realistic control assumes an attacker can learn real invoice details and hardens the payment-change process those details later get used against, see Stage 4, rather than trying to keep vendor relationships secret.
The OIG classified the matter as suspected business email compromise, but the supplied records do not establish how any vendor email account was compromised.
A vendor's own email security sits outside the district's direct control, but contracts can require vendors to use multi-factor authentication on financial-communication accounts, and the district can treat every vendor email, even from a known and correct address, as unverified until confirmed by phone.
Posing as the legitimate, already-known vendor and referencing a genuine outstanding invoice, the attacker contacted the district's accounts-payable function by email, requesting that payment be switched from the district's default paper check to electronic ACH transfer.
Train accounts-payable staff to flag any unsolicited request to change a vendor's payment method or banking details as inherently high-risk, regardless of how legitimate the accompanying invoice details appear.
The OIG reported failures to consistently confirm vendor requests for ACH payment changes directly by telephone and a lack of formalized procedures. The Controller separately reported that the actors gained unauthorized access to banking data or manipulated existing payment systems, without establishing the specific mechanism.
Require mandatory out-of-band verification of any bank-detail or payment-method change, using a phone number already on file rather than one supplied in the request, plus dual authorization and a bank prenote or test transaction before releasing funds. Do not host fillable ACH change forms on a public website, per NACHA guidance.
The Controller reported four fraudulent ACH transfers totaling approximately $689,207 between February 6 and March 12, 2024. The OIG separately reported two suspected BEC incidents totaling $686,184.39; the records are not reconciled here.
Apply transaction-level controls such as temporary holds, dollar-threshold review, or an added approval step on the first payment run to a newly changed vendor bank account before large sums are released.
The Controller reported that the payments had not been recovered as of the May 22, 2025 disclosure. The available records do not establish how or when the funds moved after receipt.
Report suspected fraud promptly to the bank and FBI IC3 to support recall and recovery efforts.
The Controller reported that the diverted payments were identified after the vendors did not receive the funds and the matter was reviewed during the district's audit process. The available record does not establish the operation of real-time transaction controls.
Shorten the detection cycle by having accounts-payable staff and vendors reconcile invoices and payments on a routine, frequent schedule rather than relying on an annual external audit to surface discrepancies.
Browse by what this case has in common with others in the library.
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's…
Orion S.A. lost about $60M in 2024 when an employee was tricked into wiring money to criminals. What Orion confirmed,…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Orlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
Attackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread, then posed as the…
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
Someone used the White House chief of staff's phone contacts and an AI-like voice to call senators and executives, asking…
US prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash.…
A fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
In July 2020, callers posing as Twitter IT stole staff logins and hit 130 accounts, from Obama to Musk, with…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
North Korea-linked attackers phished Sony staff with fake Apple ID emails, stole data and wiped thousands of PCs in 2014.…
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
A phishing attack resulted in disclosure of 2015 W-2 data for several thousand US employees, exposing SSNs and earnings to…
Fraudsters spoofed Barclays' real phone number and hold music, posed as the bank's fraud team in a two-caller vishing script,…
A spoofed email impersonating a company executive tricked a Main Line Health employee into emailing the W-2 and personal data…
The CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019…
Attackers hijacked a staff email account and used fake solar-panel invoices to trick the US charity into wiring $997,400 to…
Employees scanned a QR code in a fake Microsoft MFA-setup PDF and gave up passwords on a cloned login. How…
Social Engineering Examples