Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M recovered. How the thread hijack worked.
Social Engineering Examples·6 sources
Pine Bluff School District's BEC loss came down to one extra letter. In December 2025, the Arkansas district was making a routine monthly payment to East Harding Construction for its roughly $74 million new high school. Scammers slipped into the real email thread from a lookalike domain, "easthardings.com" instead of "eastharding.com", and asked for the payment by wire because of a year-end audit. On 17 December the district wired $3,204,639.55 to accounts they controlled. By May 2026 it had recovered $1,120,051.15. Status: Under FBI investigation.
| Date | Event |
|---|---|
| By 12 December 2025 | The finance director's Google account is accessed from a device in Lekki, Nigeria, per a login screenshot in released records |
| December 2025 | Architect Lewis Architects Engineers sends the pay application to East Harding, which forwards it to the district. Attackers join the thread from easthardings.com |
| 17 December 2025 | The district wires $3,204,639.55 through Simmons Bank. The superintendent approves it |
| 18 December 2025 | While checking an unrelated vendor request, the finance director spots the wrong domain. She calls East Harding and confirms the fraud at about 2:10pm |
| 19 December 2025 | She files a complaint with the FBI's IC3 |
| May 2026 | The district reports $1,120,051.15 recovered |
Most of what's known comes from district records released under Arkansas's open records law, including annotated email printouts and the IC3 complaint, as reported by the Arkansas Democrat-Gazette.
| Move | Why it worked |
|---|---|
| Ride a real thread | Topic, timing, amount and people were all expected. Nothing looked off |
| Add one letter | "easthardings.com" reads as right at a glance |
| Use a true reason | A real year-end audit explained the switch from the usual cheque pickup to an electronic payment |
| Hide the real email | Notes in the records suggest the genuine contractor message was hidden in the finance director's mailbox |
| Adapt | When she said she couldn't pay by ACH, the scammers offered wire instructions instead |
That last step tells you something. These people knew the relationship well enough to roll with a no.
Tip: a change in how you pay a vendor, cheque to wire, is as risky as a change of bank details. Call before you send.
The money went through Citibank to several other accounts. Simmons Bank's fraud team asked for it back. The district still had to pay East Harding the real amount owed. It has no separate cyber insurance and filed a claim with the Arkansas Cyber Response Board. The FBI opened an investigation. The finance director was later put on paid administrative leave. East Harding said its own systems weren't breached. Nobody has been identified or charged.
Pine Bluff has since adopted these controls. See also invoice fraud, the Dickinson Public Schools case and business email compromise.
It wired $3,204,639.55 to scammers on 17 December 2025 and had recovered $1,120,051.15 by May 2026.
They joined a real invoice email thread from a lookalike domain, easthardings.com, and asked for the payment by wire, citing a real audit.
East Harding said its own systems were not breached.
The next day, the finance director noticed the wrong domain and called East Harding, which confirmed it never asked for a wire.
Social Engineering Examples. “Pine Bluff School District's $3.2M BEC: one extra letter in a domain (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/pine-bluff-school-district-vendor-bec-2025
Attackers likely used public sources such as school-board meeting records, bond/construction-project disclosures, and local news coverage of the district's ~$74M high school project to identify Pine Bluff School District's large, recurring vendor payments and its relationship with contractor East Harding Construction and architect Lewis Architects Engineers.
Public disclosures about large capital projects (board minutes, bond announcements, local news) serve legitimate transparency purposes and are very hard to suppress; the realistic control assumes attackers can find this information and instead hardens the payment process it gets used against, which is addressed at later stages.
The actors registered a domain, "easthardings.com" (an added "s"), built to visually mimic the real "eastharding.com" vendor domain, staging infrastructure in advance so it could receive copied correspondence and later send messages that appeared to come from East Harding.
Brand-protection or DNS-monitoring services that alert on newly registered look-alike domains, plus an organization proactively registering close variants of its own vendor and partner domain names, can catch some of these registrations, though not every permutation.
Consistent with FOIA-released login records showing access to the finance director's Google account from a device in Lekki, Nigeria as early as Dec. 12, and with the finance director's own IC3 statement that the construction manager's email account was compromised too, the attackers gained unauthorized access to email on both sides of the vendor relationship, likely through prior phishing or stolen/leaked credentials rather than a documented technical exploit.
Enforcing multi-factor authentication on all finance-adjacent email accounts and monitoring for logins from unexpected geographies is exactly the kind of control that would have flagged the Nigeria-based access in this case in real time rather than only after the fact via FOIA records.
Once inside, the attackers appear to have applied a mailbox filter that moved the district's legitimate contractor email into the finance director's trash folder so she would not see it, then inserted the look-alike domain address into the ongoing invoice thread as a hidden participant.
Regularly auditing mailbox rules and filters for unexpected forwarding, deletion, or filing rules catches the kind of attacker-created rule that hid the genuine contractor email here, a well-documented BEC persistence technique.
Posing as a known East Harding executive inside the hijacked, genuine thread, the attackers cited the district's real, already-known year-end audit as the reason to switch the routine payment from an in-person check pickup to an electronic transfer, an accurate detail that made the request feel unremarkable.
Treating any request to change a payment method or timing as an automatic trigger for out-of-band verification, even one wrapped in an accurate, familiar-sounding pretext like a known audit, keeps a true supporting detail from being enough on its own to authorize a change.
When the finance director said she could not pay by ACH, the attackers adapted in real time and offered wire instructions instead, showing they were monitoring replies and understood the vendor relationship well enough to keep the pretext credible.
Requiring that any change to payment channel or banking details be confirmed by calling the vendor back on a previously known phone number, never one supplied in the same email thread, closes the gap that adaptive, in-thread social engineering exploited here.
The finance director initiated the $3,204,639.55 wire through Simmons Bank on Dec. 17, 2025, with the superintendent's approval, sending the funds toward an account at Citibank that the attackers controlled.
Dual authorization and separation of duties, so no single employee can both initiate and approve a large wire, plus a mandatory small test transfer with a waiting period for new or changed banking instructions, are the controls Pine Bluff adopted after the fact and would have interrupted execution.
Per the superintendent's account to reporters, funds moved from the receiving Citibank account on to multiple further downstream accounts, a rapid-dispersal pattern typical of BEC money-mule layering meant to frustrate wire-recall efforts before the fraud is discovered.
Immediate fraud reporting to the originating bank and to FBI IC3 enables fast wire-recall requests to the receiving bank, the main lever for clawing back funds before further dispersal, which is what produced the roughly $1.12M Pine Bluff recovered.
Browse by what this case has in common with others in the library.
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
Researchers from UIUC, the University of Michigan, and Google dropped 297 USB drives across the UIUC campus and found that…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into…
An Arup employee in Hong Kong sent HK$200M (US$25.6M) after a video call where everyone else was a deepfake. How…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
A Tennessee school district's finance director wired $3.36M in state education funds to fraudsters impersonating textbook vendor Pearson from a…
Scammers impersonating a school construction contractor submitted a bank-account-change request with seemingly valid documentation, and Cabarrus County, NC wired $2.5M…
Criminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How…
The FTC's first-ever case under the FACTA Disposal Rule: a Northbrook, Illinois mortgage lender repeatedly dumped intact customer credit reports.
Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam…
A scammer posing as GCI's CFO emailed payroll and, after the employee's initial pushback, persuaded them to hand over 2015…
DOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
The FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the…
In 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How…
A spoofed email impersonating a company executive tricked a Main Line Health employee into emailing the W-2 and personal data…
Impostors posing as Scoular's CEO and a senior figure at its audit firm convinced the controller a secret China acquisition…
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
Attackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread, then posed as the…
Fraudsters spoofed Barclays' real phone number and hold music, posed as the bank's fraud team in a two-caller vishing script,…
Social Engineering Examples