A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above $25M. Nine now convicted.
Social Engineering Examples·7 sources
In January 2025, a federal grand jury in Columbia, South Carolina, indicted 12 people over a nationwide business email compromise scheme that ran from at least 2020 to 2024. Prosecutors say the group, working with overseas partners, watched hacked business inboxes for big upcoming payments, then sent fake emails redirecting the money to accounts they controlled. Victims included construction firms, private equity firms, title companies and law firms. By June 2026, seven had pleaded guilty and two were convicted at trial. Status: Convictions, some allegations pending.
| Step | What prosecutors allege |
|---|---|
| Get in | Hack or use already-compromised business email accounts |
| Watch | Read the mail for large upcoming payments: property closings, construction draws, loan payouts, an inheritance |
| Strike | Send spoofed emails posing as a colleague, partner or vendor with new bank details |
| Receive | Money lands in business accounts opened for sham companies |
| Drain | Cash withdrawals and cashier's cheques, moved through several accounts, some sent overseas |
This is business email compromise at its most patient. Because the attackers had read the real emails, their fake ones matched the people, the deal and the timing.
Tip: the bigger the payment, the more it's worth a phone call. Confirm bank details by voice before any large wire, every time.
| Date | Event |
|---|---|
| 21 January 2025 | 12-count indictment returned against 12 people (case 3:25-cr-00055) |
| 18 November 2025 | One defendant arrested |
| Before trial | Seven plead guilty to wire fraud conspiracy |
| 11 June 2026 | Two convicted after a seven-day jury trial |
IRS Criminal Investigation, Homeland Security Investigations, the Secret Service, the FBI and USAID's inspector general all worked the case. Trial evidence reportedly described a US-based recruiter and manager running the domestic side. Defendants without a plea or conviction remain accused.
See also how to prevent BEC and how to verify a wire transfer.
The indictment lists about $5.3 million across ten payments. Trial evidence put the full scheme at more than $25 million from 2020 to 2024.
Seven pleaded guilty before trial, and two were convicted by a jury in June 2026.
Businesses and individuals across the US and in Japan, including construction firms, private equity firms, title companies, law firms and an estate executor.
The US Secret Service reportedly recovered about $2.5 million for victims.
Social Engineering Examples. “South Carolina BEC ring: 12 indicted, $25M+ stolen (2020 to 2024)”. Accessed 3 November 2026. https://socialengineeringexamples.com/south-carolina-12-defendant-bec-ring-2025
Per the indictment, the ring gained unauthorized access to victim businesses' computer/email systems or exploited already-compromised inboxes, consistent with the credential phishing, purchased stolen-credential access, or infostealer-sourced logins typically used to seed foreign-based BEC operations before any victim contact occurs.
MFA and conditional-access controls on business email, paired with credential-phishing awareness training, directly target the unauthorized-access step DOJ/IRS-CI recommendations call out as the entry point.
Once inside, the foreign-based operators passively watched real email threads over time, per trial evidence, to learn upcoming large-dollar transactions (real estate closings, construction draws, PE capital calls, loan disbursements, an inheritance transfer) along with the points of contact, account details, deal timing, and normal communication style needed to make a later spoofed message convincing.
Monitoring for unauthorized mailbox rules, forwarding settings, and anomalous logins (the DOJ/IRS-CI recommendation) can surface a silently monitored inbox before an attacker has gathered enough deal detail to send a convincing spoofed message.
In parallel, per the indictment's account tables, the U.S.-based crew registered sham LLCs with state authorities and opened corresponding business bank accounts at multiple banks under Demani Bosket's direction, building the receiving infrastructure before any specific fraud was executed.
A victim organization has no visibility into a criminal ring's shell-company formation or mule-account opening; the realistic control sits with banks' own KYC and account-opening due diligence flagging newly formed LLCs that quickly receive large incoming wires, not with the eventual victim.
At the moment a real transaction was about to close, conspirators sent a spoofed email impersonating internal personnel, a business partner, vendor, or other trusted party, instructing the victim to send or redirect the payment to a newly supplied bank account.
Treat any last-minute change to payment or banking instructions, especially on real estate closings, vendor payments, loan disbursements, or estate/inheritance transfers, as a red flag requiring manager-level verification before acting.
Believing the message was legitimate because it matched the real deal's timing and tone, the victim transferred funds into a mule-controlled shell-company account rather than the true counterparty's account.
Verify any changed account details via a known, independently confirmed phone number obtained outside the email thread itself (never one supplied in the suspect message), combined with callback/dual-authorization controls before releasing a wire.
Per trial evidence, the alleged organizer directed the crew to immediately drain the fraudulently obtained funds via cash withdrawals and cashier's checks and move them through multiple accounts, a classic money-mule layering pattern meant to outrun bank and victim recovery efforts.
Report suspected BEC immediately to IC3/FBI and the receiving bank to attempt a Financial Fraud Kill Chain recall; recovery odds drop sharply once funds are already being layered through multiple mule accounts, which is why speed at this stage matters more than any single earlier control.
A portion of the laundered funds was sent overseas, with a secondary source citing Nigeria, China, Singapore, and India as destination countries, placing the money beyond easy U.S. law-enforcement reach.
Once funds move into international wire/correspondent-banking channels, clawback becomes very difficult for a victim or even law enforcement; the nearest real control is triggering the Stage 6 kill-chain recall before cross-border transfer completes.
The remaining domestic portion was retained and split among ring members, completing the scheme's objective; the U.S. Secret Service later recovered roughly $2.5 million of the more than $25 million stolen for return to victims.
There is no preventive control once stolen funds have been split and spent; recovery at this point depends on law-enforcement asset seizure and forfeiture, which is how the Secret Service returned a partial recovery to victims, reinforcing why the upstream verification controls at Stages 4 through 6 are where the real defense has to happen.
Browse by what this case has in common with others in the library.
A forged "change your remittance bank account" email tricked a Puerto Rico government corporation into wiring $2.6M to a fraudster-controlled…
A European subsidiary of Toyota parts maker Toyota Boshoku transferred up to about 4 billion yen (~$37M) to criminals in…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
A fraudster posing as AFGlobal's CEO, backed by a fake KPMG "attorney," pressured the accounting director into wiring $480,000 to…
An unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
US prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash.…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A Pennsylvania shredding-business owner's 2010 qui tam suit alleged that Shred-It, Iron Mountain.
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a…
A Rapid7 penetration tester tailgated into a client's building using door-holding reciprocity and a cloned-looking badge, rode an elevator up…
North Korea-linked attackers phished Sony staff with fake Apple ID emails, stole data and wiped thousands of PCs in 2014.…
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX…
A phishing email tricked Unatrac's CFO into surrendering his Office365 credentials on a fake Microsoft login page; the attacker then…
Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam…
DOJ's first-of-its-kind nationwide takedown charged 61 individuals and entities, including five Ahmedabad, India call-center conglomerates, for an alleged 2012-2016 IRS/USCIS…
Prosecutors allege Ghanaian twins used fake female personas and AI video to take $15M+ from 130+ older Americans. What is…