Case Library / Phishing / South Carolina BEC ring: 12 indicted, $25M+ stolen (2020 to 2024)
Phishing Documented incident

South Carolina BEC ring: 12 indicted, $25M+ stolen (2020 to 2024)

A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above $25M. Nine now convicted.

Share:

Social Engineering Examples·7 sources

In January 2025, a federal grand jury in Columbia, South Carolina, indicted 12 people over a nationwide business email compromise scheme that ran from at least 2020 to 2024. Prosecutors say the group, working with overseas partners, watched hacked business inboxes for big upcoming payments, then sent fake emails redirecting the money to accounts they controlled. Victims included construction firms, private equity firms, title companies and law firms. By June 2026, seven had pleaded guilty and two were convicted at trial. Status: Convictions, some allegations pending.

Key takeaways

  • The attackers waited. They read inboxes until a large payment was due, then struck at exactly the right moment.
  • The fake emails used real names, real deal details and the right timing.
  • The indictment lists about $5.3 million across ten payments. Trial evidence put the full scheme above $25 million.
  • The US Secret Service recovered about $2.5 million for victims.

How the scheme worked

Step What prosecutors allege
Get in Hack or use already-compromised business email accounts
Watch Read the mail for large upcoming payments: property closings, construction draws, loan payouts, an inheritance
Strike Send spoofed emails posing as a colleague, partner or vendor with new bank details
Receive Money lands in business accounts opened for sham companies
Drain Cash withdrawals and cashier's cheques, moved through several accounts, some sent overseas

This is business email compromise at its most patient. Because the attackers had read the real emails, their fake ones matched the people, the deal and the timing.

Tip: the bigger the payment, the more it's worth a phone call. Confirm bank details by voice before any large wire, every time.

Who was targeted

  • Construction companies, private equity firms, title and escrow companies, and law firms in South Carolina, New Jersey, Florida, Texas, Pennsylvania and Japan.
  • A Boston-area point-of-service company, a Dallas real estate company and a Pennsylvania metals recycler.
  • An estate executor handling an inheritance.
  • A grant payment: USAID's inspector general opened its own inquiry after one of its partners received fake emails asking to change a sub-grantee's bank account in India.

The case

Date Event
21 January 2025 12-count indictment returned against 12 people (case 3:25-cr-00055)
18 November 2025 One defendant arrested
Before trial Seven plead guilty to wire fraud conspiracy
11 June 2026 Two convicted after a seven-day jury trial

IRS Criminal Investigation, Homeland Security Investigations, the Secret Service, the FBI and USAID's inspector general all worked the case. Trial evidence reportedly described a US-based recruiter and manager running the domestic side. Defendants without a plea or conviction remain accused.

What would have stopped it

  • Phone verification for any new or changed bank details, using known numbers.
  • Strong login security on email, so attackers can't sit inside an inbox for months.
  • Alerts on mailbox rules and odd logins, which often reveal a hidden watcher.
  • Tell clients your bank details won't change by email, especially in property and legal deals.

See also how to prevent BEC and how to verify a wire transfer.

Common questions

How much did the South Carolina BEC ring steal?

The indictment lists about $5.3 million across ten payments. Trial evidence put the full scheme at more than $25 million from 2020 to 2024.

How many people were convicted?

Seven pleaded guilty before trial, and two were convicted by a jury in June 2026.

Who were the victims?

Businesses and individuals across the US and in Japan, including construction firms, private equity firms, title companies, law firms and an estate executor.

Was any money recovered?

The US Secret Service reportedly recovered about $2.5 million for victims.

Sources
Cite this case

Social Engineering Examples. “South Carolina BEC ring: 12 indicted, $25M+ stolen (2020 to 2024)”. Accessed 3 November 2026. https://socialengineeringexamples.com/south-carolina-12-defendant-bec-ring-2025

Attack Chain & Defense
1Reconnaissance and mailbox compromise
What happened

Per the indictment, the ring gained unauthorized access to victim businesses' computer/email systems or exploited already-compromised inboxes, consistent with the credential phishing, purchased stolen-credential access, or infostealer-sourced logins typically used to seed foreign-based BEC operations before any victim contact occurs.

The control that would have stopped it

MFA and conditional-access controls on business email, paired with credential-phishing awareness training, directly target the unauthorized-access step DOJ/IRS-CI recommendations call out as the entry point.

2Silent inbox monitoring
What happened

Once inside, the foreign-based operators passively watched real email threads over time, per trial evidence, to learn upcoming large-dollar transactions (real estate closings, construction draws, PE capital calls, loan disbursements, an inheritance transfer) along with the points of contact, account details, deal timing, and normal communication style needed to make a later spoofed message convincing.

The control that would have stopped it

Monitoring for unauthorized mailbox rules, forwarding settings, and anomalous logins (the DOJ/IRS-CI recommendation) can surface a silently monitored inbox before an attacker has gathered enough deal detail to send a convincing spoofed message.

3Domestic mule infrastructure build-out
What happened

In parallel, per the indictment's account tables, the U.S.-based crew registered sham LLCs with state authorities and opened corresponding business bank accounts at multiple banks under Demani Bosket's direction, building the receiving infrastructure before any specific fraud was executed.

The control that would have stopped it

A victim organization has no visibility into a criminal ring's shell-company formation or mule-account opening; the realistic control sits with banks' own KYC and account-opening due diligence flagging newly formed LLCs that quickly receive large incoming wires, not with the eventual victim.

4Spoofed email deployment
What happened

At the moment a real transaction was about to close, conspirators sent a spoofed email impersonating internal personnel, a business partner, vendor, or other trusted party, instructing the victim to send or redirect the payment to a newly supplied bank account.

The control that would have stopped it

Treat any last-minute change to payment or banking instructions, especially on real estate closings, vendor payments, loan disbursements, or estate/inheritance transfers, as a red flag requiring manager-level verification before acting.

5Wire/ACH redirection
What happened

Believing the message was legitimate because it matched the real deal's timing and tone, the victim transferred funds into a mule-controlled shell-company account rather than the true counterparty's account.

The control that would have stopped it

Verify any changed account details via a known, independently confirmed phone number obtained outside the email thread itself (never one supplied in the suspect message), combined with callback/dual-authorization controls before releasing a wire.

6Rapid layering
What happened

Per trial evidence, the alleged organizer directed the crew to immediately drain the fraudulently obtained funds via cash withdrawals and cashier's checks and move them through multiple accounts, a classic money-mule layering pattern meant to outrun bank and victim recovery efforts.

The control that would have stopped it

Report suspected BEC immediately to IC3/FBI and the receiving bank to attempt a Financial Fraud Kill Chain recall; recovery odds drop sharply once funds are already being layered through multiple mule accounts, which is why speed at this stage matters more than any single earlier control.

7Cross-border exfiltration
What happened

A portion of the laundered funds was sent overseas, with a secondary source citing Nigeria, China, Singapore, and India as destination countries, placing the money beyond easy U.S. law-enforcement reach.

The control that would have stopped it

Once funds move into international wire/correspondent-banking channels, clawback becomes very difficult for a victim or even law enforcement; the nearest real control is triggering the Stage 6 kill-chain recall before cross-border transfer completes.

8Proceeds retention and division
What happened

The remaining domestic portion was retained and split among ring members, completing the scheme's objective; the U.S. Secret Service later recovered roughly $2.5 million of the more than $25 million stolen for return to victims.

The control that would have stopped it

There is no preventive control once stolen funds have been split and spent; recovery at this point depends on law-enforcement asset seizure and forfeiture, which is how the Secret Service returned a partial recovery to victims, reinforcing why the upstream verification controls at Stages 4 through 6 are where the real defense has to happen.

Quick Facts
Victim
Multiple businesses
and individuals nationwide and abroad, including construction companies, private equity firms, title/escrow companies, and law firms in South Carolina, New Jersey, Florida, Texas, Pennsylvania, and Japan, plus a Boston-area point-of-service company, an estate executor, a Dallas real estate company, and a Pennsylvania specialty-metals recycling firm
Location
Prosecuted in the U.S. District Court for the District of South Carolina
(Columbia, SC); victim businesses located in South Carolina, New Jersey, Florida, Texas, Pennsylvania, and Japan (plus at least one Boston, MA-area victim and individual victims); defendants resided in South Carolina (Saluda, Gaston, Aiken/Beech Island), North Carolina (Charlotte), Georgia (Savannah), Florida (Jacksonville), Texas (Pflugerville/Austin), and later Washington State (Auburn)
Date
Scheme active from at least January 2020 through 2024; 12-count indictment returned by a federal grand jury in Columbia, SC on January 21, 2025
(unsealed/announced January 23-24, 2025) in federal case No. 3:25-cr-00055 (D.S.C.); one defendant arrested November 18, 2025; first trial convictions of two defendants June 11, 2026
Impact
The 12-count indictment itemizes roughly $5.3 million in alleged losses across ten specific victim transactions.
BasisallegedThe alleged basis describes the indictment amounts; separate June 2026 trial-evidence and recovery figures are attributed in the financial-impact field.
Separately, June 2026 trial evidence reportedly put the full multi-year scheme at more than $25 million stolen from individuals and businesses nationwide, and the U.S. Secret Service reportedly recovered approximately $2.5 million for return to victims. Seven defendants pleaded guilty to wire fraud conspiracy; two defendants were convicted at trial. The indictment allegations remain allegations for defendants without an established plea or conviction.
Status
Documented incident
Case Type
Real-World Incident
Sector
Construction & Engineering, Financial Services & Insurance, Legal Services, Manufacturing & Industrial, Professional & Business Services, Real Estate, Retail & Hospitality
Threat Actor
Organized Crime
Explore more

Related Cases

Browse by what this case has in common with others in the library.