These Scams Are Real.
They Happened to Real People.

Jaguar Land Rover was hit by a major cyberattack in 2025. Security researchers investigating the attack identified targeted phishing emails, stolen employee passwords, and manipulation of staff among the methods tied to the attackers. JLR never disclosed the precise point of entry.

JLR shut down its global systems and paused production for five weeks. The disruption spread through its dealers, suppliers, and the wider automotive supply chain. JLR reported £196 million in cyber-related costs, while the UK's Cyber Monitoring Centre estimated the wider economic impact at £1.9 billion across more than 5,000 organizations, calling it the most financially damaging cyber event ever to hit the UK.

Evaldas Rimasauskas registered a real company in Latvia and gave it the same name as Quanta Computer — a legitimate Taiwan-based hardware manufacturer that did real business with Facebook and Google. Not a near-miss spelling. The actual name. Over two years, he sent fraudulent invoices with spoofed email addresses, along with forged contracts and fake corporate seals. Employees at both tech giants wired payments to bank accounts he controlled in Latvia, Cyprus, Hungary, and Hong Kong.

Facebook wired nearly $100 million. Google wired over $23 million. Rimasauskas was extradited from Lithuania, pleaded guilty to wire fraud, and was sentenced to five years in federal prison. He was ordered to forfeit $49.7 million and pay $26.5 million in restitution.

Belgian bank Crelan disclosed losses of €70 million to a fraud organized from abroad. Belgian press reported it was CEO fraud, with a fake “boss” pressuring an employee.

Crelan said none of its clients were affected and it could absorb the loss from reserves.

Orion S.A. is a chemical manufacturer listed on the New York Stock Exchange. On August 10, 2024 the company determined that one of its employees — specifically not a senior executive — had been the target of a criminal scheme that resulted in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties. Nobody broke into Orion's systems. Someone convinced a person to send the money.

Orion told the SEC two days later that it expected a one-time pre-tax charge of roughly $60 million for the transfers it had not recovered. The same filing states the company found no evidence of any other fraudulent activity and does not believe the incident involved unauthorized access to its data or systems. Law enforcement was notified and Orion said it would pursue recovery, including through insurance.

FACC — an Austrian aerospace manufacturer that makes parts for Boeing, Airbus, and Rolls-Royce — received a fraudulent email impersonating its CEO, Walter Stephan. The email instructed an employee in the finance department to wire roughly €50 million to fund a "confidential acquisition." The employee complied. By the time FACC realized what had happened, the money had moved through banks in Slovakia and Asia.

FACC recovered about €10.9 million but took a €41.9 million loss. The company posted a pretax loss of €23.4 million for the fiscal year. The supervisory board fired CEO Walter Stephan and CFO Minfen Gu for "severely violating their duties" in what FACC dubbed the "Fake President Incident." The finance employee who executed the transfer was also dismissed.

Ubiquiti told the SEC the fraud involved employee impersonation and fraudulent requests from an outside entity targeting its finance department. $46.7 million held by a Hong Kong subsidiary went to overseas accounts held by third parties.

Ubiquiti later reported recovering $16.7 million, a net loss of $30.8 million.

German auto-parts maker Leoni said fraudsters used fake documents and identities through electronic communications to move about €40 million to accounts abroad.

Its stock fell and it lowered its annual forecast.

A Singapore commodity firm received an email that appeared to come from one of its legitimate suppliers. The sender's email address differed from the real supplier's address by just one character — an “i” had been replaced with an “l.” The email instructed the company to send a pending payment to a new bank account in Timor-Leste. The company transferred $42.3 million.

The scam email arrived on July 15 and the transfer went out on July 19. Four days after that, the genuine supplier told the company it had never received the payment. Singapore Police filed a report and contacted INTERPOL, whose rapid payment-interception mechanism reached authorities in Timor-Leste within 24 hours. More than $39 million was withheld from the fraudulent account, roughly another $2 million was recovered in follow-up work, and seven suspects were arrested in Timor-Leste — over $40 million returned in total.

On August 14, 2019, the European subsidiary of Toyota Boshoku Corporation — a Toyota Group parts maker that supplies car seats and interiors — acted on fraudulent payment directions sent by a third party and transferred company funds outside the company. Toyota Boshoku disclosed the incident on September 6, putting the expected loss at up to roughly ¥4 billion, about US$37 million.

The company said it became aware the directions were fraudulent shortly afterward, assembled a team of legal professionals, and reported the loss to local investigating authorities. Toyota Boshoku did not publish the contents of the email or the sender details.

Money-transfer firm Xoom announced it lost $30.8 million to a business email compromise scheme.

An employee of Nikkei America, the US subsidiary of the Japanese media group that then owned the Financial Times, transferred about $29 million based on instructions from someone posing as a Nikkei management executive.

Nikkei America hired lawyers and filed damage reports with authorities in the US and Hong Kong.

A finance employee in Arup’s Hong Kong office got an email from someone posing as the UK-based CFO about a secret transaction. He suspected phishing at first. Then he joined a video call where every “colleague” was a deepfake, and he sent HK$200 million (about $25.6 million) in 15 transfers.

He found out when he later checked with head office.

Between March 8 and March 27, 2018, the Dutch arm of the French cinema group Pathé received a series of emails purporting to come from the CEO of Pathé in France. They described a confidential acquisition of a cinema operator in the Gulf, said the matter "must remain strictly confidential," and asked that replies go only to a personal address. Four transfers totalling €19,244,304 went to an account in the name of Towering Stars General Trading in Dubai.

Pathé Nederland's managing director Dertje Meijer and financial director Edwin Slutter were suspended and dismissed. The details became public through an October 31, 2018 ruling of the District Court of Amsterdam in Slutter's unfair-dismissal claim, which found in his favor on the severance he was owed.

Attackers emailed the India head of Tecnimont SpA, part of the Italian group Maire Tecnimont, from an account that looked deceptively similar to one used by the group's CEO. They then staged a series of conference calls in which members of the group played the CEO, other senior Tecnimont executives, and a Swiss lawyer, to discuss a "confidential" acquisition in China. The India head was told the money could not be sent from Italy for regulatory reasons. He authorized three transfers in one week — $5.6 million, $9.4 million and $3.6 million — to banks in Hong Kong, where the funds were withdrawn within minutes.

The fraud surfaced when Tecnimont SpA's chairman visited India. The company dismissed its India chief and its head of accounts and finance.

European discount retailer Pepco (Pepco, Poundland, Dealz) said its Hungarian business lost about €15.5 million in cash to a “sophisticated fraudulent phishing attack.”

Its share price fell sharply after the announcement.

Omaha grain company Scoular Co.’s controller received emails that appeared to come from the CEO, about a secret deal in China. They told him to get wire instructions from an employee at the company’s accounting firm, KPMG, but those emails came from the lookalike domain kpmg-office.com. The messages told him not to discuss the deal through other channels, and he wired about $17.2 million to a bank in China.

The controller no longer worked at the company. The FBI sought seizure warrants against the Shanghai company that received the money; none had been returned at the time of the report.

A Malaysian company had been buying liquefied petroleum gas from an overseas supplier since January 2023. On June 22 it received an email from someone presenting as a representative of that supplier, instructing that payment be made to a new bank account. The company paid. It only learned it had been defrauded when the real supplier said the money had never arrived.

Bukit Aman's Commercial Crime Investigation Department, working with Bank Negara Malaysia and the banks involved, traced the transfers and stopped RM28,361,636 from reaching a foreign account. Its director, Datuk Seri Ramli Mohamed Yoosuf, described the method plainly: syndicates hack or monitor a company's email to watch its transactions, then pose as a business partner or supplier. His advice was equally plain — be wary of any instruction to change a bank account for payment, and phone the supplier to confirm.

Irish airline Ryanair disclosed it lost $5 million to a business email compromise attack.

Chicago Title handled escrow on a remote commercial closing. The day before closing, its closer got wire instructions sending seller proceeds to a Citibank account in the name of Earnspark Global Concerns. An email that appeared to come from the seller’s side confirmed the instructions were accurate. The seller-side contact’s email had been compromised before closing.

The proceeds never arrived. Chicago Title sued in federal court in New York in February 2026 to freeze the account and recover the funds.

A business email compromise scheme stole more than $3.3 million from two manufacturers, a boat builder and a ferry-engine maker. Federal prosecutors said the losses delayed or reduced employee pay and threatened the businesses.

Law firm Holland & Knight was sued after $3 million was wired to a fraudulent account in Hong Kong.

Law firm Dentons lost $2.5 million to a fraudulent wire.

A company that sells lead-frame products to the semiconductor industry got an email requesting a change of payment information from what appeared to be the true email address of a business partner it regularly bought equipment from. It wired $2,462,000 to the fraudster’s account.

The United States civilly forfeited the $2,462,000.

In September 2020, offenders claiming to be staff sent internal invoice emails to an Australian company's finance area — the same routine paperwork that team processes every day, but with the bank details altered. Finance paid twice: AUD 519,545, then AUD 2,148,938. Both payments went to an account in Singapore.

The Australian Federal Police coordinated with INTERPOL and the Singapore Police Force. The first transfer had already been drained by the offenders, but the second was intercepted after the bank was alerted — AUD 2.1 million of the AUD 2.67 million was recovered. The AFP published the case as part of a disclosure that business email compromise had cost Australian victims more than $79 million in twelve months.

A title company got an email from a nearly identical address with one letter changed, asking it to change a payoff amount and generate the payment. It wired $932,881.72 to the account in that email.

Mining company NioCorp told the SEC attackers compromised its systems and used its email in a business email compromise scheme, causing misdirected vendor payments of about $500,000.

A scammer emailed the "Shark Tank" investor's bookkeeper posing as Corcoran's assistant, using an address that misspelled the real one by a single letter. The message carried an invoice for a real estate renovation — $388,700.11, from a company called FFH Concept GmbH in Germany. Nothing about that is odd for someone who invests in property, which is exactly why nobody questioned it. The bookkeeper wired $388,700 to an account in Germany. Nobody questioned it until the bookkeeper noticed the address was wrong.

Corcoran initially said the money was gone. Her bank then asked the German bank to freeze the transaction while her team proved the payment was fraudulent, and the funds were returned to her in early March 2020 — an outcome that is the exception rather than the rule.

A small furniture business thought it was paying a supplier, but scammers had intercepted their emails.

The business recovered $118,000. Victoria Police say the scam is operating across the country.

Security company Huntress documented an attempt to redirect a payment intended for one of its vendors. The attempt was caught before the full loss.

A fraudster compromised the mailbox of Cheers Exhibition Services, a Dubai exhibition-stand company, and read its correspondence to learn which contracts were live. He then registered a second web address, one letter off from the real one, and wrote to the firm's clients from it — copying the real signatures, logos and invoice formatting.

Real

md@cheersexhibitions.com

Fake

md@cheersexhlbitions.com

A Russian client, paying for a stand at GITEX in Dubai, wired $53,000 (Dh194,700) to an account at a bank in Finland.

The account had been opened in the company's own name by the fraudster. Gulf News reported that police described the operation as far more sophisticated than ordinary phishing — the difference between the two addresses, as investigators put it, was not apparent to the naked eye.

A Dubai company received an email from a client it already did business with, asking for dues to be paid. It was not the client. As the prosecutor put it, the suspect had misled the company by creating a similar email format with one letter changed. The company wired Dh100,000. The first suspect received the money and immediately moved it to the second suspect's account.

Dubai prosecutors charged both men with fraud and illegally obtaining Dh100,000, and sent the case to the Misdemeanour Court even though neither man was there to answer it.

A Christchurch solar-panel manufacturer was approached by email for a quote on goods, then received a purchase order from what appeared to be a New Zealand university. The address was not the university's. Fraudsters running the scheme used altered addresses impersonating New Zealand universities and a district health board, changed only by minor punctuation — enough to own the address, little enough to read as legitimate. The goods were shipped, the scammers paid the freight, and the invoice went to the institution that had never ordered anything. The manufacturer was left NZD 32,000 out of pocket.

New Zealand Police's financial crime unit reported the pattern hitting hardware and electronics suppliers across the country, and stopped a shipment of 1,000 computer hard drives from reaching the scammers overseas after freight companies flagged the suspicious emails.

A Hong Kong precision manufacturing firm was targeted by an impersonation attack built entirely from outside its systems. The attacker registered a lookalike domain and used it the same day, sending a message styled as a reply within an existing conversation. It carried two forged PDFs, including fake bank letters, designed to push a payment to a different account. The message was sent through a completely different email provider from the one the real company uses — something nobody reading the email could possibly see, but obvious in the message's hidden details. The attempt was caught before any funds moved.

A mid-size technology services firm received a "Past due invoice" email whose sender name matched a vendor contact its staff already knew. It passed every security check, because it had genuinely been sent through a real bulk-email service that was allowed to send on that domain's behalf. The body was short and asked for payment to be redirected. The dangerous part was not visible in the message at all.

Shown in the inbox

your vendor’s name

Where a reply would actually go

mail@ilyff.com

That second address sat on a web address the criminals had registered a few weeks earlier. Anyone who hit reply — to confirm the amount, to query the account details — was writing to the attacker while believing they were writing to their vendor. Nobody opens the reply field to check who is on the other end of it, which is the whole reason this works.

Attackers registered ceo-coachinginc.com on March 6, 2026 and used it four days later, writing to a sports-technology company as "Carol Smith, CPA" on behalf of the real firm CEO Coaching International. The email carried a fabricated overdue invoice and named a senior executive at the recipient's own company, so the payment appeared to have been agreed further up. The closing line said this was the last communication before the matter went to a collections agency. Replies were pointed at two addresses the criminals controlled: carol@ceo-coachinginc.com, and admin@azur-email.com on a completely unrelated domain. The message passed every security check — but those checks confirmed an unrelated bulk-mail service, not the company the email claimed to be from.

An email impersonating the US law firm Alston & Bird LLP arrived as a genuine Google Drive sharing notice, sent through Google's own systems — so every security check passed, because Google really did send it. The trick was in the name itself.

Normal English letter

o

The letter they used instead

о

If those two look identical to you, that is exactly the point. They are different characters from different alphabets, drawn almost the same way. The “LLP” used odd small capitals instead of ordinary ones, too. On screen, the whole name reads perfectly.

Replies were pointed at an address on cloudsecurityaccess.com, a web address created roughly 22 hours before the message was sent, with no website and no working mail system behind it.

A phishing email sent to the chief executive of a small energy company impersonated the e-signature service DocuSign. The message showed a DocuSign logo, a headline reading “Find disclosures for your review,” and a PDF filename with a file size beside it. None of it was real text. It was all one picture, the filename was just pixels, and there was no attachment to open. There was not a single ordinary link in the message either, so tools that pull out web addresses and check them found nothing to check. But every click, anywhere on that card, went to the same place. And none of the usual checks on where the message came from had run at all — there was simply nothing there to confirm the sender.

Where every click went

done4you.tv

Not a name anyone would have approved if they had been shown it.

Microsoft documented criminals taking advantage of companies whose email settings were loose enough to let outsiders pose as insiders. One example was dressed up as a SharePoint notice asking the recipient to review a shared document. In the inbox, the From line looked like this:

What the recipient saw

From: Pending Approval <you@yourcompany.com>

Their own address, sending them a document to review. The system marked it as internal mail, too.

But the checks that run quietly behind every email — the ones that confirm a message really came from where it claims — all failed. It was like someone wearing your company badge and failing the ID check at the door. The links led on to pages the criminals controlled.

Researchers at INKY tracked a sustained campaign of 26,589 malicious emails reaching 5,527 organizations, each carrying an attachment dressed up as a missed-voicemail notification, often with the recipient's own email address in the subject line. The attachment looked like a picture, but this particular kind of image file can also carry instructions that run in your browser — and that is where the criminals hid their code. The files were even mislabeled so that security scanners would treat them as harmless plain text. The sending pattern was broad and untargeted, arriving in waves and largely skipping weekends.

Over three days in April 2026, Microsoft's Defender research team tracked phishing that reached more than 35,000 users at over 13,000 organizations across 26 countries. The emails were sent through real, legitimate email services, so nothing about them looked broken. They were professionally designed, used an urgent "code of conduct" warning to sound like a message from HR, named the recipient's own company in the text, and claimed to be arriving through an official internal channel — some even included a line insisting the message was genuine. Anyone who followed the link landed on a fake Microsoft sign-in page. Signing in there handed the criminals two things: the password, and the already-approved login that signing in created — which they could reuse to get back into the account without having to sign in again.

Microsoft documented widespread account compromise through device-code phishing. The lures were ordinary business themes — invoices, RFPs, shared files, e-signature requests, voicemail and secure-message notices — with generative AI used to tailor them to the recipient's role. Clicking the link opened a page that generated a genuine, live Microsoft device code on the spot and then sent the victim to the real microsoft.com/devicelogin portal to enter it. Everything the victim touched after the email was authentic; approving the code logged the attacker straight into the account.

A phishing campaign copied the notification emails sent by Zix, a real company that businesses use to send encrypted email. The messages were titled "Secure Zix message," repeated the claim in a header, and offered one button to read it. The button downloaded an HTML attachment rather than opening anything genuine. The campaign reached around 75,000 mailboxes, with the sharpest targeting aimed at CFOs, directors and company presidents — the people most used to receiving documents that are supposed to be confidential.

Across four waves in 2024, attackers emailed Sophos employees PDF attachments containing QR codes. The documents carried company logos, DocuSign-style branding and a deadline — "this document will expire in 24 hours" — and later versions even included the target's own name and job details. Scanning the code opened a fake Microsoft 365 sign-in page that captured the password and the multi-factor code as they were typed. At least one employee was caught. The attacker walked away with their password and their approved login, and tried to use both to get into internal systems.

Researchers documented a technique that spread rapidly through 2024 and became known as ClickFix. Emails arrived under ordinary business subjects — one wave posed as GitHub security notifications and reached more than 300 organizations; another used "Important Software Update: Action Required." Some carried nothing malicious at all: no dangerous link, no attachment. What they carried was an instruction. The recipient was shown an error message and a button labeled “Solution” or “How to fix.” Clicking it silently copied a command to the clipboard. Then came the instructions:

1. Press the Windows key and R
2. Press Ctrl and V
3. Press Enter

Three keystrokes, and the victim installed the malware on their own computer. In one version the attackers padded the copied text with a fake “verify you are human” message, so the real command was pushed out of sight in the Run box.

A variant of the same technique dressed itself as the checkbox everyone has clicked a thousand times. Email recipients who followed a link landed on a page reading "Verify You Are Human" — but instead of ticking a box, they were walked through a short set of steps that ended with them running a command on their own machine. Microsoft has since documented the same pattern being used as the opening move in longer intrusions.

Microsoft tracked an invoice-themed campaign against Office 365 users that ran for more than a year. The attachments were named like this:

Attachment

Payment receipt_4429_18$_Xls.html

Attachment

Contract-1029384756.XLS.html

Read quickly, you see “Xls” and think spreadsheet. The part that matters is the ending — .html — which makes it a web page, not a spreadsheet. The attackers shuffled the capitals as well (xls.HtMl, xsl_x.h_T_M_L) to get past scanners looking for the obvious pattern.

Opening it launched a convincing Microsoft sign-in screen in the browser — loaded from the recipient's own computer, so there was no suspicious web address to notice. To stay ahead of scanners, the attackers re-scrambled how the page was written roughly every 37 days, at one point resorting to encoding parts of it in Morse code.

QakBot campaigns broke into real email conversations and replied inside them, attaching a password-protected ZIP file and putting the password in the message. That combination is the whole trick: because the file is locked, the security tools scanning the email cannot see what is inside it, so the only thing that opens it is a person following the instructions. Researchers have documented the same approach continuing after QakBot itself was disrupted, picked up by other criminal groups and by state-backed ones.

Microsoft documented a finance-themed phishing campaign that hid invisible characters inside normal words. A word like "funding" would be written with something you cannot see wedged into the middle of it, so the message read perfectly to a person while filters looking for that word saw something else entirely.

What you see

funding

What is actually there

fun · ding

The dot is ours — it is standing in for a character that has no appearance at all on screen. The real thing is invisible, which is why reading more carefully cannot save you here.

At its peak on February 26, 2026 the campaign pushed up to 2.37 million messages in a day, run from a cluster of 148 finance-themed sender domains, on strict weekday hours.

Microsoft documented a large credential-phishing campaign running on more than 350 domains the attackers had generated by formula rather than chosen — c-hi.xyz, c-tl.xyz, a-cl.xyz, j-on.xyz, p-at.club, f-io.online, all following the same letter-dash-letters pattern across endings like .xyz, .club, .shop and .online. Mail arrived from a mixture of free accounts, hijacked legitimate domains and the attackers' own generated ones. Links passed through a legitimate site's redirect, then a CAPTCHA page, and finally a fake Office 365 sign-in screen already filled in with the victim's own address.

Researchers at Agari followed a Nigerian business email compromise group they called Curious Orca and found the step that comes before the fraud. One associate sent blank probe messages — empty, with no subject at all or just the single letter "i" — to more than 7,800 addresses at over 3,200 companies across at least twelve countries since August 2018. There were two forms, and both look like nothing at all:

Subject

(empty)

Subject

i

No message. No request. No link. Just a test to see whether the address was real.

If one doesn't bounce, the address is live and the person behind it goes into a working list; the group's validated database held more than 35,000 financial controllers and accountants at some 28,000 companies. The invoice fraud comes later, aimed only at addresses already proven real.

Norfund, Norway’s state-owned investment fund, said scammers stole about $10 million by spoofing an email address. The incident occurred in March 2020 and matched a typical business email compromise, where criminals impersonate trusted people to request a transfer of funds.

Attackers took over a school administrator’s email account and sent fraudulent vendor payment requests to city finance staff.

Criminals inserted themselves into communications between the city and the Community Action Council. City employees received an email they thought was from the council with new bank information and sent three wire transfers totaling about $4 million in federal rent assistance and housing funds.

Police, the FBI and the Secret Service investigated, wire transfers to the council were suspended, and the mayor ordered a review of wire transfer processes.

An investment manager for the pension fund made a transfer after getting instructions from a former employee’s hacked email account. The board didn’t uncover the fraud until months later.

Criminals impersonated the contractor on the city’s wastewater treatment plant project and emailed fraudulent wire instructions.

The city recovered the funds.

On 7 November 2024 a Northern Territory Government agency received an email that appeared to come from a contractor at a construction company it worked with, with updated bank details attached. The agency then paid $3,583,363 into the fraudulent bank account.

Police say $3,571,760 was recovered. A Sydney man was charged with dealing in proceeds of crime worth $1 million or more and appeared in Liverpool Local Court on 24 July 2025.

An impostor posing as Branch and Associates, the contractor building West Cabarrus High School, sent a series of emails and asked that the county change the bank account receiving its payments. Staff made the change, and the following month more than $2.5 million went to the scammers.

The county recovered $776,000 plus $75,000 from insurance and moved about $1.7 million from reserves to cover the rest. It is redesigning its vendor processes.

Criminals created counterfeit email accounts impersonating school district officials and bridge contractors. About $1.2 million meant for the ConVal School District and another $1.1 million meant for the Main Street bridge project were sent to them in July and August 2021.

The U.S. Secret Service investigated. Finance staff who handled the transfers were placed on leave; officials said no town staff were criminally involved.

An impostor posing as an employee of a regular Public Works contractor exchanged emails with city finance officials for months. The impostor sent documents such as voided checks and the company’s tax ID number, then switched the vendor’s bank account. Two payments, about $803,000 and $721,000, went to the impostor’s account.

A receiving bank flagged the name mismatch, and the $721,000 payment was reversed, but the $803,000 was not recovered. The fraud was reported to the FBI and the city’s inspector general, and the city asked all vendors to verify their information.

On September 14, 2023, the city paid $1.2 million by ACH transfer after someone sent a payment request posing as Moss Construction, the contractor building the city’s new police headquarters. The fake request passed a name check because the names matched corporate records.

The city’s bank worked to recover the money; Local10 later reported that detectives recovered the lost funds.

The town treasurer received an email from someone pretending to be MIG Corp., the contractor on the Herring River Restoration Project, saying MIG now required payment by wire. The treasurer did not notice the false but similar email address, and $1.1 million was wired to a fraudulent account on July 5, 2023.

The fraud was found two days later and the banks froze the transfer before it was credited, so the town recovered the funds. The town no longer allows electronic payments to vendors.

Fraudsters got into the email accounts of a construction company working for the City of Greater Sudbury. When the city emailed to check, that email was intercepted by the impostors. On December 21 the city was tricked into transferring more than $1.5 million.

The city went to court to have the money traced and frozen, and Sudbury police opened an investigation.

An email appearing to come from PF Moon, which serviced the city’s water treatment facilities, requested an account change. Finance staff updated the banking information and sent $581,180.51 on June 21 and $221,318.78 on June 26, 2019.

The city later found the email address was not the correct one. The FBI investigated; the money had not been recovered as of the report.

The City of Ocala was swindled out of $742,000 in a business email compromise scam.

A fraudster registered a lookalike domain for Banlin Construction, a Kennewick contractor the county worked with, with the 'i' dropped from 'construction'. Over about three weeks county staff exchanged some 20 emails with a fake accountant who asked to change the banking details, and $740,000 was deposited to the fraudulent account.

About $23,000 was withdrawn before the account was frozen; the Secret Service seized the remaining $717,200.

A targeted spear phishing email fooled city employees. The attacker posed as a representative of Wright Construction Group, which was doing infrastructure work downtown, and supplied a fake bank account, and the city paid $700,000 into it.

A criminal investigation was opened. The city said no malware, ransomware or data breach was involved.

In early 2020, the city’s Finance Department received an email from someone posing as accounting staff for a construction contractor on a city project. The email asked the city to switch to electronic transfers, and two payments later went to the scammers instead of the real contractor. The city found out when the contractor said it had not been paid.

The FBI took over the investigation, and city officials said there was little chance of getting the money back.

The City of Liberty received a payment request from a lookalike email domain impersonating a legitimate vendor. Because the city owed that vendor the same amount, staff believed the request was real and wired approximately $600,000.

The receiving bank flagged the transfer as potentially fraudulent. Police are working with federal agencies, the city filed an insurance claim and strengthened its vendor payment verification.

In October 2021 fraudsters posing as a legitimate contact emailed the Port’s Diversity, Equity & Inclusion department asking that upcoming payments go to a different bank account; the email was forwarded and accounts payable sent $184,676 in three payments. About two months later a second phishing email led to $388,007 in five more payments.

The Port recovered most of the money, minus a $50,000 insurance deductible, and added financial oversight and phishing training.

Criminals impersonated a contractor using lookalike email domains, and the town lost $545,598.

The City of Dyersville’s email system was hacked. When the city asked Dubuque County about an invoice for federal American Rescue Plan Act funds, the county found it had already sent the payment, but the city never received it. Officials believe a third party orchestrated the payment.

The county reported the loss to the Dubuque County Sheriff’s Office, and the matter was under investigation.

Attackers broke into town employee email accounts and watched their messages. Using an email domain that looked genuine, they posed as a vendor on the Arlington High School building project and asked the town to switch from checks to electronic payments. Four monthly payments went to the criminals before the real vendor reported it had not been paid. The attackers also created inbox rules and deleted emails to hide their tracks.

The town’s bank recovered only $3,308, and the town filed a claim with its insurer. Local and federal law enforcement and outside cybersecurity consultants investigated.

Someone pretending to be one of the library’s legitimate vendors asked it to change the vendor’s bank payment information. The library made the change, and the next payment went to a fictitious account. State auditors said the library did not have a proper control process in place to detect fictitious vendors.

Insurance covered $350,000, the real vendor forgave the remaining $46,405.14, and $133,840.50 was later recovered from the fraudulent account and repaid to the insurer. The library added vendor verification measures to prevent future business email compromise schemes.

A staff member at a City of Hamilton municipal housing affiliate received an email that appeared to come from a known contractor, with altered banking details for a vendor payment. More than $550,000, far more than the actual invoice, was sent to an account in Surrey, B.C. The fraud came to light when the real vendor said it had not been paid.

About $417,000 was recovered after an account was frozen, leaving a loss of over $130,000 plus forensic and legal costs. A 32-year-old Surrey man was charged and turned himself in to Hamilton Police in July 2025.

City staff received a phishing email asking to change the banking information for an established city vendor. A payment of about $503,000 was processed on May 16 to a fake bank account believed to belong to the vendor. The city found out it had been defrauded on May 23.

The city reported the fraud to its bank and to Halton Regional Police, and said it put additional internal controls in place.

An accounts payable employee received an email asking to change a vendor’s direct deposit from a Frost Bank account to a Wells Fargo account. The sender was impersonating a vendor the city had done business with since 2013. The $349,000 payment went to the new account.

The police White Collar Crimes unit and the U.S. Secret Service investigated; the city said it believed it could recover the money or was covered by fraud insurance.

At the end of February scammers posing as SAMYL, the city’s cleaning contractor, emailed Palma’s treasury to say the company was closing its bank account. On 8 March the treasury paid two cleaning invoices, of €39,498.27 and €263,652.20, into the account in the email. The fraud was discovered when SAMYL asked why it had not been paid.

The city reported the fraud to the National Police the same day it was discovered and notified both banks.

In mid-July 2024 the builder on Hagenbrunn’s primary school project got an email from a supposed municipal employee asking which part-invoices were still open, and replied that about €293,000 was due. The fraudster then posed as an employee of the builder and the municipality was sent an invoice for that amount. Nearly €300,000 was transferred to an Italian account instead of the Austrian builder.

Prosecutors in Korneuburg opened an investigation for serious fraud and money laundering and identified the account holder. Who will cover the loss was still open.

Oak Bluffs was passing a state grant payment to the developers of an affordable housing project. A developer representative’s account was intercepted and fraudulent emails were substituted, and cross-checks on the banking data were skipped, so the $332,000 payment was stolen.

The town worked with the FBI and insurers to recover part of the money and asked town meeting to replace the $332,000 from its stabilization fund.

Over about six weeks in 2020, Tenino’s then-clerk-treasurer sent 20 electronic payments to recipients out of state. He said he had been tricked by a phishing email into sending the money. State auditors found he had full access to the city’s bank accounts with no oversight.

The clerk-treasurer resigned a few months later, and the Washington State Patrol turned its files over to the FBI.

A procurement officer received an email that appeared to come from an agent at a purchasing cooperative the city worked with, asking to change banking information. The email used an outdated version of the cooperative’s logo. Finance changed the details and paid more than $250,000 in outstanding invoices to the fraudulent account.

The city learned of it when the real cooperative called about unpaid invoices. The FBI was notified, and the State Auditor said recovery would likely be difficult if not impossible.

A town employee sent four transactions between August 6 and August 23, 2019, totaling $249,720 from the town’s general fund. The scheme involved the perpetrator imitating the email address of Town Manager Herb Durfee.

The criminal investigation was turned over to the U.S. Attorney’s Office, and the employee was placed on paid administrative leave.

The borough was scammed through a phony email account impersonating Youngblood Paving, its longtime paving contractor. More than $230,000 in Liquid Fuels funds was sent to an out-of-state bank in late August 2025.

The receiving bank alerted the FBI, which is investigating. The real contractor was still paid, and the borough hopes insurance will cover the loss.

In July 2018 the county received an email that appeared to be from an employee of WISE, a vendor that trains people with disabilities, asking to change the organization’s bank routing number. The county processed the change and payments that summer and fall went to the scammers.

The FBI could not find the suspects. Insurance paid $195,000, the county absorbed a $25,000 deductible, and it now calls vendors back at known numbers before approving banking changes.

Someone posing as Strawser Paving Company, an existing city vendor, sent phishing emails to the city in December 2022. One email persuaded an accounting assistant to change the company’s bank routing information, and the next day a payment went to the altered account. A required verification step was skipped.

The city filed an insurance claim and police opened a criminal investigation. The accounting assistant was placed on leave and the Finance Director was terminated.

A town vendor’s email accounts were compromised. The scammers used them to send invoices that looked legitimate but carried incorrect payment instructions, and the town paid two payments totaling $208,300.

Police and the FBI investigated, the finance director resigned, and the mayor said insurance would cover any loss.

Chile's central bank owed $205,000 to RVK, an American consulting firm that advises on sovereign fund management. Someone set up an email account in the name of the firm's real contact, changing the address only at the very end.

Real

name@rvkinc.com

Fake

name@rvkinc.co

Writing as the consultant, they asked for the payment to go somewhere else instead — to a company called JDB Investment Limited LLC, at a Wells Fargo account in New York. The bank made two transfers, $16,400 and $188,600.

The real consulting firm eventually asked why its invoice from March had not been paid, and confirmed the email account was fake and the money had never reached it. The Banco Central de Chile filed a criminal complaint with Chile's Ministerio Público and opened an internal investigation, which found no evidence of employee involvement and no other funds affected.

The Public Works Department received a phishing email asking it to update payment information for an existing vendor. Staff did not verify the change and paid $184,235 to a fraudulent bank account.

The county learned of it when the bridge contractor said it had not been paid. With its bank and Kelso police, the county recovered the money and adopted a bank account validation service.

At the end of September 2024 scammers emailed the municipality of Helmond pretending to be one of its suppliers. An invoice of €93,000 was then paid to the wrong account. The municipality discovered the fraud on 15 November, when the real supplier sent a payment reminder.

The municipality said the payment went through because of a human error, and it planned to report the fraud to police and try to recover the money through its bank.

On 9 March 2022 Vitoria-Gasteiz city hall received an email impersonating one of its suppliers. Between March and June the city made several payments, worth €89,991 in total, to the account in that email. The fraud came to light on 13 June, when the real company contacted the city.

The city said it was working on recovering part of the money.

Ottawa’s city treasurer received an email that appeared to come from the city manager, asking her to pay a supplier. After a short exchange with the sender, she approved a transfer of about US$97,800 to a scammer in the United States. A second request for a larger amount arrived days later while she was sitting beside the real city manager, who said he knew nothing about it.

The city changed its procedures so the same employee can no longer both create and approve a money transfer.

Fraudsters hacked into a supplier’s email system and used it to contact the supplier’s customers, including the council. The council made a payment before the fraud was caught. It was the first time the council had been defrauded in this way.

The council stopped further funds from going out, updated its fraud response plan, trained invoice processors, and set up a report that flags changes to supplier account details.

A criminal network copied suppliers' logos and created email accounts very similar to the real ones to tell public administrations that a supplier’s bank account had changed. Vila-seca town council lost €56,517.42 this way in May 2020.

The council detected the fraud and reported it to the Mossos d’Esquadra (Catalan police). Police said the network had targeted about 25 Catalan administrations.

A routine payment to a supplier for completed work was fraudulently redirected to unauthorized bank accounts. The village’s chief administrative officer said the breach was a hack of the supplier’s email address, not the village’s systems.

Lawyers helped recover most of the money, leaving a net loss of $44,536, which the village was advised it must bear. New internal procedures were put in place.

In 2016 a Gloucestershire County Council employee received an email that appeared to come from the council’s chief executive, using a fake address and asking for an urgent payment. The staff member transferred £18,980.54. The case came to light through a Freedom of Information request by the Stroud News & Journal.

The council recovered £9,160.38 of the money.

On 16 December 2020 the Palacio de Congresos, a body that depends on Valencia city council, received an email that claimed to come from its security contractor Securitas but was sent from a lookalike domain. It asked the centre to confirm a change of bank details. Invoice payments worth about €21,000 then went to the fake account.

Securitas reported receiving neither payment, the fake account was frozen and the National Police opened an investigation.

A hacker compromised a former town employee’s email account, intercepted an email carrying two invoices from CR Environmental for a dredge survey, and altered them with new payment instructions. Because it came from an internal email, staff wired just over $16,000 to the fraudulent account on May 5, 2025.

The select board approved $16,860 to replace the payment, and the finance director now requires phone verification for similar payments.

In December 2022 the clerk of Harlech Community Council sent two payments of £4,500 to a third party after an email exchange with someone pretending to be the council’s vice chair. The email address misspelt the vice chair’s name, and the emails were poorly written with grammatical and typographical errors.

The Auditor General for Wales said the clerk failed to properly question the instructions and pointed to poor internal controls.

Employees transferred money after getting an email saying the bank account for remittance payments had changed.

In an email spoofing scheme, a criminal posing as the chief financial officer of a legitimate vendor asked the city’s Finance Department to update the vendor’s banking information for ACH payments. Believing the request was real, staff made the change. The next payment for a legitimate invoice went to the fraudulent account.

The receiving bank flagged the transaction and the account was frozen, and the city was told any remaining funds would be recoverable after the bank’s investigation. The city said it was fully insured and has added stronger internal controls.

A gang got Rs 120 crore transferred from Dr. A. P. J. Abdul Kalam Technical University’s State Bank of India account. Police said the gang sent emails using a fake AKTU mail ID and posed as official operators with a fake authority letter and KYC form. The mastermind posed as the university’s Chief Account Officer.

Lucknow police arrested seven people and recovered Rs 119 crore, with the remaining amount still being recovered.

MacEwan University received a series of emails from what appeared to be Clark Builders, a construction firm the university had worked with for more than a decade. The messages carried the vendor's logo and asked staff to update the banking details on file. Staff made the change. Between August 10 and August 19, 2017, three payments — ranging from about $22,000 to $9.9 million — went to accounts the fraudsters controlled. The scheme relied on fake websites and targeted emails impersonating more than a dozen Edmonton-area construction companies.

The fraud came to light on August 23, when the real contractor called to ask why it had not been paid. Working with banks, lawyers in several jurisdictions and police, the university traced and froze funds in Canada and Hong Kong. By the time proceedings concluded in April 2018 it had recovered about $10.9 million — roughly 92% of what was taken. The remaining shortfall was covered from reserves.

In an email scam, criminals impersonated a trusted vendor of Dickinson Public Schools and redirected two payments. The money came from the district’s building fund.

The U.S. Attorney’s Office and the FBI seized $4,856,578.51 traced to a bank account. The funds are to be returned to the district once court proceedings are complete.

Scott County Schools lost $3.7 million after an email disguised as coming from a vendor, along with fraudulent financial documents. The district learned of it when the real vendor reported it had not been paid.

A week later the district announced it had recovered the full $3.7 million.

In early 2024 about $3.5 million in Hempstead school district funds was transferred to an account in the name of “DME Unlimited.” The district’s IT department found that the finance director’s email had been spoofed or hacked.

According to the district attorney, a California woman withdrew $338,000 of the money in cash. She was arrested in Escondido, extradited to Long Island and charged with grand larceny, and pleaded not guilty.

The district’s finance director received an email from someone posing as a representative of the learning company Pearson, sent from the lookalike domain pearson.quest instead of pearson.com. After an exchange about banking details and payment dates, the director sent two wire transfers totaling $3.36 million from state school funding.

The bank flagged the activity nearly two weeks later, after the money had been moved. About $742,000 had been recovered, and investigators traced the funds to money mule accounts.

Scammers posing as an executive of East Harding Construction, the firm building Pine Bluff High School, used a lookalike email domain. The contractor’s real messages were filtered out of the employee’s inbox, and the scammers wrote that the usual person would not be able to pick up a check. The district wired $3,204,639.55 on December 17.

The fraud was reported to the bank the next day. The district says it has recovered about $1.12 million.

In late August 2023 a routine payment from Santa Monica-Malibu Unified to a construction contractor was diverted in what the district called a carefully orchestrated online hack. Investigators found that a hacked email account belonging to the contractor, not the district, had been used. The district learned of it on August 28.

The district recovered $2,733,305 and demanded the remaining $200,206 from the compromised company. The LA County Office of Education, Santa Monica Police and the FBI were involved.

On July 12, 2021, a district employee received an email from a real GRPS account claiming to have new wiring information for paying the district’s health insurance company. The colleague named on the account said she did not write or send it. Two payments totaling $2,839,375 went to the new account.

Court documents say federal agents seized laptops, phones, documents and money in October 2021, and a California couple was accused of money laundering and wire fraud.

Manor Independent School District lost approximately $2.3 million to a phishing email scam. Three separate fraudulent transactions took place in November 2019.

Between January 12 and February 8, 2022, the Livingston Parish School Board paid $2,251,861 to fraudulent accounts after emails asked to change the electronic transfer details for two vendors on a school construction project. The superintendent said the senders used the first names of district employees in the emails. Staff did not follow the procedure of calling vendors to verify the changes.

The board learned of the fraud when a real contractor contacted it. $1,907,894 was recovered and $343,967 was not. The district now requires written and verbal verification of banking changes.

The district received a phishing email that appeared to come from a company it did business with, complete with the company’s logo. It asked the district to switch from paying by check to ACH or wire transfer to a bank in Florida. The district sent two transfers totaling about $2 million.

Investigators recovered about $813,000. The Florida account holder, a money mule, was convicted of money laundering in 2020 and sentenced to nearly five years in prison.

The district received emails asking to change the bank account information for two vendors and did not verify them. One vendor’s email had been compromised. Between March 18 and April 4, 2025, the district made four payments to the fraudulent account.

The bank caught a name mismatch on April 8, and the district recovered $1,577,530. The vendor agreed to repay the remaining $204,890 in monthly installments.

Fraudsters impersonated Appalachian State’s contractor, Rodgers Builders, using a fake domain name to redirect payments. The bank details were changed on December 2, 2016, and on December 8 the university paid about $1.96 million to the fraudulent account.

Two UK-based men were indicted on wire fraud conspiracy, money laundering conspiracy and aggravated identity theft. The university said most of the money was recovered in 2017.

The university received an email that appeared to come from the contractor building its pavilion and student recreation center. It asked the university to pay its spring invoice to a new bank account. The email was fake, and the money went to an account the contractor did not control.

Law enforcement froze the fraudulent account, where a significant amount of the money remained. The university said it was reviewing its verification procedures.

The district received a phishing email with false payment instructions, made to look like it came from a trusted vendor. A payment meant for a contractor on an ongoing construction project was sent by ACH transfer to a fraudulent account.

Nearly $700,000 has been recovered, and the district is pursuing more through its insurer. It has put new safeguards in place for wire and ACH transfers.

The district received an email that appeared to come from J.C. Orr & Son, the firm working on its high school renovation, updating the firm’s mailing address for payment. A $1,648,656.19 check was then deposited on June 22 into a bank in Indianapolis. The district learned of the problem in July when the real firm asked about its unpaid work.

The check was withdrawn and the full amount was returned to the district. State police arrested a suspect in Indiana on August 3.

Between July 2021 and January 2022 the Calcasieu Parish School Board made seven payments totaling $1,607,620 to scammers. Staff changed vendor bank account information based on seemingly valid emails and fraudulent forms, without further verification. The district realized what had happened in December 2021.

$837,771 came back through bank reversals and an audit found $789,849 still unrecovered. The board adopted a policy requiring a follow-up call to the vendor’s number on file.

An email phishing scam cost the district more than $1.3 million in December 2023.

A scammer sent an email that appeared to come from the district’s main contractor on a middle school construction project. It asked the district to switch payments from paper checks to direct deposit, and officials wired the payment to the scammer.

The district settled with the contractor for $837,500 so subcontractors could be paid. Vendors are now paid only by check, and staff complete annual fraud-prevention training.

Fraudsters allegedly posed as staff of the University of Buenos Aires treasury office. Transfer orders were first sent by email from the address tesoreria@ubatic.net.ar and then delivered on paper with forged signatures of authorised staff. Thirteen transfers totalling about 1,591 million pesos were made from the Law and Dentistry faculties' bank accounts.

A federal judge and prosecutor took up the case with multiple arrests, and the university and the bank opened internal investigations.

Someone emulated a construction vendor’s email and gave the district a fake account number. The superintendent said it looked very much like emails the district had received before from that company. The district paid $846,864.86 before the real vendor reported an unpaid invoice.

The sheriff’s office said $779,604 was recovered, but $67,260.86 remained missing and the suspect had not been identified.

Flagler County Schools had been working with a construction contractor since June 2023 on an expansion of Matanzas High School. In September a district employee received an email requesting $719,583 for the construction work, and the money was sent electronically to an account believed to belong to the contractor. About two weeks later the contractor said it had never received it.

The district reported the fraud to the Flagler County Sheriff’s Office and the FBI became involved. The sheriff said recovery was unlikely because of the delay.

A hacker gained access to a vendor’s email and requested $563,000 from the school district for an outstanding balance. In a second incident, an email from another contractor requested a change in payment method and $126,000 for services. The real vendors did not receive the payments.

The district reported both incidents to the FBI and added security measures to its vendor payment system. The City Controller, who found the losses during an annual audit, referred the matter to the Pennsylvania Attorney General.

In April, someone posing as one of the district’s vendors contacted the business office to say it had changed bank accounts and asked for a bank routing form. The superintendent said the scammers did a very elaborate job of creating an email that looked authentic. On May 22 the district paid $660,000 to the impostor, and on May 30 the real vendor called to say it had not been paid.

A Florida credit union flagged and halted the first transfer, and the district recovered close to $500,000. It filed an insurance claim for the remaining $160,000.

Wembley Multi-Academy Trust, which runs three schools in northwest London, was paying a construction company for building work. Fraudsters posing as the construction company tricked the trust into paying the wrong bank account after the supplier’s email was tampered with. Four payments totalling £385,532 were made during 2022-23.

The trust reported the fraud to the Metropolitan Police, and the investigation was ongoing when the loss was reported.

Starting in September 2018, scammers posed as a construction company employee named 'Rachel Moore,' using an email address similar to the company name. VCU sent an ACH transfer of $469,819.49 on December 20, 2018. In January 2019 the bank told VCU the transfer was fraudulent.

Most of the money could not be recovered. A UK-Nigerian man was charged with wire fraud and money laundering.

Bucks County Community College received emails, from a domain believed to be connected to a construction company it had worked with, directing payment to a different account. The college wired $407,516. The real construction company later contacted the college, which revealed the money had been diverted.

Police traced the receiving account to an elderly New Jersey man who had been coerced into giving access to it. Two New York women were charged with dealing in proceeds of unlawful activity, receiving stolen property and criminal conspiracy.

Emmanuel College in Warrnambool received an email changing bank account details that claimed to be from a local construction business. The college paid $480,000 to the new account. Police said the email came from overseas, and the money was withdrawn and sent overseas.

Police recovered only $1,200 and froze the account. The principal said the school was insured but insurance would not cover the whole amount.

The district lost $286,213 to an email scam after vendor banking information was changed without the required verification. Seven payments went out before district leadership was alerted, about three months into the payments.

The district recovered $58,339 through its bank. The employee responsible was terminated in June 2025, and vendor banking changes must now go through the chief financial officer, who may call the vendor to confirm.

A person posing as a district vendor asked staff to change the company’s direct deposit information, using a spoofed email address made to look like the vendor’s. Staff did not detect the fraud, and two payments went to the scammer: more than $93,000 in early October and nearly $176,000 in early November.

Officials said the funds are likely unrecoverable and the case remained open with the FBI. The city’s risk fund could cover the first $250,000 if the district files a claim.

The Sabine Parish School Board was the victim of an email phishing attack. As a result, $251,972 was paid to a fraudulent account instead of the intended vendor.

The board notified its insurance company and filed a claim to recover the loss.

Laois Offaly Education and Training Board was paying a construction company for work at a Tullamore school. After a genuine invoice arrived, an email posing as the construction company told the accounts department to pay a different bank account. About €178,000 was transferred, and the fraud came to light when the builder said it had not been paid.

Gardaí traced the email to the Czech Republic. Two people pleaded guilty to money laundering and received suspended sentences, and all but €1,000 was recovered.

Police said an unknown person impersonated a security vendor in a compromised email scheme. Three wire transfers totaling about $178,803.57 were sent to an unauthorized bank account in September 2024. The district found out in December 2025 when the real vendor asked about payment.

The board reported it to police on December 19, 2025, and says the vendor, not the district, bears the loss. There were no known suspects.

The university received a genuine €98,500 supplier invoice in August 2024. In September, an email asked it to change the supplier’s bank details, and the university paid into the new account without checking the details as its controls required.

The university and the supplier agreed to split the loss 50:50, leaving the university with a loss of nearly €50,000.

An email from a vendor’s compromised account asked UCF to send a payment to a new bank account. The university approved the change and sent the payment plus a $23,000 check. When the vendor replied that the change was unauthorized, a flood of spam to the university’s email system kept officials from seeing the warning for three days.

The university recovered only $2,394. The state auditor found UCF had added verification steps but still sent payments before verifying new vendor bank details.

Star Academies, which runs 24 academies, suffered a cyberattack targeting a supplier’s and the trust’s email systems. An exchange of fraudulent emails led the trust to pay £77,370 into a fraudulent bank account.

The bank froze the account and returned £38,153.18. Insurance covered the rest, and the trust says it suffered no final financial loss.

An international school in Tardeo had a contract with a UAE-based supplier. Fraudsters created an email address resembling the supplier’s and told the school not to pay the account it had on file, directing the money to a bank account in the United States instead.

After the supplier said it had received nothing, the school went to the Central Cyber police, who recovered ₹82.55 lakh for the school.

Starting in September 2025, an email account that was not the superintendent’s official district address forwarded invoices to an accounting employee and asked that they be processed. The district sent a $38,718 check on September 23, 2025, and a $28,918 check on October 23, totaling $67,636.

The district’s insurer reimbursed the loss apart from the deductible. An Ohio woman was charged with two felony counts of theft by false representation.

Hackers took over the email account of Northwest University’s chief financial officer. Detectives said they secretly monitored his emails and waited for a legitimate vendor payment to come due. When it did, they diverted the money, leaving the school out nearly $60,000.

Kirkland police said no suspects had been arrested.

While the Wall ISD superintendent was off work ill in late April 2017, the business manager received emails from his account asking her to wire district money to individuals. Three wires went out, totaling $45,472. When the superintendent returned on May 1 he said he had sent no such requests and that the emails were fake.

A fourth wire was stopped by the receiving bank’s fraud department. The district reported the fraud to the sheriff’s office.

Three fraudulent emails impersonating a vendor asked to change banking information. The district sent $41,500 to the fraudulent account.

The Ohio Auditor’s Office documented it. Insurance covered $36,500, leaving a $5,000 deductible.

Scammers sent emails that appeared to come from the Boston Public Schools technology department, asking staff to verify their information through a link. The emails looked real enough that nearly two dozen people followed the directions. Nineteen employees had their direct deposits redirected to an account in California, nearly $40,000 in all.

The City of Boston said it would reissue checks to the affected employees.

Scammers sent emails demanding urgent payment of overdue school or tuition fees to a bank account, warning of action from the school’s litigation department. The emails came from hijacked accounts of fellow students or from domains resembling official school addresses. Police reported at least 15 cases from October 14, 2025.

A primary school on the south coast was expecting an invoice for playground improvements paid for by money parents had raised. Fraudsters had hacked an email account and changed the account details on the invoice. The school paid £19,000 to the fraudsters.

A person posing as a student at a private university in Miri emailed a refund request. The university paid RM24,314 into the bank account given in the email. The real student later said he had not sent any such email.

Police opened a cheating investigation under Section 420 of the Penal Code.

A phishing email fooled a school payroll employee into changing the direct deposit details for Superintendent Elizabeth Lolli. Her $5,159 paycheck was sent to the scammer’s account.

The money was withdrawn before the district could reverse the payment.

A payroll officer at the Marion County district changed an employee’s direct deposit details after receiving an email request. Auditors found the officer did nothing to verify the request beyond receiving the email.

The Ohio Auditor of State issued a finding for recovery against the payroll officer, its first ever for public money lost to a phishing scam. The amount was repaid under audit.

More than 2,000 UC Berkeley email accounts received a message appearing to come from Chancellor Nicholas B. Dirks. It did not come from Berkeley at all — the real sender was penweltm@miamioh.edu, an account on a completely different university's domain. Attached was a PDF whose link led to a page asking for a username and password. Berkeley's Information Security Office noted one detail in its write-up:

What the header showed

To: (empty)

More than 2,000 people received the same message, and not one of them could see that anyone else had. They had all been blind-copied.

Brown University's Phish Bowl published a genuine message reported by staff. It carried a colleague's name and the opening line every finance team eventually sees: "Hello Are you available? Please I need your assistance urgently." The real sender was zachmile931@gmail.com. Gmail had already put its own banner across the top: Be careful with this message… is similar to a name in your organization, but the email address does not belong to your domain.

Federal prosecutors said an attacker got into employee email accounts and impersonated staff to get the two charities to send money.

A spoofed email that appeared to come from an investment manager led a workers’ union to transfer funds to a fraudulent account.

The DOJ later secured forfeiture of about $5.3 million tied to the scheme.

In early June 2023 a hacker broke into the email account of a commercial furniture vendor that supplied Children’s Healthcare of Atlanta. Posing as a vendor employee, the hacker changed the vendor’s bank account for payments. On June 13, 2023 the hospital system sent $5.3 million to an account belonging to a former accountant who was paid a commission to move the money.

The hospital system and the vendor spotted the fraud within days, and about $4 million was recovered. The money launderer was convicted by a jury in February 2026 and sentenced to four years in prison.

Rijksmuseum Twenthe was buying a John Constable painting from the London dealer Simon C. Dickinson Ltd. Fraudsters inserted themselves into the months-long email negotiation and sent messages appearing to come from the dealer, so the museum’s payment for the £2.4 million painting went to an account in Hong Kong. The painting arrived, but the dealer was never paid.

The museum and the dealer went to court in London, each blaming the other. It was not determined whose email was compromised, and the judge dismissed the museum’s application while allowing it to seek damages another way.

An email phishing scam fooled an employee of the American Museum of Natural History, a nonprofit. The employee believed the email instructions were authentic and made a wire transfer of $2.826 million. The museum disclosed the loss on its IRS Form 990.

The museum said it continues to seek restitution and found no malice by the employee.

A church in Brunswick, Ohio was scammed out of $1.75 million in a business email compromise.

In November 2024 the Qikiqtani Inuit Association was hit by a cyber fraud attack. An attacker breached the system of a third-party organization QIA dealt with and used that hacked email address to send QIA fraudulent banking details. QIA reported an initial loss of $2.2 million and said its own systems were not compromised.

QIA said it had recovered $2.1 million of the $2.2 million and was working to recover the rest; the RCMP arrested and charged a man with fraud over $5,000.

A phishing email compromised a small community nonprofit’s email. An employee then sent $1.55 million to someone claiming to be a client, following fraudulent payment instructions.

The fraud was reported within the hour, the funds were frozen, and the full $1.55 million was recovered.

Attackers took over the finance director’s email account and watched it for four months, setting up rules to hide legitimate emails and divert replies. They then spoofed the nonprofit’s own domain and emailed six people under the subject line “Change banking service.” Two transfers of roughly $620,000 each were sent.

With help from its cyber insurer and law enforcement, the organization recovered all of the money except $500.

Red Kite Community Housing, a tenant-led charity managing about 6,500 homes, was targeted by criminals who mimicked the domain and email details of known contacts providing services to it. They recreated an email thread so staff believed it was a genuine follow-up to an existing conversation. A two-stage check on payment changes was not completed, and the money was transferred.

The matter was passed to Action Fraud and police investigated; the Regulator of Social Housing downgraded the charity’s governance rating from G1 to G2. The charity said tenants' rents would not be affected.

Scammers stole about $1 million from the charity Save the Children in a business email compromise.

An intruder got into the email account of an employee at one of the foundation’s grantees and found login credentials for the foundation’s grants system. The intruder then changed the grantee’s bank account number, diverting a $1 million grant payment.

Police are investigating.

Thieves got into Philabundance’s computer systems through a phishing scam, blocked legitimate emails, and sent a spoofed invoice that mimicked a construction company’s bill for its new community kitchen. The food bank paid the invoice on July 7. It discovered the theft on July 24, when the real contractor asked about its payment.

Philabundance reported the theft to the FBI and Philadelphia police and strengthened its IT security and financial controls.

A financial staff member at the Boys & Girls Club of Greenwich acted on an email that appeared to come from a verified contact, asking for a wire to a known education and scholarship fund. The bank listed was not the one the fund normally used. More than $800,000 was wired, and the club found out when the fund’s money manager said the money had not arrived.

After nearly a year and about ten search warrants, Greenwich police identified a suspect. A 68-year-old Florida woman was arrested on a first-degree larceny warrant and extradited in August 2024, and a detective recovered a significant portion of the money.

During its building campaign, the church’s emails with its builder were quietly watched by a criminal. At a key billing moment, the criminal posed as the contractor and emailed fraudulent payment instructions. The message arrived on a Friday when the office was closed, and staff paid it the following Monday. The church learned of the theft only when the real builder called days later asking why its invoice was unpaid.

The FBI opened an investigation. The church moved forward and opened its new worship center in September 2024.

The Florida Baptist Convention was due to send mission money to the North American Mission Board for church planting. Staff received an email that appeared to come from the mission board, asking for the funds to go to a new account number. It did not come from the mission board, and more than $700,000 was stolen.

The convention said it had no reason to suspect employee wrongdoing, was working with federal and state investigators to recover the money, and would honor its ministry commitments from reserves.

Thieves hacked the email account of the nonprofit’s bookkeeper and inserted themselves into a long email thread. They then sent messages asking to change the wire payment instructions for a grant recipient. The payments went to the thieves.

By the time it was discovered the money was long gone and the local detective was powerless to help; the executive director later learned the Secret Service was investigating.

A church believed it was emailing with its construction contractor. Fraudsters impersonating contractor employees redirected the church’s payment.

A federal conviction followed in 2024.

Mazsihisz, Hungary’s largest Jewish federation, was renovating the Rumbach Street Synagogue. Scammers used several phone calls and emails to convince two employees to change a contractor’s bank details. A transfer of 122 million forints went to the fraudsters’ account and was withdrawn in cash.

Police investigated. An internal report said the employees were victims of outside fraud but had made errors, and the two office administrators were fired.

Blue Hills Civic Association passes state funding to partner organizations. Someone posing as a representative of one partner emailed the partner’s budget, a W-9 form and an ACH form. Relying on those documents, the association sent two wire payments, totaling $300,000, to a fraudulent bank account.

The state froze the association’s funding after it reported the loss months late, and the association laid off nearly all its staff. Hartford police are investigating and the FBI has been notified.

A nonprofit that built an affordable housing project for single-parent families in the Louisville region wired a retainage payment after an email from its general contractor gave a new bank account. The contractor’s email system had been compromised. The nonprofit kept writing to the impostor, who claimed the bank had restricted the account, and the fraud was found more than a month after the wire.

After the nonprofit’s lawyers got involved, the money was frozen within a day and nearly $300,000 was recovered.

Our Revolution, the nonprofit that grew out of Sen. Bernie Sanders’s 2016 campaign, disclosed in its tax forms that it was the victim of a Business E-Mail Compromise scam in December 2016. The scam resulted in an electronic transfer of about $242,000 to an overseas account. The money had been raised to aid the Standing Rock Sioux tribe.

The group worked with the FBI, its counsel and a cybersecurity consultant to identify the thieves and recover the funds, but those efforts were unsuccessful.

The Rockville Volunteer Fire Department had set aside $220,000 as a down payment on two new ambulances. While it was arranging the wire, someone impersonating a vendor it had been working with got into the email thread and gave false instructions with a slightly changed bank routing number. As the department’s president put it, you would have had to look very closely to see that one letter in the email string had been changed. The money went to a different bank.

Close to half of the money had been recovered, though it could take months to come back. The department was working with Montgomery County Police, the U.S. Secret Service and the FBI, and was taking donations to replace the rest.

In October and November 2021, a Waltham nonprofit affiliated with a local university was hit by a business email compromise. Messages from a known email address requested disbursements matching earlier legitimate requests, and the scammers also submitted invoices. About $126,000 was moved into shell companies and laundered.

In August 2023 two Texas men, Paul Webb and Montrail Brooks, were arrested and arraigned in Middlesex Superior Court on money laundering and receiving stolen property charges.

Staff at the National Gallery of Denmark (Statens Museum for Kunst) received an email that appeared to come from the museum’s director, Mikkel Bogh, asking for the urgent transfer of funds to an English bank account. They sent the money the next day. More requests, again apparently from the director, followed. By the end of the winter break, 805,000 kroner had gone to several overseas accounts.

A charity supporting cancer patients received an email asking to change a supplier’s bank account details, with a letter on company letterhead attached. Finance processed the change, and two invoices were paid to the new account. The real supplier noticed only when it asked why its invoices were unpaid.

The charity asked its bank to stop further payments, freeze the bogus account and retrieve any remaining funds. It also reviewed its controls and restricted bank detail changes to more senior staff.

The Tailem Bend Netball Club was paying contractors for upgrades to its courts and lighting. After a genuine invoice arrived, the club received a second email giving new bank details for the contractors. It paid $153,000 to the scammers, and only $13,000 was recovered.

The local council gave the club a $50,000 interest-free loan, a local company donated $30,000, and the club used money set aside for upgrades and fundraising to cover the rest.

In early January 2017 the McKnight Hockey Association’s treasurer received an urgent emailed request for a transfer of funds. The emails masked the real addresses of the association’s president and vice president. Believing the board had approved it, she wired the money without requiring signing authority, and almost $145,000 was released.

About $45,000 was recovered, leaving a loss of nearly $100,000. Calgary police and the bank investigated, and Hockey Calgary said several other local hockey organizations had also been targeted.

Attackers impersonated a nonprofit’s executive director, using a spoofed email domain to make their requests look genuine. About $87,000 in donor funds was lost, and 45 donors were affected. The fraud ran for about three weeks before it was discovered.

The nonprofit suffered damage to donor trust and terminated staff.

The Upwey-Tecoma Bowls Club’s green was damaged in floods in November 2022 and replaced using insurance money. In early 2023 the club paid the final instalment after acting on an email that looked legitimate, then received a request for the same payment. A hacker had got into an email account, found the genuine invoice and sent a copy with only the bank details changed.

The club was told there was no prospect of recovery and that insurance would not cover it. It launched a fundraising appeal.

Brown Road Baptist Church was ready to make the final $82,000 payment on the mortgage for its sanctuary. The treasurer called the lender, who said payment instructions would arrive by email, but the instructions that arrived were not from the lender. The church wired the money using those fake instructions. Police believe the attack likely began with someone clicking a malicious link.

Mesa police froze the account the hackers used.

Good Shepherd, a Hamilton agency that helps homeless and marginalized people, received emails from a spoof account that appeared to belong to a contractor it worked with. The emails told the charity to send outstanding payments of over $94,000 to a new bank account. Police were contacted when the charity learned the real contractor had not received the money.

Peel Regional Police arrested a 33-year-old Mississauga man and charged him with possession of property obtained by crime.

Authorities say a group used spoofed email accounts to convince representatives of a west Georgia church to send funds to a fake business account the group controlled. The scheme took more than $60,000 from the church.

Samuel Nana Opoku of Fairfax County, Virginia, faces charges including money laundering and felony theft by taking, and authorities issued warrants for others believed to be involved.

The General Council on Finance and Administration, The United Methodist Church’s finance agency, was one of several targets of a business email compromise scheme, in which a bad actor compromises email to impersonate an employee or trusted vendor. Investigators allege the agency was scammed for $29,580 in March and $39,375 in April; the agency put its total loss at $49,560. The scheme took more than $100,000 from the agency and three companies between March 2018 and August 2019.

A Jefferson County, Texas, grand jury indicted Reuben Alvarez Sr. of Beaumont on money laundering charges. The agency’s insurance reimbursed the full amount, minus a $500 deductible.

Laurel Park FC, a youth club in Lower Earley with almost 400 young players, was saving for new fencing, decking and goals. Over a few days in January, its treasurer got emails that appeared to come from the club chairman and paid what he thought were contractors doing work for the club. The emails were fake, and about £28,800 went into fraudsters’ bank accounts. Only £8.90 was recovered.

A Richmond-area charity received an email that appeared to come from a vendor it knew, saying the vendor no longer accepted checks and asking for a wire instead. The charity wired more than $30,000, then contacted the vendor, which said its email had been hacked and it did not bank where the money went.

The charity reported it quickly, and prosecutors and police froze the account before most of the money moved. It was recovered within 48 hours.

A charity’s finance director received a fraudulent email that appeared to come from the charity’s chief executive. The finance director paid £15,000 to an unknown bank account. No checks were made to confirm the message was genuine.

Hackers took over the Donegal GAA County Board treasurer’s email account. From it, they sent detailed instructions to a member of the board’s administration team ordering a transfer of £15,000 sterling to a bank account in England. The money was withdrawn within hours, and €17,400 had left the board’s account.

Gardaí investigated with Thames Valley Police, and a complaint to the Financial Services Ombudsman was under way. The board moved its email to a different provider, partly for security.

On February 18, someone used the hacked email account of St. Rose’s priest to ask the church secretary for $19,750. Believing the request came from him, she transferred the money that day to an account linked to a home in Worton, Maryland.

There were no arrests and it was unclear whether the money could be recovered. The diocese warned all parishes to check unusual requests directly with the priest or the diocese.

Whitby Wildlife Sanctuary was paying a regular supplier for materials for a new animal housing project. Fraudsters intercepted the emails mid-conversation, posed as the supplier and supplied their own bank details for the invoice. The sanctuary learned of the fraud when its bank called about a suspected fraud.

The case was referred via Action Fraud to the National Fraud Intelligence Bureau. A later report said the bank reviewed the email evidence and refunded the money; supporters also raised over £20,000.

An Australian lawn bowls club, which asked not to be named, was paying a contractor in four instalments for upgrades. Before the final payment, its bookkeeper received an email asking for the money to go to a different account from the first three, with an invoice that matched the earlier ones except for the bank details. The club paid more than $20,000, and within days worked out that its email account had been hacked.

The club reported it to police, its bank and the Australian Cyber Security Centre. The bank had not reimbursed it, and its insurer said the policy did not cover the scam.

The volunteer-run Juneau Soccer Club’s treasurer received several emails that appeared to come from the club president, asking for transfers to pay for club equipment. The sender had masked the address to look like the president’s, and the invoices did not seem out of the ordinary. Three transfers went out, about $13,734 in total.

The fraud was found fairly quickly, but the money could not be recovered. The board reported it to Juneau police, changed its policies and covered the loss from a contingency fund.

On January 5, 2018 the civic association’s treasurer received an email that appeared to come from the association’s president, asking for a wire payment. The first payment went out on January 8 and three more followed that month at the emailer’s request, $11,328 in all. About $4,000 came from a memorial dinner fund that supports neighborhood events.

Recovery was complicated because the treasurer had approved the transfers. The association switched to written checks only, and board members contributed their own money to replace the loss.

The volunteer treasurer of a Dutch foundation that organises chamber-music events received an email showing the chairman’s name, with replies set to go to a different address. It asked for an express transfer of €9,500 to a foreign account, far more than the foundation’s usual payments of a few hundred euros. The treasurer paid, noticed the reply address was different, and called the bank too late to stop it.

The board held the treasurer responsible and filed a disciplinary complaint. The Dutch accountants’ tribunal upheld it and gave him a formal warning in June 2018.

A man emailed the Seattle Hearing, Speech and Deafness Center offering a $30,000 donation, then sent a check for $39,850. The "donor" emailed that the extra $9,850 was meant for another charity and asked for it to be wired back. The charity wired the money before learning the check was fake.

Seattle police asked other targeted nonprofits to contact its fraud unit, and the charity strengthened its donor-verification procedures.

The CEO of Communities of Crocus received an email that appeared to come from the mayor, requesting payment of an invoice for a special use permit. The signature read "Mayor John Nelson" and the sender line showed "CITY OF FRANKLIN PLANNING COMMISSION WISCONSIN," but the message came from a @mail.com address, not the city’s domain. She wired the money and learned it was fake when she called the city about a receipt.

Franklin police are investigating and subpoenaed the recipients' bank records.

The volunteer-run Yangebup Progress Association was organising its Carols by Candlelight event when scammers hacked the organiser’s email. They moved the genuine supplier invoices into a hidden folder and sent back identical invoices with their own bank details. The association lost more than $5,000, about a third of its budget, and found out only after paying.

A couple buying a home in DC’s Cleveland Park neighborhood wired an initial deposit on emailed instructions, and it went through. A second email, which their lawsuit says came from a hacker, sent the $1.5 million balance to an account the hacker controlled.

They sued Federal Title and Escrow, alleging weak cybersecurity led to the hack.

Criminals intercepted the emails going back and forth between a homebuyer and their solicitor. They then set up an email account made to look like the solicitor's and sent payment instructions on headed paper — for exactly the amount the buyer was already expecting to pay. The buyer sent £640,000. The solicitor later confirmed they had never asked for it.

Most of the money was never recovered and the purchase collapsed. The Law Society published the case alongside the National Economic Crime Centre and Action Fraud, with one clear piece of advice for buyers: always call your lawyer to check before transferring money, because emails can be intercepted or diverted.

A man buying property near Cle Elum received an email that seemed to come from his title company, with instructions to wire a large payment. He sent the money. The email used the company’s name but came from a Gmail address, which he did not notice.

When he called the title company to follow up, he learned of the scam and reached his bank in time to stop the payment. Detectives believe the title company was breached through a phishing email.

Hackers got into the couple’s email account and, posing as them, wrote to their conveyancer early in the sale of their flat. A form for their signature and bank details was intercepted and returned with a forged signature and the fraudsters' own bank details. The £309,000 sale proceeds went to a TSB account the couple did not use.

They recovered some, but not all, of the money through insurers. Police were investigating.

A Stamford resident was trying to buy a home in Fairfield County when they were tricked by email into wiring more than $400,000 to a fraudulent account. Stamford police issued a warning about the scam.

A fraudster impersonated a realtor in an email to a closing agent and supplied a false payoff statement. The closing agent transferred $332,904.

Judith Hawarden was buying a home in Forest Town, Johannesburg, and had to pay the balance into the trust account of the law firm Edward Nathan Sonnenbergs (ENSafrica). The firm's banking details were sent to her as a PDF attached to an email from a secretary in its property department. The correspondence was intercepted and the account details in it were substituted for the fraudster's. The email in the chain did not come from the firm at all.

Real

ensafrica.com

Fake

ensafirca.com

On August 22, 2019, Hawarden transferred R5.5 million. It went to the fraudsters and was gone.

Hawarden sued the law firm. In January 2023 the Johannesburg High Court ordered ENSafrica to pay her R5.5 million, plus interest and extra costs as a penalty. ENSafrica appealed, and on June 10, 2024 the Supreme Court of Appeal overturned that ruling, deciding the firm had no legal duty to warn her about the risk. Hawarden did not recover her money. The appeal changed who bore the loss; it did not change how the fraud was carried out.

The couple asked their conveyancers to email the firm’s bank details rather than post them. An email appearing to come from the conveyancers arrived with a PDF of bank details, and Mr Doyle made the payment before the Easter weekend. Days later it emerged the money had been paid into a fraudulent account. The article says fraudsters may have accessed his email account and swapped the real message for a copy with their own details.

Their bank, Lloyds, said it was investigating. Mr Doyle said: "We’ve no money and no house."

Days before closing, she got an email that looked like every other one from her title company, congratulating her and telling her to wire her funds so she’d only need to come in and sign. She wired about $255,000, most of her savings, then learned she’d never been talking to the title lawyer.

Denise Hindle was buying a home when she received an email that looked legitimate, saying 'We’re ready to close. Let’s speed things up.' The sender was a criminal posing as her attorney. She wired a quarter of a million dollars.

Part of the money was recovered after a Western Union employee in Texas spotted the fraud.

Buying a house in Ireland, he went to his Lloyds branch with an email on his iPad that appeared to be from his solicitors. Two bank staff checked the details and transferred his £180,000 savings to the account in the email. Lloyds said his email account had been hacked and he had been given false account details.

He turned to the bank, the financial ombudsman, Action Fraud and the police, but said he had given up hope of being reimbursed.

Legitimate email correspondence between the couple, their solicitor and their mortgage broker was intercepted by a criminal. Their £137,500 deposit was sent to the fraudster’s account instead of the solicitor’s. A forensic analyst the couple hired found the emails had been intercepted using 'reply-to' headers.

£80,112 was recovered, but just under £60,000 remained missing. The case was transferred to Manchester police.

A hacker broke into the conveyancer’s email account, used the 'forgot password' button and intercepted the reset email. The hacker then created a new user on the conveyancer’s PEXA property-settlement account and changed the bank details to the hacker’s own, so the family’s sale money was redirected.

Funds were recovered in stages after the story aired, and PEXA agreed to repay the full stolen amount.

While buying a flat at auction, she received an email saying the solicitors' client account details had changed, and made the £137,000 final payment before going on holiday. Police said fraudsters had gained access to her email and were impersonating the solicitors to her, and her to the solicitors. One clue: the fake email had her names the wrong way round.

RBS clawed back £8,000. The Metropolitan Police arrested and bailed two women and questioned a third.

Pat and Marisa Lawlor received wire instructions in an email that appeared to come from their escrow agent, with a signature matching earlier emails. They wired their $160,000 down payment. A few days later another email said they were 'clear to close' and just needed the down payment, but the money was already gone.

The money was not recovered. They got the house only by borrowing from a family member.

Dan Kalisher was rebuilding after the Altadena fire when a scammer intercepted emails between him and his real contractor. The scammer sent a new invoice from a cloned address that differed only by a hyphen and asked for payment by wire or ACH. His fiduciary wired $150,000 from his insurance payout.

The fraud came out when the real contractor asked when the invoice would be paid. County supervisors directed staff to develop tighter protections against contractor fraud.

The buyer received an email that appeared to come from his attorney, with wiring instructions needed to close on a real estate purchase. He wired about $142,834.80 to an account controlled by a co-conspirator. Investigators later seized $18,500 of the money as a cashier’s check issued in a fictitious name.

A federal judge entered a final forfeiture judgment on the $18,500 on September 28, 2023, and the money is being returned to the victim.

Attackers hacked the mail server of the Consumers Association of Singapore and sent phishing emails to consumers. A man who had filed a dispute with the association clicked a live chat icon in one of the emails, and criminals used his details to get his banking credentials. He lost about S$149,000 within minutes.

He was one of at least 10 victims of the phishing emails, with total losses of at least S$225,000.

While the couple were buying a house, fraudsters hacked and monitored the email exchanges between them and their solicitor. Believing they were paying their solicitor, the couple transferred £80,500 through their Halifax banking app.

Halifax first offered to refund only half because the couple had ignored an in-app warning; after Which? asked it to look again, it refunded the full amount.

An email from her solicitor’s office told the single mother to pay £76,959 into a Danske account to complete her house purchase. A few hours later a second email said the earlier details were incorrect and asked for payment to a Barclays account. She sent the money to the second account, which was fraudulent.

Both banks said the money could not be retrieved. The PSNI referred the case to Action Fraud.

A couple got a legitimate email with closing instructions, then a spoofed email directing their funds to a different bank account.

Federal authorities recovered about $95,325.

The husband received a payment request with bank details from someone he believed was the settlement agent. The address was almost the same as the agent’s, except one letter had been added and the .au removed. He made three payments totalling $110,000, then a further $22,981.40 described as stamp duty. The scam surfaced when a demand for $480,000 more was forwarded to their mortgage broker.

The bank could not recover the funds and the couple had to withdraw from the purchase. Consumer Protection WA said it was investigating whether the agents involved had met their obligations.

A Tasmanian homeowner renovating her property was corresponding with a construction company when scammers intercepted the email thread. They wrote to her from a spoofed address that closely mimicked the legitimate business, telling her the company had updated its banking details. The invoice they attached was an exact replica of the real one — every line the same, except the payment details, which now pointed to the scammers' account. She paid AUD 120,000.

Because the fraud was reported late, the money was not recovered. The Australian Federal Police published the case in a warning about criminals targeting the construction sector, where large scheduled payments between homeowners, builders and suppliers make an altered invoice unremarkable.

A homebuyer outside Denver received an email that appeared to come from his title company. It included his exact closing amount and wiring instructions asking him to send the funds early, and he wired just under $80,000, his life savings. Two days later the title company learned the money had never arrived.

A funds recovery team working with the U.S. Secret Service located and froze the receiving account, and the money was returned to his bank within a week.

A few days before she was due to exchange on her new home, she received an email that appeared to come from her solicitors and was branded in their style. It said the firm had changed its bank details. She sent her deposit, her life savings, to the new account, and by the time she checked, the money had already been withdrawn.

The newlywed couple received an email asking them to transfer their house deposit. A few days later a second email, claiming to be from their conveyancers, said the firm’s accounts were changing due to an audit. They transferred the £45,000 to the new account. When they checked with the firm, it said the money had not arrived and the second email was not from them.

Barclays' fraud team recovered £22,000; the rest of the deposit was lost.

First-time buyers Cemal and Derya Biryol received an email that looked like it came from their closing attorney. It listed their insurance details and the exact amount due, with wiring instructions attached. Cemal wired $53,194.48, which went to an account that was receiving other fraudulent wires.

Their bank froze the funds and the couple got their money back about two weeks later, but their closing was delayed.

Brian and Sandie Bridges emailed their real estate agent asking for wiring instructions for their down payment. The agent forwarded instructions she believed came from the title company, but they had come through a hacked account using a spoofed address. The couple wired $46,000 to the wrong account.

The couple sued the agent and her brokerage, saying she never called to confirm the instructions. The case was still in litigation when the story was published.

Jenna Carlson had saved for years to buy her first home. She was putting 20% down — $42,000. She had exchanged 16 emails with her real estate attorney's paralegal, asking clarifying questions before the wire. One of those emails contained the wiring instructions. She went to the bank and sent the money. The next day, the real paralegal called asking about the down payment. Carlson said she'd already wired it. The paralegal replied: "What email? I didn't send any email." The sender's address was nearly identical to the paralegal's — just two extra letters added.

Chase Bank was able to stop $9,000 of the wire. The other $33,000 was gone. "It was fraud and I'd been scammed," Carlson said. "Everything I'd saved was gone in the blink of an eye. And I couldn't do anything about it." She went through months of therapy to cope with the loss. FBI Special Agent Siobhan Johnson, quoted in the ABC7 story, said real estate wire fraud is one of the fastest-growing cyber scams in the country.

Two days before closing on a beachfront condo, Bill Bowers received an email he believed was from his title company, using its letterhead and staff photos. The sender asked him to wire the money instead of bringing a cashier’s check. He wired $40,000, and the scammers then sent friendly follow-up emails about his closing date.

He reported it to police but had not received any money back when the story aired, and had to draw more from his savings to keep the house.

Three days before closing, first-time buyer Manish Sharma received an email that appeared to come from his title company, with wiring instructions for his down payment and closing costs. The sender was using a new address that resembled a real title agent’s. He wired more than $40,000, and the title company never received it.

The receiving bank recovered about 60% of the money; the rest was still lost.

An Alpharetta woman received an email saying her PayPal and credit union accounts had been used for nearly $10,000 in fraudulent charges. Scammers posing as security staff at PayPal and Georgia’s Own Credit Union told her to move all her funds into a new account. She sent $40,000 through a Bitcoin ATM to an account they provided.

She learned it was a scam when she visited her bank. No suspects had been identified.

Fraudsters hacked the buyer’s own email and impersonated the title company for weeks. The couple wired a $38,000 down payment.

They found out on the way to pick up their keys, when the real title company called to say the wire never arrived.

First-time homebuyer Jaime Leeper received emails that looked like they came from her loan officer and realtor. The scammers had changed the domain in the addresses but kept the rest of the email chain intact. She wired more than $36,000 for her down payment and closing costs to the scammers' account.

She found out at her final walkthrough and had to use other savings to cover the down payment.

Days before closing, Drew LeMay and his wife were added to what looked like a real email exchange between their lender and First American Title about closing costs. A hacker had copied the exchange and was posing as the lender or title company from an address a few letters off the real one. The couple’s financial advisor forwarded the email chain to arrange the wire, and more than $30,000 was sent.

The money was not recovered, and their insurance claims were denied. They used other savings to close on the home.

After visiting their solicitor, the couple were told the bank details for their Bristol house deposit would be emailed later that day. An email that appeared identical to the solicitor’s others, and even mentioned their visit, arrived about an hour later, and they transferred £22,000. A second email the next day asked for the full amount; they noticed the solicitor’s name was misspelt and found the details were false.

First-time buyer Ryan Winters received emailed wiring instructions that used his title company’s name and logo and his escrow officer’s name and photo. The display name looked right, but the actual address was different. He wired more than $28,600, and a later email thanked him for the wire.

His realtor warned him shortly afterward, but he could not stop the transfer. He reported it to the Harris County Sheriff’s Office and the FBI.

Alexia paid a $50,000 real estate bill through internet banking. Scammers had hacked into her email and substituted a different bank account number on the invoice, so the payment went to them.

The receiving bank froze the account and returned $36,500, but $13,500 was lost. The Banking Ombudsman found her bank was not responsible for the loss, and she accepted $2,000 for its poor communication.

Ben Lerner and his wife were buying a condo in Florida when, in the week of closing, they received an email from what they thought was their attorney. A first wire was returned, and a second email asked for another wire, which went through. The attorney later said a criminal had spoofed the firm’s email.

The couple did not get the money back.

Scammers impersonated her lawyers by email and told her to send her first-home deposit to an intermediary account. The real emails had 'purchase' in the subject line and the fake ones did not, and the sender was a free Outlook address with the firm’s name moved in front of the @ sign. The scammers knew her lot number and what stage her finances were at.

Her bank traced the recipient and the money was returned about six weeks later. Police said the fraud was committed offshore, so no arrest could be made.

Serenity Isom, 20, and her partner received an email telling them to wire their closing costs. It had all the right details, including the closing date, but the sender’s address had been forged by adding 'gmail'. They wired $12,000, all the money they had, and a man withdrew $9,000 of it at a Florida bank branch.

Police could not make an arrest, and the couple did not expect to recover the money.

Near the end of her home purchase, Toni Powell received an email that appeared to come from her title company, complete with her title agent’s photo. It told her to wire $7,542.47 before noon that day, and the sender knew details of her move, closing, and down payment. She learned the email was fake only when she arrived at closing and the title company said it had not sent it.

Her title company and bank told her the money could not be recovered because she had sent it voluntarily.

A member received an invoice by email and paid it, but the money went to a scammer’s account rather than the company’s. Weeks later the company said it had not been paid. Investigators found the original email had been intercepted and the bank details changed to the scammer’s.

Helene Brotman received an email saying she had been charged for a two-year, $500 protection plan, with a phone number to call. When she called to dispute it, the caller took remote control of her computer. Scammers took $3,500 before she regained control.

Her bank refunded $1,500, so she still lost $2,000. She filed a complaint with the FBI’s Internet Crime Complaint Center.

Researchers documented a wave of emails with blank bodies and a PDF attached. Open the PDF and you find an invoice for a few hundred dollars from a brand you recognize — McAfee, PayPal, Geek Squad — for something you never bought, plus a phone number to call and sort it out. Some also carried QR codes. The number does not reach the company. It reaches the criminals, who then talk the caller into handing over information or installing software that gives them access to the computer.

Attackers registered a Google Workspace trial and a malicious app, then used Google's own notification system to carry their message. The result genuinely came from Google's own systems and was genuinely sent by Google — there was nothing fake about the sender at all. The text inside claimed Google had received a subpoena to release the contents of the recipient's account, with a link to read more. That link went to a fake Google Support page built on sites.google.com, Google's free site-building service.

Google's Threat Analysis Group documented the Iran-linked group APT42 running phishing built out of borrowed credibility. The attackers wrote under the names of real researchers and journalists, using web addresses like understandingthewar.org and brookings.email — close enough to well-known organizations to feel real at a glance. They often sent a genuinely harmless PDF first to establish trust, then moved targets on to phishing pages and redirects hosted on Google Sites, Google Drive, Dropbox and OneDrive, sometimes via link shorteners, ending at fake Gmail, Outlook and Yahoo sign-in pages. Google says it disrupted the group's abuse of Google Sites across more than 50 similar campaigns in six months.

Within weeks of the .zip domain ending going on sale, Netcraft found criminals already using it. Live phishing sites included microsoft-office365.zip and microsoft-office.zip aimed at Microsoft users, e-mails.zip aimed at Google users, and login.payment-statement.zip aimed at Okta users. The point is the confusion: ".zip" is something almost everyone recognizes as a file, so an address like that reads as an attachment you were expecting rather than a website you have never visited.

Check Point tracked a campaign that changed the hidden sender information on its messages, so an invitation looked like Google Calendar had sent it for someone the recipient actually knew — the kind of line that reads “Google Calendar on behalf of John Smith.” Around 300 brands were impersonated across more than 4,000 emails in four weeks. The invitations first carried malicious calendar files; when security tools began catching those, the attackers switched to links pointing at Google Drawings and Google Forms instead, so the whole chain stayed inside services people already trust.

The Loudoun County Sheriff's Office warned residents about scammers answering online listings from temporary email services — naming Dispostable, GetAirMail, 10MinuteMail, GuerrillaMail, Mailinator and 33Mail. The scam itself was the classic overpayment: the "buyer" sends a check for more than the asking price, asks the seller to wire back the difference, and the check turns out to be worthless days after the money has gone. By then the address that arranged it has expired.

Robert Brown, a 78-year-old retired geologist from Little Elm, received an email claiming his bank account had been hacked. It told him to withdraw his money, convert it to gold or cryptocurrency, and give it to a courier for safekeeping. He lost more than $2 million, his retirement savings.

Brown died without recovering the money. Authorities raided two North Texas jewelry stores linked to the gold bar scheme, and federal authorities said they shut down three call centers in India.

A senior closing on a property got a compromised email from the “title company” with wire instructions for over $1.3 million to a fraudulent account.

The FBI froze the receiving account and found wires from other victims in it.

Leila Meltzer, 75, was buying an apartment at 205 West End Avenue. Hackers posing as her real estate attorney emailed that closing was set and 'funds need to be with us today or latest tomorrow.' She wired $764,100 to an account controlled by the hackers in Georgia.

Meltzer sued the attorney for legal malpractice and breach of contract; the attorney’s lawyer called the claims unfounded.

A 74-year-old Whitehall Township man was targeted in a lengthy scam that began with an email about an allegedly fraudulent charge on his PayPal account. He was told he would be responsible and had to repay PayPal at a gas station Bitcoin kiosk. Using money withdrawn from his IRA, he bought more than 200 gold bars worth almost $600,000, and also lost about $91,000 in cash.

A 25-year-old New Jersey man pleaded guilty and was sentenced to state prison, followed by probation, and ordered to pay $688,372 in restitution to the victim.

The NSW Fair Trading Minister, urging seniors to stay alert, cited a case where a consumer lost $760,000 after their mortgage broker’s email was compromised.

Nancy Pun, 102, had an aged care deposit meant to pay for the rest of her care. The email didn’t go to Nancy. Scammers emailed her granddaughter, who holds power of attorney, posing as an employee of the aged care home and giving fake bank details.

The family couldn’t bring themselves to tell her.

A Hickman couple, both over 80, received a fraudulent email saying an Amazon package had been delivered to the wrong address. Scammers then posed as federal officers and took payments by Bitcoin, Western Union and Apple gift cards. In total they lost $250,000, including $50,000 taken from their accounts.

The Lancaster County Sheriff’s Office said recovery is very unlikely because the scam was reported about seven weeks after the last payment.

Brian Oliver received an email claiming PayPal owed him $450. He called the phone number in the email. The scammer walked him through a fake "typo" that appeared to deposit $10,000 into his Bank of America account — except the bank website he was looking at was a mirrored fake. Over the next three days, Oliver fed $10,000 in cash into a crypto ATM and handed $198,560 in gold coins to a courier driving a black Mustang. The password at the door was "blue."

Gainesville Police set up a sting operation. One courier, Seth Wayne, received 18 years in federal prison. A second courier, Atharva Shailesh Sathawane, was convicted of conspiracy and money laundering tied to over 30 transactions and nearly $8 million stolen from elderly victims.

It started with a click on a link in an email. The scam included a fake $40,000 “accidental refund.” The couple said their entire retirement savings were gone.

The FBI got involved.

An elderly Muddy Creek Township man got an email from what he believed was PayPal, with a phone number that he called. He was told to withdraw cash and put it into a bitcoin machine at a GetGo. Later he was told a 'federal agent' would come to his house to pick up more cash.

State troopers set up a sting at the home and arrested the man who came to collect another $80,000.

A 75-year-old Murfreesboro man was contacted by email by someone posing as McAfee Services. Over several days he was pressed to wire money for supposed payments and penalties, sending $138,000 in total.

Ross Fulton, retired after 46 years as a pastor, and his wife Melinda were paying $130,000 in cash for a home in Independence, Missouri. A scammer posing as their real estate agent emailed that 'all funds needed for closing' must be sent by wire transfer. They wired the money to an account they believed belonged to the title company and learned of the fraud on closing day.

Their attorney said recovery is unlikely; the couple moved in with a daughter.

A 64-year-old man buying a property in Florida had been in genuine email contact with the title agency handling the sale. A scammer using an email address nearly identical to the agency’s sent wiring instructions, and he wired $115,214.67 for what he believed were closing costs. He reported it to Salisbury Township Police on March 16.

The receiving account had no connection to the title agency and had already been frozen by Texas authorities. A search warrant approved by the Lehigh County District Attorney’s office led to the full amount being returned.

Elderly victims in Auckland received fraudulent emails that appeared to come from their bank and asked them to phone the bank. The number in the email was fictitious and connected to the scammers. Three victims were identified, and together they lost more than $200,000.

Police arrested a 20-year-old man at a New Lynn property after about a month of investigation. He was due in Waitākere District Court.

A 65-year-old man received an email that appeared to come from a well-known comparison portal offering investment advice. He was told to open an account with an online bank, and after a supposed identity check a second email gave him the banking details. He transferred €100,000 to the account he was given.

When his login failed, he called the bank, which said no account had been opened and the details did not exist there. Police described the email as phishing.

A 75-year-old Jackson Township woman told State Police she lost $98,577 to scammers posing as Best Buy’s Geek Squad. The scam began with a fake email. The scammers also got access to her home computer and were controlling it remotely.

Pennsylvania State Police are investigating.

She got an email about a subscription she never ordered and clicked the link to cancel. A man called offering a refund, got access to her computer, then claimed he’d refunded $49,000 too much and needed it paid back.

Police arrested two men when they came to her home to collect cash.

In early July a 61-year-old woman received an email that claimed to be from her Sparkasse savings bank. A phone call followed from a man claiming to work for the bank. The criminals took about €66,000 from her.

Robert Banzin, an 85-year-old retired Catholic priest, received an email that appeared to come from PayPal saying someone had bought something on eBay through his account. He searched online for a PayPal number, called it, and reached scammers posing as PayPal investigators. They persuaded him to withdraw just over $61,000 from his savings.