We’ve all probably seen those sketchy-looking phishing emails from scammers. You know the ones that say something like ‘your account has been hacked’ or ‘you’ve got a UPS shipping notification’ or whatever and then it asks you to click on a link. Hopefully, you haven’t fallen for it. Well, the town of Surfside Beach in South Carolina did fall for it recently, sending about half a million dollars to a fraudulent account instead of the Gastonia contractor it was meant for. Reporter Scott Calvert wrote about it for The Wall Street Journal and joined WFAE’s Marshall Terry.
Marshall Terry: The town sent about $545,000 to those fraudsters. What was the money supposed to be for?
Scott Calvert: This was supposed to be the fourth payment to Wildcat Contractors for a project burying overhead power and fiber-optic lines on Ocean Boulevard in Surfside Beach.
Terry: So what happened? How did the town fall for this and what are town officials saying?
Calvert: Well, there’s a lot that we still don’t know. On the morning of March 9, the town’s public works director traded messages with Wildcat’s CEO about the timing of that check.
Then, just 90 minutes later, an impostor posing as Wildcat’s project manager said, 'We’d like an electronic transfer instead of a check,' and that’s what the town did a few days later.
It transferred that money to a Utah bank account that wasn't Wildcat’s. Oftentimes, scammers in these cases they'll fool people with malicious software, phishing emails, or tweak digital addresses.
Once in, they can then spot legitimate email threads about invoices and other business matters. Another thing they often do is they set up flags on compromised email accounts so they can see when payment-related messages land. Again, it's not clear what happened here, and Surfside, in fact, says that a forensic analysis found no improper access to town email accounts. Wildcat has said something similar.
Here's what is clear. The scammer set up these dummy websites and email addresses, and one domain looked like Wildcat's domain, but the L in wild was changed to an I. And that was really shrewd because the scammer capitalized the second I in the email address, and a capital I looks the same as the lowercase L in standard email fonts. So it looked for all the world like “wildcat,” even though it was actually “wiidcat.”
They also created a second dummy domain. This one tacked an “s” onto “surfside” to create “surfsidesbeach.org” instead of “surfside” singular. This is called “typosquatting.” This led people both at the town and at Wildcat to communicate unwittingly with the scammer at various points.
Terry: Let’s pull back for a second. We tend to think of this happening to people and not towns and cities, where there are supposed to be some guardrails. How often does this sort of thing happen to municipalities, though?
Calvert: More often than you might think. So this type of scam is known as a “business email compromise,” and it affects big companies, small firms, institutions, municipalities — anybody who's moving large amounts of money that might be enticing to a scammer. Last year, the FBI said that reported losses nationwide hit $3 billion. About a decade ago, it was less than $1 billion, so a pretty steep increase.
Terry: So what happens now in Surfside and with the contractor? Is that money gone?
Calvert: The money is most likely long gone. Neither side realized the scam for 45 days. When these scams are discovered within 3 days, the FBI says there's a 75% success rate in recovering the funds. State law enforcement is investigating.
Meanwhile, the town says this transfer request looked legitimate. On the company side, Wildcat — they very much want this money because at the end of the day, they didn't get the $545,000 payment that they were owed. The CEO there says, ‘We didn't get scammed, the town did,’ regardless of how it actually unfolded.
She says the town made this key error because they didn't verbally confirm that change in payment method with her, even though they did try to reach her. They just never actually got hold of her. That may be the biggest lesson here, and it really applies to everybody. When in doubt, always call a known phone number and make sure that you talk to somebody.
