U.S. Attorney’s Office Seizes Approximately $3.5 Million Dollars Associated with Business Email Compromise Scam

Vanessa R. Avery, United States Attorney for the District of Connecticut, and Michael J. Krol, Special Agent in Charge of Homeland Security Investigations (HSI), New England, today announced that the U.S. Attorney's Office has seized approximately $3,507,191 in funds stolen through a business email compromise scam.

A business email compromise scam ("BEC scam"), which usually involves email spoofing, involves the creation of email messages with a deceptive sender display name. When a bad actor engages in an email spoofing attack, the bad actor sends an email header that displays an inaccurate sender address, which can deceive the receiver unless the receiver inspects the header closely. This inaccurate sender address is usually someone the receiver knows or trusts, so the receiver might open malicious links or engage in risky behavior that the receiver would otherwise not engage in. In this case, the bad actors impersonated one of the parties to the real transactions and replaced the intended beneficiary account with their own prior to payment. By changing the intended beneficiary account, the bad actors commit a BEC scam.

According to a complaint (3:24-cv-1822), which was filed yesterday in U.S. District Court, in July 2024, HSI and Westport Police began investigating a BEC scam that victimized a Connecticut business. The investigation revealed that the business had received an email from a spoofed email address, which was very similar to a general contractor's legitimate email address, with instructions for a payment that was to be made to the general contractor. In May and June 2024, the Connecticut business sent approximately $5.4 million to the bank account as instructed.

The company promptly reported the business email compromise to Westport Police, and HSI successfully traced the stolen money to nine separate bank accounts, which were seized by the government. With the filing of the forfeiture complaint, the U.S. Attorney's Office will seek to forfeit the proceeds of the crime and, should it be successful, work with the Department of Justice's Money Laundering and Asset Recovery Section to return the money to the victim company.

"These cases demonstrate the U.S. Attorney's Office's commitment to helping victims of crime," said U.S. Attorney Avery. "Working with our law enforcement partners, we will continue to pursue criminal prosecution of the individuals responsible for these crimes, but using civil asset forfeiture, we can expeditiously recover as much stolen money as possible and return this money to victims prior to criminal convictions. Although it can be difficult to come forward and admit that you were a victim of a crime, we stand ready to help you to the fullest extent possible."

"Business email compromise scams are sophisticated and difficult to detect, resulting in major losses for businesses," said HSI New England Special Agent in Charge Krol. "It is essential that businesses that have been victimized by scammers reach out to law enforcement immediately for the best chance to recover their lost funds. Today's results are a best-case scenario because of the quick action of the business and the dedication of law enforcement working together to track the money, freeze accounts, and get the business their money back. HSI is using innovative investigative methods to pursue business email compromise cases to get victims their money back and gather evidence to bring scammers to justice."

To avoid becoming the victim of a BEC scam, verify email addresses are accurate when checking mail on a cellphone or other mobile device before you open any attachments or follow any instructions and never make any payment changes without verifying with the intended recipient by phone or in person. If you think you have been a victim of a BEC scam, immediately contact your bank to request a recall or reversal as well as a Hold Harmless Letter or Letter of Indemnity and contact local law enforcement. Additionally, file a detailed complaint with the Internet Crime Complaint Center at www.ic3.gov. The Internet Crime Complaint Center is run by the FBI and serves as the country's hub for reporting cybercrime. Visit www.ic3.gov for updated information regarding BEC trends as well as other cyber fraud schemes.

This case is being prosecuted by Assistant U.S. Attorney David C. Nelson.