CABARRUS COUNTY, NC — Cabarrus County officials say more than $1.7 million is still missing after a social engineering scam diverted funds meant for high school construction.
Officials say the money was taken during a transfer of over $2.5 million intended for Branch and Associates, Inc., a Virginia-based company serving as general contractor for the construction of the new West Cabarrus High School.
Investigators say conspirators posed as representatives of the company and targeted Cabarrus County Schools and Government employees through a series of emails beginning in November 2018.
The conspirators requested a change to Branch and Associates’ vendor banking information, according to investigators, and provided “seemingly valid documentation and signed approvals” to County staff. This type of legitimate request is routine, the County says, and did not raise any red flags among employees.
Once the County unknowingly transferred the vendor payment into the scammers’ account, officials say the funds were then diverted through multiple other accounts.
The crime was not recognized until January, officials say, when Branch and Associates sent a courtesy notification of missed payment.
The County immediately contacted SunTrust bank, from which the funds were reportedly transferred, and Branch and Associates also notified Bank of America, to which the funds were transferred.
Officials say roughly $776,000 of the original $2.5 million remained in traceable accounts, which Bank of America was able to freeze.
In March, Cabarrus County paid the frozen amount to Branch and Associates. The remaining $1.7 million was paid to the company in May.
Funding for the construction project was restored on Monday, July 29th after the County’s Board of Commissioners approved the transfer of about $1.6 million to the Capitol Projects Fund.
Officials say construction on Cabarrus County Schools’ newest high school has not been impacted.
The scam remains under investigation by the Cabarrus County Sheriff’s Office and the FBI. Any future funds recovered through the investigation will be returned to Cabarrus County.
Cabarrus County has provided a detailed timeline of events and additional information about the scam, which can be found below.
About social engineering and business email compromise (BEC)
According to the Federal Bureau of Investigation (FBI), social engineering is the act of psychologically manipulating people to take action to inadvertently provide access to protected information or assets. In this case, the conspirators used business email compromise (BEC). BEC targets businesses working with foreign suppliers and/or businesses regularly performing wire transfer payments. These sophisticated scams are carried out through social engineering and/or computer intrusion techniques to conduct unauthorized fund transfers.
- January 16, 2018
- Cabarrus County sets up an electronic funds transfer account for Branch and Associates, general contractor for the West Cabarrus High School construction project.
- November 27, 2018
- Cabarrus County Schools receives and responds to a socially engineered email from an imposter posing as a representative of Branch and Associates and requesting changes to the account.
- The conspirators continue to correspond with Cabarrus County by email. County employees follow processes, including requesting a signed updated EFT form and signed bank documentation in support of the change.
- December 4, 2018
- The conspirators submit the completed form and documentation, posing as a contact at Branch and Associates.
- December 21, 2018
- The County submits the $2,504,601 payment to Branch and Associates through EFT.
- January 8, 2019
- Cabarrus County Schools receives an email and Cabarrus County receives a phone call from a valid representative of Branch and Associates inquiring about a missed payment.
- Cabarrus County contacts the Cabarrus County Sheriff’s Office, which launches an investigation into the business email compromise. The Sheriff’s Office notifies the FBI, which accepts the case.
- The County notifies SunTrust, the County’s bank, and follows their recommended protocols.
- The County works with its insurance broker, Gallagher, and files a claim with its insurance agency, AIG.
- The Cabarrus County Information Technology department initiates cybersecurity incident response and finds no breach in security.
- The County halts vendor payment setup for those who receive payment via EFT. Officials verify all vendors with any banking changes over the previous six months.
- February 6, 2019
- Debra Richardson begins a three-month process, validating existing vendor data and redesigning the County’s vendor registration and maintenance processes.
- February 12, 2019
- Bank of America recovers $754,652.05.
- February 22, 2019
- Bank of America recovers additional funds of $3,934.78 and $17,931.57.
- March 20, 2019
- The County sends $776,518.40 to Branch and Associates. The transaction is confirmed.
- May 8, 2019
- Cabarrus County receives a $75,000 insurance claim payment.
- May 22, 2019
- The County sends $1,728,082.60 to Branch and Associates. The transaction is confirmed.
- July 29, 2019
- The Board of Commissioners approves the transfer of $1,653,082.60 from a portion of the Assigned Fund Balance set aside for extraordinary circumstances to the Capital Projects Fund.
- The investigation continues.