This is Part 1 of a two-part series. The second installment will be published on August 12, 2026.
A $545,000 wire fraud loss recently made national headlines when a South Carolina coastal town sent that amount to what it thought was a construction contractor, but it turned out to be a scammer.
The town and the contractor are now in a public dispute over who bears the loss, and the town’s insurer is conducting a forensic review. The case is a useful reminder that this type of fraud creates real exposure on both sides of a wire transfer — for the organization sending the money and for the vendor or contractor waiting to receive it — and that both sides have a role to play in preventing it. Additionally, if it does happen, the payer and the contractor need to appreciate the importance of quick cooperation.
The Scam That Fooled a Town
According to news reports, the fraud unfolded in a familiar way. A contractor’s project team and a municipal finance office were in the middle of an ordinary exchange about an upcoming payment for utility work. At some point, someone posing as the contractor’s project manager emailed the town and asked that the payment be sent electronically instead of by check. The town’s staff reviewed the request, failed to find a red flag, and authorized the transfer. Weeks later, everyone involved learned the money had gone to an account the contractor never controlled.
We are not weighing in on how the breach occurred or who should absorb the loss between the parties involved. Those are open questions still under investigation. What is clear is that both organizations came away with a real problem: the town is out $545,000, and the contractor has still not been paid for work it has already completed.
How This Type of Fraud Works
This is a business email compromise, sometimes called social engineering fraud or payment instruction fraud. Fraudsters commonly compromise or spoof an email account, monitor an ongoing transaction, and step in at the exact moment a payment is expected. They may impersonate a vendor, an executive, a customer, a law firm, or an internal finance employee, and the request often looks routine because it fits naturally into a conversation that was already happening.
A few warning signs tend to recur:
- A bank account that has suddenly changed.
- An unusual sense of urgency.
- Slight variations in an email domain.
- Poor grammar or phrasing that does not sound like the person supposedly writing it.
- A refusal to speak by phone.
- Instructions that ask you to bypass your normal payment controls.
Sophisticated attacks may show none of these signs at all, because the fraudster has gained access to a real email thread and simply inserts a fraudulent instruction into an otherwise genuine conversation. Additionally, artificial intelligence tools are being used by fraudsters to draft the fraudulent emails, which can remove the red flags of poor grammar, spelling errors or awkward phrasing. Artificial Intelligence tools are also being used to quickly identify the appropriate sender and recipient and their contact information to lend an air of legitimacy to fraudulent emails. That is part of what makes this type of fraud so difficult to catch on a quick read, whether you are the one sending the payment or the one who is supposed to receive it.
Why Wire Transfers (and even ACH Transfers) Are Especially Risky
Wire transfers are fast, often final, and difficult to reverse once the receiving bank has accepted the funds. The speed of transactions is one of the qualities that makes wire transfers useful for legitimate business, and it is exactly what fraudsters count on to carry out a scam that allows them to quickly misdirect funds. Once a fraudster’s account has the money, the money can be moved to another of the fraudster’s accounts and the receiving account can be closed almost immediately, which makes the funds very difficult, if not impossible, to trace. ACH transfers carry some of the same risk, though the settlement process can occasionally leave a slightly longer window to act. In fact, public reporting indicates the Surfside Beach payment was made by ACH, which is a useful reminder that the same verification discipline is needed whether the payment method is a wire, ACH, or another electronic funds-transfer system. Timing, more than almost anything else, determines whether a loss like this can be undone, which is why the response in the hours right after discovery matters so much.
The First 24 to 72 Hours
If your organization discovers it has sent money to a fraudulent account, or discovers that a customer says it already paid an account you never provided, the first few days matter more than anything that comes after.
On the operational side, the organization that sent the funds should contact its bank’s fraud department immediately and request a wire recall or a hold on the funds, and ask the bank to reach out to the receiving bank and any intermediary bank to freeze what remains. There is also a legal reason to move quickly. North Carolina and South Carolina versions of UCC (the Uniform Commercial Code) Article 4A allow a court, for proper cause, to restrain a recipient’s bank from releasing funds or a beneficiary from withdrawing them, but that remedy is only useful if the money has not already moved on. Thus, when critical funds are involved, it may be worth it to call legal counsel immediately and initiate the restraining order process. Also, some banks hold larger payments for a short period before final release, and that window can occasionally allow a transaction to be reversed. If you are the vendor whose identity was spoofed, it is worth alerting your own bank as well, since a fraud investigation may eventually need to trace where the funds actually went.
On the law enforcement side, report the incident promptly to federal law enforcement, including through the FBI’s Internet Crime Complaint Center (IC3). For large or recent transfers, law enforcement sometimes has channels to request that financial institutions freeze funds before they leave an account, and a police report can also matter later when pursuing an insurance claim.
On the preservation side, both organizations should hold onto every email, wire instruction, approval, call log, text message, payment record, bank confirmation, and relevant cybersecurity log. This matters because resolving who bears the loss, or negotiating a settlement between the parties, often depends on being able to show exactly how the fraud occurred, who authorized what, and whether normal controls were followed.
On the cybersecurity side, determine whether an internal email account was actually compromised, whether the attacker accessed sensitive information, and whether that triggers any notification obligations. This step matters for both the paying organization and the vendor, since either side’s systems could turn out to be the source of the compromise, and knowing which one it was often shapes everything that follows, including any dispute over who is responsible for the loss.
Also, if the compromise involved a genuine e-mail account owned by one of the innocent parties, the issue may not be limited to the missing money. The threat actor, in addition to sending fraudulent emails, may have moved around the individual’s email account or found a way into the company’s larger servers and networks. North Carolina and South Carolina breach-notification rules can come into play if the mailbox exposed personal information, financial account information, or credentials that could be used to access financial resources.
No organization can eliminate these risks entirely, but organizations that already know what to do in the first hours and days after discovering a loss like this are in a far better position than those that have to figure it out under pressure. If you would like help building an incident response plan for a scenario like this, our team is glad to talk through what would work best for you whether you normally send payments or receive them—we can advise you.
