A Phish Tale

I know. I was a dummy.

Turns out there are lots of dummies out there. Primed to be scammed.

I was a dummy because I didn’t look more closely at the above message. I was racing through my emails. I began drafting a forwarding in-house message to redirect payments.

Fortunately I didn’t press send. Didn’t even finish drafting the email. Because it hit me: I’ve worked with staff reporter Maya McFadden at the Independent for over four years. Never once has she signed an email message to me ​“Regards, Maya McFadden.” Or even ​“Maya McFadden.”

Nor, come to think of it, does she hope that her emails ​“meet me well.”

I checked the email address. Hadn’t checked it before. forward4ever? Hmmm. That sounded fishy even to me. I looked up ​“tutanota.com”: an encrypted email address.

So that’s how they do it. At least sometimes.

Another thought hit me: Someone who works for the board of ed similarly didn’t pay close enough attention when they received a variant of this email. That’s how hackers impersonating the district’s COO stole $5.9 million meant to pay the school bus company.

Wow! I called the FBI’s top Connecticut official with a scoop: Those guys hit me, too! I figured this was a big deal.

It is a big deal, I learned. But nothing new. Loads of these scammers are hitting people in Connecticut with these emails each day. Their numbers increase every year. And plenty are getting through.

Connecticut’s FBI has a cybercrime task force spending lots of time on these scams. They’re called ​“business email compromise cases.”

“There are whole call centers overseas with hundreds of people doing this all day every day. Companies and private citizens big and small are being hit. I don’t think any company is too small,” FBI Connecticut Asst. Special Agent in Charge Mike Butsch told me.

Just last year state residents lost $120 million to these kinds of online scams, according to cases the feds documented. Butsch said they believe reported cases represent only 10 percent of the actual crimes — meaning cyberscammers would have made off with $1.2 billion last year from Connecticut victims alone. 

The scam centers are often based in African and Asian nations, he said. The scammers research details about employees and supervisors of even small organizations like ours. Sometimes they trick people into clicking on malware that gives them access to internal corporate emails, as in the case of the board of ed. Sometimes as in our case they seek to have money routed to other bank accounts.

In the 2023 New Haven school board theft, scammers were able to ​“compromise” a board of ed manager’s email account, according to the U.S. Attorney’s Office. They then created a fake email account that mirrored First Student bus company’s. It used the compromised account to have contract payments meant for the real First Student sent to the fake First Student account. They changed the real company’s payment information to a newly created fake account’s payment information to receive the money.

Often the scammers are able to cover their tracks and get away with it. The FBI and U.S. Attorney have made progress on the June 2023 New Haven school board theft: U.S. Attorney Vanessa Avery reported in November that agents have so far traced and recovered more than $4.7 million of the lost money. The investigation is continuing.

They’ve had other successes too. They convinced a federal judge in 2019 to sentence a convicted Nigerian citizen named Stanley Hugochukwi Nwoke (aka Stanley Banks, Hugo Banks, Banky, and Jose Calderon) to three years in prison for his involvement in a scam targeting hundreds ​“if not thousands” of businesses, nonprofits and schools with this technique. In one case, posing as the CEO of a Torrington company, an associate of Nwoke convinced the controller to transfer more than $1 million to fake accounts he set up in Virginia, Florida, D.C., and Hong Kong. A year earlier a federal judge in Connecticut sentenced a Nigerian man named Daniel Adkunle Ojo to 32 months in prison for an email hack of Glasonbury’s school system. He tricked an employee to forward W‑2 tax forms for 1,600 school system employees; based on that info, Ojo filed fraudulent tax returns that netted him him $36,926 in ​“refunds” he deposited into different bank accounts.

While hustling to catch some of the scammers, the FBI is working to get out the word to prevent the thefts in the first place. It’s preparing public service ads with tips, Butsch said. He offered some advice to remember in order to avoid becoming a victim when opening your email:

• Be wary of any unexpected contacts.

• Be wary of stated sense of urgencies, like threats or dire pleas for money.

• Be wary of requests for secrecy, like not reaching out to anyone else for help.

If you do get scammed, Butsh said, please contact the FBI immediately through this website. That makes it easier for the feds to recoup the money, especially within the first day. And it helps them keep track of the true extent of the problem. 

I was relieved not to have fallen prey to the ersatz well-met ​“Maya McFadden” and had to refer another case to the FBI. Relieved, but also embarrassed about having been such a dummy when I first opened the scam email.

“You caught it,” Special Agent Butsch reassured me. ​“A lot of people don’t. Good job.”