A scammer pretending to be a construction vendor tricked the Citrus County School Board in Inverness, Florida, into sending more than $800,000 to the wrong bank account. The fraud wasn’t discovered until the real vendor called to say they hadn’t received their payment.
According to the Citrus County Sheriff’s Office, $846,864.86 was intended for a trusted vendor who was working on a construction project for the school district. However, the money was wired to a fraudster’s account after they sent a fake—but convincing—email that resembled the vendor’s usual messages.
Don’t miss
- I’m 49 years old and have nothing saved for retirement — what should I do? Don’t panic. Here are 5 of the easiest ways you can catch up (and fast)
- Gain potential quarterly income through this $1B private real estate fund — even if you’re not a millionaire. Here’s how to get started with as little as $10
- Car insurance premiums could spike 8% by the end of 2025 — thanks to tariffs on car imports and auto parts from Canada and Mexico. But here’s how 2 minutes can save you hundreds of dollars right now
“This was an email from someone pretending to be the vendor that looked exactly like what the vendor would’ve sent,” said Dr. Scott Hebert, Superintendent of Schools, in an interview with WFLA.
How the scam worked
According to the Citrus County Sheriff’s Office, the fraudster copied the vendor’s email address and made it look nearly identical to the real one. They also included a fake bank account number for payment. The scam worked because the email was so well-crafted that it didn’t raise immediate red flags.
“A malicious actor will come in and change one or two characteristics of a URL address or an email link—something that doesn’t totally appear correct,” said Detective Cutlip with the CCSO High-Tech Crimes Unit. “At first glance, if you’re having correspondence, you wouldn’t pick up all those changes.”
Once school officials realized what had happened, they immediately contacted law enforcement. The sheriff’s office worked with the U.S. Secret Service to track the money, which had already been split between two bank accounts outside of Florida.
Thanks to that quick response, investigators were able to freeze and recover about 92% of the funds—roughly $779,600. More than $67,000 was still missing, and the investigation remains ongoing.
In the wake of the scam, the Citrus County School District is implementing new safety measures. Dr. Hebert said all district employees are getting extra cybersecurity training, and new protocols are being developed to help staff detect and respond to cyber threats in the future.
“Disciplinary action will occur,” Hebert told WFLA. “Those folks that were involved… will be held accountable for not following any of the procedures that we had in place.”
Depending on the findings of an internal investigation, that discipline could range from further training to suspension or termination.
Read more: Thanks to Jeff Bezos, you can now become a landlord for as little as $100 — and no, you don’t have to deal with tenants or fix freezers. Here’s how
How to protect yourself or your business from phishing scams
This type of scam, often called business email compromise or phishing, is becoming increasingly common. To avoid falling victim to these scams, here are a few steps you can take:
Double-check email addresses
Scammers often change just one character in an email to make it look real. For example, "gadams[at]adamsconstruction.com" might become "gadams[at]adamsconstructi0n.com."
Verify payment information before you hit ‘send’
If a vendor emails new bank details or says their payment info has changed, call them using a known phone number—not one listed in the email—to confirm.
Be cautious about any last-minute changes
If someone suddenly requests changes to a scheduled payment, closing date, or account number, take extra steps to verify that the changes are legitimate. It’s always better to take a few extra minutes to verify then to fall victim to a scam.
Train your team
Make sure everyone who handles money or emails with vendors knows what phishing scams look like and how to report them. This includes following the steps listed here and knowing not to click on links or download files from unknown sources.
Contact law enforcement immediately if you suspect fraud
One reason the school board was able to get most of the money back was because they reported the scam right away. The sooner you act, the better your chances of recovering lost funds.
As this case shows, even experienced professionals can fall for a scam when the attack is sophisticated. But by staying alert and putting clear procedures in place, businesses and individuals can better protect themselves from financial fraud.
What to read next
- Want an extra $1,300,000 when you retire? Dave Ramsey says this 7-step plan ‘works every single time’ to kill debt, get rich in America — and that ‘anyone’ can do it
- Here are 5 ‘must have’ items that Americans (almost) always overpay for — and very quickly regret. How many are hurting you?
- Do you rely on your monthly Social Security check to get by? Here are 5 simple money moves for American seniors during Trump’s presidency
This article provides information only and should not be construed as advice. It is provided without warranty of any kind.
