Add Listing
    Add Listing

    No Hack Required: How Email Impersonation Led to a Six-Figure Loss

    Share This Post

    According to the Mansfield News Journal, what appears to a trusted local news source, the City of Mansfield, Ohio, is recovering from a $748,145 loss after falling victim to an email spoofing attack that tricked its finance team into redirecting a legitimate vendor payment to a fraudulent account. Described by insiders as a careless error, and refusing to share specific details, we are unsure if the scam was initiated from a lookalike domain or not.

    Fraudsters impersonated the CFO of Shook Construction, a city contractor, and requested a change to the ACH banking details on file. Believing the request to be real, city staff processed the update, resulting in a large payment sent to a fraudulent account at KeyBank in Xenia, Ohio.

    The scam was discovered days later when Park National Bank flagged the transaction as suspicious. Authorities have since frozen the account, and insurance will cover the full amount of the loss.

    Finance Director Kelly Converse called it a “careless error” and announced the implementation of new safeguards:

    • No banking changes without executive approval
    • Mandatory monthly cybersecurity training
    • Vendor re-verification protocols

    This incident underscores a crucial reality: email spoofing and impersonation attacks don’t require a single line of malicious code. They exploit trust, oversight gaps, and human assumptions, all of which can be addressed through better awareness, policy enforcement, and layered email security.

    Key Lessons for Organisations:

    • Treat vendor banking changes as high-risk, verify via multiple channels.
    • Use DMARC, SPF, and DKIM to protect domains and educate staff to spot spoofing and lookalike domains.
    • Keep vendor lists confidential and monitor for suspicious public records requests.
    • Require executive-level review for financial process changes.

    Final Word:
    Email spoofing doesn’t require a hack, just timing, trust, and public data. Human error remains the biggest attack surface.

    Stay vigilant. Verify everything. Especially when money is moving.

    Email Expert Blogs

    Subscribe To Our Newsletter

    Get updates and learn from the best

    More Email News To Explore