Ozarks Technical Community College robbed of nearly $900k

Gmail's spam protection has been broken for ages. I'm keeping getting obvious spam (pills, eggplants emojis, money from prince kind of stuff) directly into my inbox. At the same time, legitimate email is going to the spam folder.

On the other hand, I’m seeing more and more legitimate stuff land in Gmail’s spam filter.

Like virtually of San Francisco Marathon’s newsletters. Sure they’re pushy and really really want you to sign up for more races and I definitely need to unsubscribe … but I did subscribe and that means it isn’t spam.

Its just different people disrupting the spam space.

Someone looked at the operational assumptions of “lets target gullible people by using stupid obviously fraudulent scenarios so that we can weed out everyone who wont play along” and noticed it is missing a very large target market unnecessarily.

Like it or not, this is the price of "privacy". Being able to easily pretend to be anyone, in the absence of an overarching identity framework -- and leaving identity recognition to the end user -- makes cybercrime a lot easier than it has to be.

I hate to say it but a lot of "accounting depts" these days are someone with no formal training who just took on the role as another hat on top of other hats as the more experienced folks retired or moved on to greener pastures. There's a shortage of accounting folks in general as well.

Google and Facebook got bilked out of $100M, and you would guess they had lots of processes and technology in place. https://www.npr.org/2019/03/25/706715377/man-pleads-guilty-t...

The article just says it was a "cyber fraud incident" which is pretty vague. It may not have been a bill at all.

Going to go out on a limb and guess it wasn’t one invoice.

I read that more as someone called the school and said something like: “hi, I’m calling from vendor X you usually pay into our bank account ABC, but due to some reason, we’ve needed to close that account. Can you please update that account to DEF and make all future payments there?”

There are more and more reports of serious phishing attempts that do not rely on mere fake emails, but involve criminals breaking into a business' infrastructure, observing mail (and sometimes even call) flow for a while (this can take months!) and waiting for an opportune moment to strike. They'll use the real company's infrastructure to send an invoice or email in the middle of an existing project that goes unnoticed for long enough to hit several clients. By the time the client and the hacked company start arguing about who paid what bill when into what account, the criminals are already out and moving on to their next target.

Not many people are prepared for these attacks. All the standard checks for phishing scams (sender, subject, language used, information repeated, technical measures like SPF and DKIM) pass with flying colours. You need to be wary of every single email from legitimate contacts to protect yourself from such a threat.

Such hacks target businesses (because huge b2b transactions are common enough) but also wealthy individuals contracting companies. Anyone capable of wiring out a sum of money large enough to make months of work for the (probably third world) salaries of the people involved in the operation worth it can be a target.

There are plenty of people who will fall for your old "we're the IRS, pay us Google Play gift cards" scam and even a fake invoice from an unknown company sometimes gets paid by a billing department that doesn't care about their jobs, but not every scam victim fell for some comically obvious scam. In the real world, real companies don't stick to best practices ("hi we're your bank. No you can't call us back to verify") and as long as legitimate companies send weird bills or make weird payment requests, scammers will find ways to mislead people.

They pretended to be the vendor and probably got the college to "update" vendor payment info to the fraudster's controlled account's details.

Is there some reason to think that these things will be effected?

I read that as "yeah keep coming to class, everyone will get paid, the lights will be on".

I don't see why that wouldn't be true.

I would assume they can say this due to having insurance coverage.

If you have been harmed by the statement of the college, the legal recourse would be to sue them and bring evidence of the actual harm.

Thanks for the link.

The scammers typically recruit fall guys to open accounts to receive the funds by offering them some small portion of the take. Along with a story about it being a favor , like "I'm from outside the country and don't have a bank account to receive my recent inheritance, etc".

With perhaps some intermediate transfers to other fall guys if it's a large amount.

The funds are withdrawn in sub $10k chunks by the fall guys in cash as they arrive and the larger portion handed over to the scammer.

EFTs are reversible but have much lower limits. To move this much money they probably used a bank wire. This can be reversible if you catch it in time. But wires happen so fast the thieves will surely transfer the money elsewhere before the originator even finds out.

They can undo. But if there's some Marty Byrde on the other side, there are ways of making the txn durable, not subject to undo.

This used to be the case before "they" thought having personalized ads would drive up interest.

I can confirm that, based upon google research, the "Ozark Technical Community College" is in the Ozark Mountains of Missouri and Arkansas. More or less.

Right but when there is a victim its because someone did an illegal or victim creating action.

We don't blame the victim for the success rate of the perpetrator, because it was still up to the perpetrator to do the action to create the victim.

I’m curious about the details here, like if they swapped out wire details in the system or made a whole bank account in the vendors name etc

okay? I'm not aware of anyone who thought crypto solved fraud in the first place.

Fake invoice scams have been around for a long time.

Right but usually people argue banks prevent this sort of thing and that's one of the main downsides to crypto. It turns out banks don't.

For websites with specifically-American audiences, it can often be easier to only allow people from their intended readership access than to correctly understand and implement compliance to a foreign law. In this case, it's a local news website.