'Those folks that were involved… will be held accountable:' A scammer stole $800K from a Florida school board by faking a vendor email. Here's how to avoid the same trap

How the scam worked

According to the Citrus County Sheriff’s Office, the fraudster copied the vendor’s email address and made it look nearly identical to the real one. They also included a fake bank account number for payment. The scam worked because the email was so well-crafted that it didn’t raise immediate red flags.

“A malicious actor will come in and change one or two characteristics of a URL address or an email link—something that doesn’t totally appear correct,” said Detective Cutlip with the CCSO High-Tech Crimes Unit. “At first glance, if you’re having correspondence, you wouldn’t pick up all those changes.”

Once school officials realized what had happened, they immediately contacted law enforcement. The sheriff’s office worked with the U.S. Secret Service to track the money, which had already been split between two bank accounts outside of Florida.

Thanks to that quick response, investigators were able to freeze and recover about 92% of the funds—roughly $779,600. More than $67,000 was still missing, and the investigation remains ongoing.

In the wake of the scam, the Citrus County School District is implementing new safety measures. Dr. Hebert said all district employees are getting extra cybersecurity training, and new protocols are being developed to help staff detect and respond to cyber threats in the future.

“Disciplinary action will occur,” Hebert told WFLA. “Those folks that were involved… will be held accountable for not following any of the procedures that we had in place.”

Depending on the findings of an internal investigation, that discipline could range from further training to suspension or termination.

Invest in real estate without the headache of being a landlord

Imagine owning a portfolio of thousands of well-managed single family rentals or a collection of cutting-edge industrial warehouses. You can now gain access to a $1B portfolio of income-producing real estate assets designed to deliver long-term growth from the comforts of your couch.

The best part? You don’t have to be a millionaire and can start investing in minutes.

Learn More

How to protect yourself or your business from phishing scams

This type of scam, often called business email compromise or phishing, is becoming increasingly common. To avoid falling victim to these scams, here are a few steps you can take:

Double-check email addresses

Scammers often change just one character in an email to make it look real. For example, "gadams[at]adamsconstruction.com" might become "gadams[at]adamsconstructi0n.com."

Verify payment information before you hit 'send'

If a vendor emails new bank details or says their payment info has changed, call them using a known phone number—not one listed in the email—to confirm.

Be cautious about any last-minute changes

If someone suddenly requests changes to a scheduled payment, closing date, or account number, take extra steps to verify that the changes are legitimate. It's always better to take a few extra minutes to verify then to fall victim to a scam.

Train your team

Make sure everyone who handles money or emails with vendors knows what phishing scams look like and how to report them. This includes following the steps listed here and knowing not to click on links or download files from unknown sources.

Contact law enforcement immediately if you suspect fraud

One reason the school board was able to get most of the money back was because they reported the scam right away. The sooner you act, the better your chances of recovering lost funds.

As this case shows, even experienced professionals can fall for a scam when the attack is sophisticated. But by staying alert and putting clear procedures in place, businesses and individuals can better protect themselves from financial fraud.