Business Email Compromise: Notable Public Cases
What Public Business Email Compromise Cases Reveal
Public Business Email Compromise (BEC) prosecutions and FBI data show a consistent pattern: attackers spoof or compromise a trusted email account, send convincing fake wiring instructions, and route stolen funds through layers of shell accounts, cryptocurrency, and overseas transfers before victims discover the fraud, often within days. The cases below, drawn from public DOJ, FBI, and Secret Service records, illustrate how these schemes operate and how they get investigated.
A note on sources. Every case and statistic referenced on this page comes from publicly available government records — U.S. Department of Justice press releases, FBI Internet Crime Complaint Center (IC3) reports, and U.S. Secret Service announcements, each linked at its source. These are public enforcement actions, not matters handled by Redbeard Intelligence and Investigations. We reference them here for education, to show how BEC schemes actually operate and how a documented investigation approaches this kind of fraud.
Business email compromise remains one of the costliest categories of internet-enabled fraud tracked by federal law enforcement, and the public record now includes prosecutions touching technology giants, nonprofits, labor unions, and small businesses alike. Reviewing how these cases unfolded, and how investigators traced the funds, helps businesses recognize warning signs and understand what a professional, documented investigation can examine after a wire fraud loss.
Why These Public Cases Matter
These case summaries come from public court and agency records. Redbeard was not involved in the matters described below; they are presented for education, to illustrate how BEC schemes and their investigations actually work.
- Spoofed, Not Always Hacked
Public cases repeatedly show attackers registering a look-alike domain, changed by a single letter, rather than breaking into the real account.
- Invoices Disguise the Ask
Fraudulent wiring instructions are usually dressed up as a routine invoice or payment update from a trusted vendor or partner.
- Urgency Is the Weapon
Case records show victims pressured to wire funds quickly, before anyone can verify the request through a separate, known channel.
- Money Moves Fast
Stolen funds are typically layered through several domestic accounts within hours, before many victims notice the loss.
- Funds Cross Borders
Investigators in these cases repeatedly traced proceeds to overseas banks and, increasingly, cryptocurrency exchanges.
- Verification Breaks the Scheme
A callback to a previously verified phone number, not the one in the suspicious email, is the control cited most often.
What Do Real, Publicly Prosecuted BEC Cases Look Like?
One of the most widely reported BEC prosecutions involved Lithuanian national Evaldas Rimasauskas, who registered a company with a name nearly identical to a real hardware vendor used by two major technology companies, then sent forged invoices, contracts, and letters made to appear signed by real executives. Between 2013 and 2015 he induced the two companies to wire more than $120 million to accounts he controlled. He pleaded guilty to wire fraud and was sentenced to five years in prison, with forfeiture of nearly $50 million and restitution ordered above $26 million, according to the FBI.
In a more recent case, four members of a transnational criminal organization were sentenced for a BEC scheme that federal prosecutors say stole more than $38 million from victims in the U.S. and abroad, infiltrating legitimate business email threads beginning in 2022 and laundering the proceeds through shell companies and fraudulent bank accounts, according to the U.S. Attorney’s Office for the Southern District of Florida.
How Do BEC Schemes Actually Move the Money?
In January 2023, a Massachusetts-based workers’ union was defrauded of $6.4 million after receiving a spoofed email that appeared to come from its investment manager, the sender’s domain altered by a single letter. Investigators traced the proceeds through seven domestic bank accounts and attempted transfers to a cryptocurrency exchange and to accounts in Hong Kong, China, Singapore, and Nigeria before the U.S. Secret Service and Department of Justice secured forfeiture of more than $5.3 million, according to the U.S. Attorney’s Office for the District of Massachusetts.
Smaller organizations are targeted the same way. One defendant was sentenced to 48 months in federal prison for a scheme that used fake vendor invoices to defraud several victims, including a Pennsylvania nonprofit mental health provider, of roughly $1.1 million; his role was opening bank accounts under other people’s identities to quickly receive and move the stolen funds, according to the U.S. Attorney’s Office for the Eastern District of Pennsylvania. In a separate Maryland case, a defendant extradited from South Africa was sentenced to 90 months in prison and ordered to repay $2,389,130 after conspiring to send spoofed emails with false wiring instructions to targeted businesses, according to the U.S. Attorney’s Office for the District of Maryland.
What Do the National Numbers Show?
These prosecutions are not outliers. The FBI’s Internet Crime Complaint Center (IC3) reported $2.77 billion in BEC losses across 21,442 complaints in 2024 alone, one of the costliest categories of internet crime it tracks, according to the 2024 IC3 Internet Crime Report. Looking back further, IC3’s BEC public service announcement puts identified global exposed losses between October 2013 and December 2023 at more than $55 billion, spanning reports from all 50 states and 186 countries, according to the FBI IC3 public service announcement “Business Email Compromise: The $55 Billion Scam”.
What Digital Evidence Do These Cases Rely On?
Public case records point to a consistent evidence trail: email headers showing the true originating domain and IP address, DNS and domain-registration records for the look-alike sender domain, the sequence of wire-transfer and bank records documenting where funds moved, and communication logs showing when the fraudulent instructions were sent and acted on. Investigators and prosecutors in these matters built their cases by preserving and correlating this material quickly, before accounts closed or records aged out.
What Can a Documented Investigation Establish?
A private investigation cannot file criminal charges or freeze funds the way the DOJ, FBI, or Secret Service can. What a licensed investigator can do, where appropriate, is help a business preserve email headers and system logs before they are lost, document the timeline of the fraudulent request, and organize records in a form suitable for law enforcement reports, insurers, and counsel. This page describes public cases for educational purposes only; it is not legal advice, and no outcome is guaranteed for any matter.
Licensed Support If You Suspect BEC
Redbeard Intelligence and Investigations maintains corporate offices in Orlando and Naples, and works only through lawful methods. If your organization suspects it has been targeted by a business email compromise scheme, contact us at (888) 564-8300 or contact@redbeardpi.com for a confidential consultation about documentation and next steps.
Frequently Asked Questions
Are the cases described on this page Redbeard’s own investigations?
No. Every case summarized here is drawn from public U.S. Department of Justice, FBI, and Secret Service records, linked at their source. They are shared for education, to show how BEC schemes and their investigations work, not as matters Redbeard handled.
How much money do businesses lose to BEC scams each year?
The FBI’s IC3 reported $2.77 billion in BEC losses across 21,442 complaints in 2024 alone, and more than $55 billion in identified global exposed losses between October 2013 and December 2023.
What is the most common way BEC schemes trick victims?
Public cases repeatedly show a spoofed or look-alike email domain paired with a fraudulent invoice or wiring-instruction change, combined with urgency that discourages the victim from verifying the request through a separate, known channel.
Can a private investigator recover money lost to a BEC scam?
No investigator can guarantee recovery. What we can do, where appropriate, is help preserve digital evidence, document the incident timeline, and organize records to support your bank’s recovery request, an IC3 report, and any law enforcement or legal follow-up.
What should a business do immediately after a suspected BEC wire transfer?
Contact your bank immediately to request a wire recall, report the incident at IC3.gov, preserve the fraudulent emails and headers without deleting anything, and consider licensed investigative support to help document the loss for your bank, insurer, and counsel.
Concerned About a Business Email Compromise Loss?
If your organization has experienced a suspicious wire transfer or spoofed vendor email, time matters. Redbeard Intelligence and Investigations helps clients nationwide and internationally preserve digital evidence and document the incident for their bank, insurer, and counsel — without promising a guaranteed recovery.
What is the cost? | how does it work?
At Redbeard Intelligence & Investigations, we offer upfront, transparent pricing that reflects the specific details and complexity of each case. Instead of vague estimates or hidden charges, we provide clear, upfront pricing tailored to your investigation’s unique requirements—without unexpected fees, hidden costs, or additional unexpected expenses. Our goal is to offer efficient, high-quality investigative and intelligence solutions with transparency and peace of mind.
To begin an investigation, intelligence operation, or technical security assessment, the first step is a confidential consultation via phone or email with one of our experienced professionals. During this initial discussion, we will gather key details about your situation to determine the most effective strategy tailored to your needs. Whether you require private investigative services, intelligence gathering, or technical security solutions, our team will develop a customized plan designed to achieve your objectives. Based on the specific requirements of your case, we will then provide a transparent price quote and/or invoice for the cost of the services needed. Throughout the process, we ensure clear and consistent communication, keeping you informed of any significant developments. Upon completion, you will receive a comprehensive written report detailing our findings, along with any supporting evidence such as photos, video documentation, or technical security assessments.
Contact us through phone or email for an initial discussion and provide key details about your needs.
Based on the specific requirements of your case, you'll will receive a flat-rate price quote and invoice for the cost of the services needed.
With pricing and mutual terms accepted, payment will be collected for the predetermined costs, and you'll officially become our client.
Throughout the process, we keep you informed of any significant developments. Upon completion, you will receive a written report detailing our findings, along with any supporting evidence or documentation.
