A small Idaho city loses $1 million in a ‘social engineering’ scam. How it happened

A nearly $1.1 million payment meant for a contractor working on a small Idaho city’s wastewater system has gone missing as a result of a “social engineering scam” that diverted the funds, officials say.

A news release about the incident said city officials in Gooding intended to electronically deposit the money in the contractor’s bank account. Criminals impersonating representatives of the contractor gave them fraudulent information, however, and almost $1.1 million was transferred to a wrong account.

Gooding, a city of 3,700 people, is the seat of rural Gooding County in south-central Idaho’s Magic Valley. It is about 120 miles southeast of Boise.

Social engineering scams are used by thieves “to exploit a person’s trust in order to obtain money directly or obtain confidential information to enable a subsequent crime,” according to Interpol.int.

Such stealing “most commonly occurs when hackers manipulate employees into disclosing private information which leads to them voluntarily parting with company or client funds money or products,” according to Edgewood Partners Insurance Center in San Francisco. “Hackers take advantage of human nature to exploit a target company through its employees.”

The hoax was detected relatively quickly, the release said, but not before the payment was made. The city’s bank originally informed officials that the money was recovered and placed back in the city’s account, but the bank later said it hadn’t actually recovered the funds.

The request to change payment information was done with documentation that appeared authentic, the release said. It said legitimate requests to update bank account information are routine.

Conspirators then waited for the city to transfer the vendor payment, and after the funds were deposited in the scammers’ account, they were diverted to a different account.

Gooding officials have consulted with its insurance vendor, the release said, and that construction of its wastewater plant will not be affected.

“While the city has previously conducted social-engineering scam training, it is establishing new protocols to prevent future loss,” the release said.

The FBI and Gooing County Sheriff’s Office were investigating. Anyone with information was asked to call the Sheriff’s Office at 208-934-4421.

The Idaho Statesman contributed.

This story was originally published June 10, 2024 at 10:59 AM.