A fake email can trick a business into sending money. A romance scam can persuade someone to move it along. In this episode, we explore how fraudsters combined both schemes and how investigators uncovered a network linked to more than 60 known victims and over $14 million in attempted theft. The case shows that online fraud is not always one simple trick. It can involve compromised company inboxes, forged payment documents, fake identities, and personal relationships—all working together to move money and conceal where it came from.
How the email scam worked
Business email compromise, or BEC, is a scam that uses access to or impersonation of a company email account to divert payments. Criminals don’t necessarily need to break into a bank. They may only need to get into the right inbox and learn how a company handles its payments. The scheme often starts with a lookalike email address or a fake login page. If an employee enters their password, the scammers can access the account. They may then create rules that forward emails to an outside address or hide security alerts from the account owner. Rather than act immediately, the scammers can quietly study the company’s routines: who approves payments, which vendors are paid, and when transfers are expected. When the timing is right, they send a convincing payment request or alter the banking details on a real one. Because the message may come from a familiar account and match the company’s normal process, the request can appear routine. But the destination account has changed. By the time anyone notices, the funds may already be moving.
A company’s payments were redirected
One example discussed in the episode involved Rockview, a small employee-owned company in Connecticut. An administrative assistant received what appeared to be a wire request from the company’s chief operating officer. It included a signed loan agreement and seemed legitimate. The company later discovered that the executive had not sent the request. Investigators found signs that email accounts had been manipulated: messages were forwarded to outside accounts, and security alerts were deleted or hidden. The case illustrates why these attacks can be difficult to spot. The fraud does not always look like an obvious, suspicious email. It may blend into everyday business communication, using familiar names, documents, and payment routines.
The romance scam behind the money trail
The story took an unusual turn when some of the stolen funds passed through the account of a 69-year-old widow in the United States, referred to here as Linda. Linda had lost her husband and met a man online who was affectionate and attentive. As the relationship developed, he began asking for financial help. Eventually, he asked her to receive money and send it onward. That made Linda a money intermediary someone used to transfer funds between accounts. Some people who perform this role know they are helping criminals. Others are deceived into believing they are assisting a romantic partner or someone they trust. In this case, the romance scam and email fraud reinforced each other. The compromised business emails helped generate the stolen money. The relationship helped persuade Linda to receive and forward funds, adding another step between the original theft and the people running the scheme. According to the episode, Linda also lost more than $40,000 of her own savings. Her story is a reminder that people caught in a money-moving scheme may themselves have been manipulated and harmed.
Why combining scams can be effective
A criminal network can make fraud harder to recognize by dividing it into steps. One person may gain access to an email account, another may prepare forged documents, and someone else may build a relationship with a potential money intermediary.Each individual step might look ordinary in isolation: a payment request, an invoice, or a personal favor. Together, they create a system for stealing and moving money.The episode describes a network connected to more than 60 known victims and over $14 million in attempted theft. It also discusses how investigators followed digital clues and linked the activity across accounts and identities.
What businesses and individuals can learn
For businesses, a payment request that changes bank details deserves special care, even when it appears to come from someone familiar. Confirm changes through a separate, trusted method rather than relying on the email thread itself. It’s also important to pay attention to unexpected forwarding rules, login alerts, or changes to account settings. For individuals, be cautious if someone you meet online asks you to receive money, transfer funds, or use your bank account on their behalf. A relationship can feel genuine while still being used to create pressure or lower your guard. Taking time to verify a story and seeking independent advice can help prevent serious financial harm. The central lesson is that trust can be exploited in both professional and personal settings. In this case, the same fraud network relied on the trust people place in familiar work routines and in close relationships.