The Email Looked Exactly Like the Vendor's. It Cost a School District $4.9 Million.

Josh Burrus 2026-10-13

In February, Dickinson Public Schools in North Dakota told its community that criminals had "impersonated a trusted vendor and redirected two payments" out of the district's building fund. The total was $4.92 million.

No ransomware. No locked screens. Someone sent convincing emails, someone in the payment process believed them, and the money went to an account the district didn't control. Local police asked the FBI and the U.S. Department of Justice to step in because the case was beyond their reach, according to reporting by The Bismarck Tribune.

If that story sounds familiar, it should. In 2023, we wrote on this blog about Flagler County Schools here in Florida losing about $719,000 to a similar scheme. Three years later the playbook hasn't changed much. The tools behind it have.

Phishing grew up

For years, security training taught people to spot the obvious tells: bad grammar, strange greetings, a sender address that looked slightly off. Those cues are disappearing.

Generative AI writes clean, natural email in seconds. It can copy the tone of a superintendent's memos or a vendor's billing department after reading a few public examples. Albuquerque Public Schools made this point in an October 9 post for Cybersecurity Awareness Month. Attackers now use AI to write convincing emails, mimic the writing style of principals and executives, clone voices and create fake video.

Voice is the part that worries me most. In May 2025, the FBI warned that criminals were using AI-generated voice messages to impersonate senior U.S. officials and target current and former federal and state officials and their contacts. The Bureau's own assessment was blunt: "AI-generated content has advanced to the point that it is often difficult to identify."

Think about what that means for a county finance office. An email from a known contractor asks to update banking details. A day later a voicemail arrives in what sounds like the project manager's voice, confirming the change. Both are fake. Both feel routine.

The numbers behind it

The FBI's Internet Crime Complaint Center reported nearly $20.9 billion in cybercrime losses for 2025, up 26 percent from the year before. Business email compromise, the category that covers the Dickinson scam, accounted for about $3.05 billion of that. Most of those losses moved by wire transfer. And those are only the incidents people reported.

Deepfakes are adding a new layer. A report released this week by identifAI, a company that sells deepfake detection tools, ties roughly $40 billion in financial fraud to deepfakes, with video and voice cloning making up nearly two-thirds of the incidents it tracked. Take a vendor's numbers with appropriate salt. The direction of the trend isn't really in dispute.

Why SLED organizations are such good targets

Public agencies have a few traits that make this kind of fraud easier.

A lot of their information is public by design. Board agendas, approved contracts, vendor names and staff directories are often posted online. That's good government. It also gives a scammer a ready-made script.

Payments are large and predictable. Construction draws, technology purchases and bond-funded projects create big, recurring transfers to known vendors.

Staff are stretched. The person processing invoices is often covering two or three other jobs, and a polite, urgent email from a familiar name doesn't set off alarms.

The state-level view isn't reassuring either. In the 2026 NASCIO-Deloitte Cybersecurity Study, 67 percent of state CISOs listed phishing among the top threats for the coming year, and 55 percent named AI-enabled attacks.

What works now

The good news is that the strongest defenses against AI-assisted fraud are mostly process, not products. They cost little and they work regardless of how polished the fake message is.

Verify every banking change out of band. Any request to change vendor payment details gets confirmed with a phone call to a number already on file, never one from the email or voicemail. Make it policy, put it in writing and back the staff who follow it, even when it slows a payment.

Require two people for large or changed payments. A second approver who has to independently check the request breaks most of these schemes.

Use phishing-resistant multi-factor authentication. Albuquerque Public Schools notes that MFA blocks the vast majority of attacks that rely on a stolen password. App-based number matching or hardware security keys are stronger than text-message codes.

Lock down your email domain. Publishing DMARC, SPF and DKIM records makes it harder for attackers to send mail that appears to come from your own domain.

Train for today's threats. Annual click-through training built around spotting typos is out of date. Run short, regular sessions using realistic examples, including voice and text message scenarios, and make it easy and blame-free for staff to report something odd.

Agree on a verbal code word. For senior staff who might be impersonated on a call, a simple pre-agreed phrase is a low-tech check that a voice clone can't fake.

The point of all this

None of this requires your team to become deepfake experts. It requires a payment process that assumes any single message could be fake, and a culture where staff feel comfortable picking up the phone to check.

October is Cybersecurity Awareness Month, which makes it a good time to walk through your accounts payable process with fresh eyes. vTECH io works with Florida schools, cities and counties on email security, MFA rollouts, security awareness training and policy reviews. If you'd like a second set of eyes on how your organization handles payment changes, call us at 888-277-5918.

Sources

Back to Tech Blog

Need Help with Your IT Strategy?

Our experts can help you navigate the technology landscape. Contact us today.

Contact Us