Secret Service recovers nearly $3 million stolen from North Carolina housing authority in BEC scam

A North Carolina state agency that administers a fund for homeowners struggling with housing expenses lost nearly $3 million in a business email compromise (BEC) scam last year.

According to court documents, the stolen funds were seized by a special agent within the United States Secret Service in September.

The North Carolina Housing Finance Agency (NCHFA) manages $273 million the state received from the Homeowner Assistance Fund, which was established through the American Rescue Plan Act of 2021 to prevent displacement due to the pandemic.

Last April, two NCHFA employees received emails from an account pretending to be from Innovative Emergency Management, a private company that contracts with the agency to dole out funds.

The emails requested that the employees within the financing department update payment information for IEM. Upon request, the sender provided a voided check for the new account at Community Federal Savings Bank and the agency wired over $2.7 million.

NCFHA was then contacted by its bank, Wells Fargo, which urged them to verify that the new account was legitimate. After contacting IEM, and discovering that the email address used by the sender was slightly different (@iemmgt.com instead of @iem.com), they immediately filed a report online with the FBI’s Internet Crime Complaint Center (IC3). Four days later, on April 24, an analyst with the Secret Service took up the case.

In response to a request from investigators, Community Federal Savings Bank informed them that the account is actually managed by Currencycloud, an international currency transfer service bought by Visa for nearly $1 billion in 2021. According to the court documents, Currencycloud partners with the bank to conduct wire transfers in states where it is not licensed to carry out transactions.

The company informed investigators that the account was opened in the name of FVB LTD by a Romanian national named Florina-Victoria Constantinescu. United Kingdom business records show the company was incorporated in January 2023 as a clothing retailer and is linked to a Glasgow address.

At the time of the wire transfer, FVB LTD supplied Currencycloud an invoice saying they had billed the North Carolina agency for a "Consultancy and Management Fee."

After receiving a warrant for the account in August, Currencycloud handed over the funds the next month. NCHFA did not respond to a request for comment.

In 2022, the FBI received nearly 22,000 complaints related to BEC scams, resulting in losses of more than $2.7 billion.