Surfside Beach loses $545,598 in sophisticated email scam; Wildcat Construction CEO disputes forensic report, says town ignored red flags
A payment of $545,598 intended for Wildcat Construction has become the focus of an ongoing fraud investigation in Surfside Beach, South Carolina, after the money was allegedly redirected to a scammer-controlled bank account through a sophisticated email scam.The payment was meant for Wildcat Construction, which was carrying out an underground utility project for the town. According to The Wall Street Journal, the fraud began during what appeared to be a routine email conversation about issuing payment for completed work.
Fraudsters allegedly posed as contractor
Investigators believe someone impersonating a Wildcat Construction employee requested that the town change the payment method from a paper check to an ACH (Automated Clearing House) transfer.The town subsequently sent the money to a bank account in Utah instead of the contractor’s legitimate account.The incident is being treated as a Business Email Compromise (BEC) scam, in which cybercriminals use spoofed or lookalike email addresses to impersonate trusted individuals and redirect payments.According to the forensic investigation, fraudulent actors created fake email domains resembling those used by Surfside Beach and Wildcat Construction. Investigators found no evidence that the town’s internal computer systems or Microsoft 365 accounts had been breached.
Fake payment request blended into genuine project
Investigators said the fraudulent payment request appeared during an active construction project involving an expected invoice and an existing payment obligation, making it appear legitimate.The forged documentation reportedly included updated bank account information, a callback number and a signature resembling that of Wildcat Construction CEO Alyssa Bowker.The report also found that a town employee attempted to verify the payment instructions by emailing Wildcat Construction’s legitimate email address and requesting a callback before processing the transfer.However, investigators said it remains unclear whether the response came from a genuine company representative or from the scammers.Cybersecurity experts say this highlights how modern fraudsters often manipulate existing communication channels, making traditional verification methods less effective.
Wildcat CEO challenges investigation
Wildcat Construction CEO Alyssa Bowker has publicly disputed parts of the town’s forensic report.According to WMBF, Bowker said Surfside Beach selectively released emails supporting its own narrative while failing to establish whether those messages actually originated from Wildcat’s servers.She also claimed the published emails appeared to have had their signatures removed, despite containing Wildcat phone numbers.Bowker further argued that no one from the town verbally confirmed the ACH payment change directly with her or any authorized Wildcat employee.She described verbal confirmation as a standard business safeguard and said several additional warning signs became apparent after the fraud was uncovered.According to The Wall Street Journal, the town’s finance director said a staff member called Wildcat’s project manager on March 13 before the payment was sent. The project manager referred the caller to Bowker, and a voicemail was left on her mobile phone.Bowker told the newspaper she does not remember receiving the voicemail but acknowledged she may have missed it.
Town stands by forensic findings
Surfside Beach said the purpose of the independent forensic investigation was to determine whether the town’s systems had been compromised.Officials said the investigation found no unauthorized access to municipal systems and therefore had no further comment on Bowker’s allegations.Mayor Robert Krouse said he believes the payment issue originated on the contractor’s side, including the submission of the ACH request.However, the forensic report itself does not conclude that Wildcat Construction was responsible. Instead, it states only that no breach occurred within Surfside Beach’s systems.Krouse acknowledged that town officials could have made additional verification calls or rejected the ACH request but described those observations as “20/20 hindsight.”He said the town will review its internal procedures and discuss the matter further during an executive session of the town council.
Payment dispute continues
Bowker said Wildcat Construction has still not received payment for the project and hopes the dispute can be resolved soon.The town also addressed speculation surrounding the dismissal of finance assistant Brian Gray and business license official Nicole Kindzia, both of whom were fired in June.Officials said the two employees “had absolutely nothing to do with the cybercrime incident.” According to the forensic report, the employee who sent the March 13 verification email followed the finance department’s established procedures.
