WIRESNAREGet Started

Public incident analysis

A spoofed investment manager and a $6.4 million transfer

In March 2025, the U.S. Department of Justice reported a forfeiture tied to a Business Email Compromise (BEC) scheme against a Massachusetts workers union.

What the public record says

The instruction pointed to the wrong account

According to the Justice Department, a workers union in Dorchester, Massachusetts received a spoofed email in January 2023 that appeared to come from its investment manager.

The Department said the email misled the union into transferring $6.4 million to a bank account controlled by a third party. After the transfer, funds moved through intermediary accounts. Investigators traced proceeds to seven domestic bank accounts.

On March 26, 2025, the Department announced that a court had entered a default judgment and final order forfeiting approximately $5.3 million connected to the scheme. The Department updated its release on April 29, 2025.

Read the Justice Department release

The high-risk moment

Trust shifted to the impersonator

The public release identifies the key moment: an email that appeared to be from the investment manager directed funds to the wrong account. It does not publish the message or state every warning sign that was present.

Illustrative review flagSender context differsVerification recommended. Detection details are not shown.

Warning signs to review

  • A bank account or beneficiary that differs from trusted records
  • A sender, reply-to address, or domain that is not an exact match
  • Pressure to act before another person can verify the instruction
  • A request to use contact details supplied only in the email

How WireSnare is designed to help

Flag, review, verify, then respond

  1. 1

    Flag

    WireSnare reviews new mail in a selected Gmail or Outlook mailbox and can flag suspicious payment instructions or impersonation.

  2. 2

    Review

    The user opens the dashboard flag and checks its reason against the sender, conversation, and payment details.

  3. 3

    Verify

    The user pauses before acting and contacts the known person or organization through independently trusted details.

  4. 4

    Respond

    If fraud is confirmed or funds moved, the user contacts the financial institution immediately and follows the relevant reporting process.

WireSnare cannot determine with certainty that a message is fraudulent, and no product can guarantee that a loss would have been prevented. Independent verification remains necessary.

Response steps when a payment may be at risk

  • Stop any pending transfer or payment change.
  • Call the bank or payment provider immediately if funds moved.
  • Preserve the email, headers, account details, and related records.
  • Contact the real person or organization through trusted records.
  • Report the incident to law enforcement and the appropriate fraud-reporting service.
  • Tell affected colleagues, family members, caregivers, or advisers what happened.
Get Started