Your customer paid a stranger instead of you. Every check you ran said the payments were fine.

Primary source. United States Department of Justice, US Attorney's Office, Southern District of Indiana. Press release, November 2025, on the sentencing in a $182k email compromise scheme against a small business in Clark County, Indiana.
justice.gov/usao-sdin/pr/fraudster-sentenced-federal-prison-182k-email-compromise-scheme-targeting-family-owned
Corroborated by a second outlet reporting the same sentencing: suncommercial.com

Verification. The DOJ page returned HTTP 403 to automated retrieval on 20 August 2026. The release was read by a person on 28 August 2026 and checked line by line against this page. Every sourced claim here corroborates, including the restitution figure to the cent. The release describes the victim as a family-run business, in a quoted passage; the wording on this page follows the release.

Taken from the source: a business email compromise scheme beginning April 2023 against a small business in Clark County, Indiana; co-conspirators gained unauthorized access to an email account used by employees; they impersonated a company representative and told another small business in the same county that the victim had changed banking institution; future payments were directed to a specified JPMorgan Chase account; that account was registered to a fictitious entity created solely to receive the funds; $182,201.80 was received; the account was drained quickly and much of the money spent; the defendant left the country and was arrested about six months later re-entering from Canada; the owners, approaching retirement, refinanced property, extended lines of credit and postponed retirement to keep the business; the defendant pleaded guilty to wire fraud and was sentenced to 21 months in federal prison with three years of supervised release, and ordered to pay restitution. The case was investigated by the US Secret Service.

Limit of the source: the release states that access to the mailbox was gained and that, using that access, a company representative was impersonated and the emails sent. It does not state explicitly whether the messages were sent from the compromised mailbox itself. This simulation teaches the account-takeover reading, which is the natural one, and says so here rather than hiding the ambiguity.

Written for the simulation, not sourced: every date, day count and elapsed period on this page, including the ninety-six days and the three months of payments, because the source gives no timeline; the number of invoices, their references and amounts; the wording of the fraudulent email; the accounts payable manager and the phone call; the business's own controls, including the rule made after an earlier fake invoice; the employee's leave and what the experience cost them; the four options at every decision and which is designated correct.

Presented as contested, not settled: whether a customer who paid the wrong account on a written instruction from a compromised mailbox still owes the debt. Liability in these cases turns on jurisdiction, contract terms and the facts. Nothing on this page should be read as legal advice.

Currency and names: figures are US dollars as recorded by DOJ. No individual, company or customer is named here, deliberately, including the defendant and the entity the receiving account was registered to. The plan price is StrongKeep's own published pricing and is not part of the case.