EDEN PRAIRIE, Minn. — Court documents filed in Hennepin County outline the alleged electronic theft of $1 million from a well-known Twin Cities foundation.
An application for a search warrant filed by Eden Prairie police details a theft by swindle reported by the Margaret A. Cargill Foundation (MACF) on July 10. Detective John Andrews, who specializes in complex financial crimes, was granted the authority to search the records of a company known as Early Warning Services LLC, which also does business as Zelle. Zelle is a service that electronically moves money between accounts using just an email address or U.S.-based phone number.
In the warrant, Det. Andrews says MACF had awarded a $2 million grant to an organization in Alaska, and made arrangements to distribute the money using a web-based grants management system. On June 16 MACF sent $1 million to the grantee's account at Bank of America, but the organization never received the money.
An internal investigation by the foundation revealed someone had accessed the email account of one of the grantee's employees, then located login information for MACF’s web‐based grants management system. The suspect or suspects then allegedly changed the Bank of America account number to one they controlled and diverted the $1 million.
Andrews says in the warrant application that suspects in Business Email Compromise (BEC) scams routinely open bank accounts with the name of shell companies with the sole purpose of laundering stolen money. He explains that he suspects will then "‘turn and burn" these accounts (open an account, funnel a large amount of stolen money through in a short amount of time, then abandon it) because they know the bank accounts will quickly be closed by the banks due to fraud.
A review of the fraudulent account records shows a number of small transactions near Dallas, TX, then a handful of large transfers to a Zelle account holder named "Beatriz" via cashier's check.
Cyberattacks on charitable groups on the rise
Joel Barker, President and CEO of Brave North Technology, which provides technology and cybersecurity support for local businesses and more than 100 local non profits, says the attack is eye-opening in its size, but fits a growing trend.
Barker: "I'm not surprised. This is something that I think is a new normal that we'll continue to see.
It is, of course, a lot of money, so what is unique with them is they do give larger gifts. This kind of attack though, where somebody would breach an account. That is a common occurrence."
Kent Erdahl: "How often are you seeing this type of activity?"
Barker: "We see cyber events take place daily. Sometimes they're smaller events. Phishing emails we see multiple a day. A lot of times people are aware not to click on something, but there are attacks that are successful at least weekly across our client base that we have to shut down computers, shut down accounts.
There is a significant increase in threats for organizations, especially non-profit organizations."
Fortunately, Barker says none of his clients have suffered a crippling attack that has locked them out of doing their work.
Erdahl: "Is this sector as prepared, as others?"
Barker: "I think the non-profit sector is prepared. I think the perception is that they lag behind, but what keeps me up more at night is small business clients. They don't have as much of a structure, like a board that's advising them to say, 'You really should be focusing on this.'"
Regardless, Barker says everyone now has a million new reminders of why it's worth your attention.
"I would really encourage those organizations to at least put a plan in place," he said. "Prepare for some type of event like this to occur because it will happen to an organization at some point."
Officials with the MACF shared a statement with KARE 11 when contacted about the $1 million theft.
"This is an active criminal investigation, which limits the details that can be shared. We also want to respect the privacy of our grantee partner and their own investigation," said Margaret A. Cargill Philanthropies President Heather Kukla in a released statement. "As cybercrime becomes more sophisticated, we continue to invest in secure platforms and processes at Margaret A. Cargill Philanthropies to ensure we protect charitable assets and support our grantee partners. MACP has confidence in our grantmaking systems, and we have no reason to believe those systems are compromised. Our grantmaking operations are safely continuing without interruption."
WATCH MORE ON KARE 11+
Download the free KARE 11+ app for Roku, Fire TV, Apple TV and other smart TV platforms to watch more from KARE 11 anytime! The KARE 11+ app includes live streams of all of KARE 11's newscasts. You'll also find on-demand replays of newscasts; the latest from KARE 11 Investigates, Breaking the News and the Land of 10,000 Stories; exclusive programs like Verify and HeartThreads; and Minnesota sports talk from our partners at Locked On Minnesota.
- Add KARE 11+ on Roku here or by searching for KARE 11 in the Roku Channel Store.
- Add KARE 11+ on Fire TV here or by searching for KARE 11 in the Amazon App Store.
- Learn more about the KARE 11+ app for Apple TV in the Apple App Store.
- Learn more about KARE 11+ here.
Watch more local news:
Watch the latest local news from the Twin Cities and across Minnesota in our YouTube playlist: