What the official report says
On 26 March 2025, the US Department of Justice announced a court-ordered default judgment and final forfeiture order for approximately $5,315,746.29. The funds were traceable to a business email compromise scheme and subsequent laundering. The order followed a civil forfeiture complaint filed in June 2024.
As alleged in that complaint, a workers union based in Dorchester, Massachusetts, transferred $6.4 million in January 2023 after receiving a spoofed email appearing to come from its investment manager. The instruction directed payment to an account controlled by a third party.
Tracing funds through intermediary accounts
DOJ reported that the proceeds moved through intermediary bank accounts. Some funds were transferred, or attempts were made to transfer them, to a cryptocurrency exchange and foreign bank accounts in Hong Kong, China, Singapore and Nigeria.
Investigators traced proceeds to seven domestic bank accounts whose contents were subsequently seized. The US Secret Service investigated the case. The report describes forfeiture; it does not establish that the money had already been returned to the union.
Forensic lessons: preserve authorization and transaction context
A payment-diversion investigation needs both the communication trail and the money trail. Preserve the original instruction, known-good investment-manager contact details, approval records and transaction references. A plausible sender name does not establish that a transfer was authorized.
The release does not publish raw email headers, domain indicators or the precise technical spoofing method. Those details cannot be reconstructed from the press release alone. The practical lesson is to combine preserved email evidence with independently verified authorization and bank records, rather than treating a DNS lookup as proof of the scheme.
Primary source
Read the official US Department of Justice reportThis review summarizes the cited public report. The original source date is shown separately from this review’s publication date. Subsequent proceedings or recoveries have not been verified here.