The Invoice Was Real. The Supplier Was Real. One Bank-Account Change Redirected US$1.1 Million.

According to court documents, employees at a New Jersey healthcare provider received emails in June 2020 that appeared to come from its contracted safety-equipment supplier. The messages instructed the organisation to send future payments to a new bank account.

That account was controlled by Benjamin O. Alexander through BOA Building Maintenance and Cleaning Services LLC. Believing the instructions came from its genuine supplier, the healthcare provider sent four ACH payments totalling approximately US$1.1 million.

Alexander has now pleaded guilty to conspiracy to commit money laundering, the U.S. Department of Justice announced on 29 September 2026.

The supplier was genuine and so was the payment obligation. The only fraudulent element was the destination account, delivered through an email that appeared to carry the supplier's existing credibility.

Many organisations verify invoices carefully but treat a bank-detail change as an administrative amendment to an already trusted supplier. That reverses the risk hierarchy: a changed bank account should effectively require re-verification of the supplier-payment relationship.

When email is compromised or spoofed, a fraudulent instruction inherits everything the real supplier has earned. Confirming the request through the same channel it arrived in confirms nothing.

A bank-detail change received by email was accepted as a genuine instruction from a trusted supplier, without independent verification of the request.

The new destination account was not validated against the supplier's identity. The account belonged to an unrelated cleaning business, a mismatch that name and ownership checks would be expected to surface.

Nothing treated a change of payee account followed by repeated payments to it as an exception. Four ACH payments reached the fraudulent account before the diversion was addressed.