WORCESTER, Mass. — A sophisticated email scam redirected more than $731,000 in payments intended for a company that installed seating at Worcester’s DCU Center, according to a recent federal court ruling.
The fraud unfolded in 2023 after Worcester-based Stutman Contracting hired Hussey Seating Company to provide and install seating at the arena. The subcontract was valued at about $1.09 million.
Hussey completed the work and invoiced Stutman for a total of $731,861. But instead of reaching Hussey, three wire payments were sent to a bank account controlled by an unidentified fraudster, according to court records.
U.S. District Judge Margaret R. Guzman addressed the dispute in a July 29 decision in the federal case between Stutman and Hussey.
Fraudster impersonated both companies
The scheme began after an unauthorized party gained access to at least one Stutman employee’s Microsoft email account in July 2023, according to the court.
The person behind the scheme also registered internet domains designed to resemble those belonging to Stutman and Hussey. Investigators found that an email rule had been created to divert legitimate messages from Hussey away from their intended recipient.
The fraudulent emails appeared to come from Hussey employees and told Stutman that the seating company had changed its banking information.
The scammer then provided new wire-transfer instructions for an account that did not belong to Hussey.
According to the court record, Stutman did not independently confirm the banking change with Hussey before sending the money.
The fraudulent domain was particularly similar to Hussey’s legitimate web address. Hussey uses husseyseating.com, while the fraudulent messages came from addresses using husseyseatnig.com, with letters in “seating” transposed.
The scammer also impersonated Stutman in communications with Hussey, creating the appearance that the two companies were communicating normally.
More than $731,000 was transferred
Stutman sent the first payment — $178,634 — on Aug. 8, 2023.
Two additional wire transfers followed between August and October, bringing the total sent to the fraudulent account to $731,861, according to the court.
At the same time, the fraudster continued communicating with Hussey while posing as a Stutman employee and indicating that payment was being made.
The deception was discovered Oct. 12, when Hussey contacted Stutman about the unpaid invoices. The companies then realized that a third party had been impersonating them.
Stutman reported the incident to police, and the U.S. Secret Service became involved in the investigation.
Court records also describe an incident in which someone posing as a Stutman employee obtained payroll information from Hussey. Investigators said that information was subsequently used to make the fraudulent communications appear more credible.
Companies disputed who was responsible
The loss led to a legal dispute between Stutman and Hussey over who should ultimately bear responsibility for the missing money.
Hussey sought payment through a bond obtained by Stutman to protect payments owed to subcontractors and suppliers. Stutman subsequently sued Hussey, alleging, among other claims, breach of contract, negligence and violations of the Massachusetts Consumer Protection Act.
Hussey denied responsibility and argued that weaknesses in Stutman’s computer security contributed to the fraud. The company also maintained that its own systems had not been compromised.
A forensic examination found evidence that a Stutman employee’s email account had been accessed without authorization. A separate cybersecurity review found no evidence that Hussey’s systems had been breached.
Judge says Hussey was still owed payment
Guzman ruled that Hussey had not breached its subcontract by seeking payment from Stutman.
The judge found that the contract obligated Stutman to pay Hussey for the work it performed. Sending money to an account controlled by someone impersonating Hussey did not satisfy that obligation.
The ruling means the fact that Stutman transferred the money to the fraudulent account did not eliminate its contractual obligation to Hussey.
The federal case stems from the companies’ dispute over the financial consequences of the 2023 email fraud. The court docket identifies Stutman Contracting as the plaintiff and Hussey Seating Company as the counterclaimant in the contract litigation.
