Athens lost $721,976 after lookalike Pepper Construction domains entered a real email thread

Athens, Ohio, deposited $721,976 into the wrong account after lookalike Pepper Construction domains slipped into a live email thread about the new fire station. On the morning of November 14, 2024, a city employee got a message that seemed to come from an accountant at Pepper Construction asking whether the next payment — more than $700,000 — could go by direct deposit instead of check so subcontractors got paid on time. The city said yes if they set up electronic pay. Forms went out. The next day, November 15, Athens sent the money to a Republic Bank checking account.

Those messages weren’t from Pepper. Scammers had been watching a real thread between the city’s grants administrator and Pepper’s Evan Grootenhuis. Pepper’s real domain is pepperconstruction.com. The imposters used pepperconstrcution.com (c and u swapped) and pepperconstructlon.com (l for i) — easy to miss when you hit Reply. Domains traced to an Iceland registration. Days later, when someone posing as Grootenhuis tried to push a second bank change after a story about a “vandalized mailbox,” city account administrator Jessica Covert flagged the odd addresses. The real Grootenhuis confirmed: not us.

A lookalike domain inside a living thread beat a cold spam filter. Before you change how a big invoice gets paid, match the domain letter by letter — or call a number you already trust.

If you want a plain read on whether strangers can email as your company — spoofcoach.com. Free.