On a Tuesday morning in South Carolina, a town clerk opened an email. It looked exactly like the one from the mayor—same signature, same tone, same request for a wire transfer. She authorized the payment. $545,000 gone. The town’s budget, community trust, and years of hard work evaporated in a single click.
You’ve probably read the headlines: “Town Falls for Sophisticated Phishing Scam.” But let’s stop pretending this was a failure of human vigilance. Email was never designed to be secure. It was designed to send messages. That’s the problem.
Every day, organizations large and small transact millions of dollars over a protocol—SMTP—that treats every email like a postcard. Anyone can write any address in the “From” field. No authentication required. No verification. No guardrails. The town’s email server didn’t check whether the mayor’s email actually came from the mayor because it couldn’t. The infrastructure let the spoofed email walk right in.
This isn’t a story about a clever criminal. It’s a story about a system that normalizes trust where trust shouldn’t exist. Blaming the town clerk is like blaming a bank teller for a forged check — the system failed, not the person.
We call this a “phishing attack” as if it’s some exotic technique. The reality is brutally simple: the scammer sent an email that looked real, and the email system had no way to tell the difference. That’s not a bug. It’s a feature of a protocol designed in 1982, when no one imagined that one day your tax dollars would be routed through a message that could be faked by a teenager with a laptop.
Here’s the part that should terrify you: this town had no DMARC policy. No SPF records. No DKIM signatures. These are the three pillars of email authentication—the equivalent of a lock on a door. Their absence means anyone can impersonate anyone. And the tech companies that provide email services? They don’t mandate DMARC enforcement by default. They leave it as an “advanced setting” that 99% of organizations never touch.
So we have a choice. We can keep blaming victims—the overwhelmed clerk, the underfunded IT department, the small town that can’t afford a cybersecurity team. Or we can admit that the global email infrastructure is broken by design and demand that it be fixed.
Security isn’t a feature you opt into. It’s a baseline that should be enforced on day one.
This isn’t just about one town in South Carolina. It’s about every municipality, every school board, every nonprofit, every small business that relies on email to move money. The next $545,000 could be yours. And the only thing standing between you and that loss is a few lines of DNS records that your IT provider probably never configured.
Stop calling this a “scam” and start calling it what it is: a systemic failure of the technology we use every day. The town clerk did her job. The email system didn’t do its job. And until we treat email authentication as a civic necessity, not a technical nicety, we’re all one click away from the same story.
FAQ
Q: Wasn't the clerk just careless?
A: No. The email looked exactly like the mayor's. Without DMARC enforcement, the email system cannot verify the sender. The clerk operated in a system that gave her no tools to detect the forgery. Blaming her is like blaming a pilot for a crash caused by faulty wings.
Q: What should I actually do right now?
A: Check your domain's DMARC policy. If you don't have one, set it to 'reject' (not just 'none'). Work with your IT provider to implement SPF, DKIM, and DMARC. Then enforce those policies on your email server. This takes a few hours and can prevent 99% of spoofing attacks.
Q: Isn't this just a small-town problem?
A: No. Large enterprises, banks, and government agencies have been hit by the same attack. The difference is that big organizations often have the resources to recover quietly. Small towns can't. But the vulnerability is universal—any email system without authentication is a ticking bomb.