A Wisconsin school district paid two fraudulent invoices totaling $67,636 after emails impersonating its superintendent directed an employee to process educational purchases that had never been ordered.
Prosecutors allege the checks went to Laura Griffin of Pickerington, Ohio. Bank records cited in the criminal complaint showed the money entering an account in her name before $40,000 moved through Cash App and another $28,000 went to Crypto.com.
Griffin was charged with two felony counts of theft by false representation. Her attorney appeared for her July 27 initial court hearing, but Griffin did not, prompting a Door County judge to issue an arrest warrant.
The Emails Impersonated the School Superintendent
The first phishing email reached the Southern Door County School District in September 2025 and was designed to look as though it involved Superintendent Kevin Krutzik.
The address was not Krutzik’s official district account. According to the amended criminal complaint, the fake superintendent account forwarded an invoice to an accounting employee and requested that it be processed.
The first invoice sought $38,718 for a digital curriculum platform, robotics kits, online tutoring, teacher workshops and testing software. A second invoice requested $28,918 for professional-development workshops, coaching sessions, curriculum resources and certification management.
Both invoices instructed the district to pay Griffin and provided the same banking and mailing information. Investigators said the real superintendent was not involved in the email exchanges.
The District Mailed Two Checks to Ohio
The district sent a $38,718 check on Sept. 23, 2025, and a $28,918 check on Oct. 23. The first cleared on Oct. 1, while the second cleared on Oct. 30. Together, the payments totaled $67,636.
Investigators obtained records identifying Griffin as the holder of the U.S. Bank account where the checks were deposited. The account had been opened online, and the invoices were supported by a W-9 containing her identifying information, according to the complaint.
The district contacted law enforcement after discovering the phishing scheme. It also notified its bank and insurance provider.
The Money Allegedly Moved Through Cash App and Crypto.com
Bank records allegedly showed that the school’s money was quickly removed from Griffin’s account, leaving a balance of $17.18. Investigators traced $40,000 in withdrawals to a Cash App account registered to Griffin and another $28,000 to her Crypto.com account.
The complaint alleges that money sent through both services was converted into Bitcoin and transferred to multiple cryptocurrency wallets. Investigators traced some of the cryptocurrency to virtual-asset services based outside the United States, including platforms in the United Kingdom and Seychelles.
The complaint said the overseas transactions and peer-to-peer transfers limited investigators’ ability to determine who ultimately received the money.
Griffin Said an Online Boyfriend Directed the Transfers
When Ohio investigators interviewed Griffin in March 2026, she reportedly said an online man she considered her boyfriend had sent her the two checks and instructed her to move the money. Griffin said the man claimed to work for the Army and told her that the checks represented money being sent through an Army account.
According to the complaint, Griffin said she had already sent the man approximately $120,000 over five years, separate from the school district’s checks. She allegedly transferred money from bank and credit-card accounts and mailed him a copy of her identification and a cellphone.
Griffin said she had never used cryptocurrency before the man instructed her to convert the school funds. She also told investigators that they had communicated only through messages and that planned in-person meetings repeatedly failed to occur. Prosecutors accuse Griffin of obtaining the district’s money through false representations, and the case has not reached a plea or trial.
The District Recovered Most of Its Loss Through Insurance
The Southern Door County School District said its insurance provider reimbursed the financial loss apart from the policy deductible.
After reviewing its purchasing and cybersecurity procedures, the district expanded the types of transactions requiring purchase orders and provided updated purchasing training to employees. It also added email protections intended to detect phishing, brand impersonation and account takeovers, according to the district’s public statement.
A Judge Issued a Warrant After Griffin Missed Court
Griffin faces two counts of theft by false representation involving amounts between $10,000 and $100,000. Each charge is a Class G felony carrying a maximum possible sentence of 10 years in prison and a fine of up to $25,000 if she is convicted.
Her initial appearance was scheduled for July 27 in Door County Circuit Court. Griffin’s attorney appeared, but Griffin did not, according to Fox 11 News. The court issued a warrant for her arrest.
A New Vendor Should Not Be Approved Through Email Alone
The FBI advises organizations to verify payment requests through a known telephone number or an in-person conversation rather than replying to the email requesting the money. That review should cover the vendor’s identity, invoice, purchase order, delivery record and payment destination.
A school or business adding a new vendor can require approval from someone other than the employee processing the invoice. A claimed request from a superintendent, executive or department head can be confirmed through the organization’s internal email directory or telephone system.
The payment should also match a purchase order created before the invoice arrived. An itemized bill for curriculum, equipment or professional services does not prove that those products were requested, delivered or approved. Organizations that discover a fraudulent payment should contact the issuing bank immediately, preserve the email headers, invoices, W-9, check images and account information, and report the incident through FBI’s Internet Crime Complaint Center.