Bally’s Evansville Scammed Out of $212K Through Vendor Phishing Scheme

Posted on: December 12, 2023, 09:46h. 

Last updated on: December 12, 2023, 12:01h.

Devin O'Connor @CasinoorgDevinO Read More
Expertise: Asia Pacific Gaming, Commercial Gaming, Legislation, Politics.

Officials with Bally’s Evansville in Indiana tell police the business was the recent victim of a phishing scam that resulted in the casino misdirecting more than $212K.

Bally's Evansville Indiana casino crime
The Bally’s Corporation says more than $212K was stolen from Bally’s Evansville through an email phishing scheme. The Evansville Police Department is investigating the claim. (Image: Bally’s Corporation)

The Evansville Police Department reports that Bally’s Evansville recently reached out to the law enforcement agency to report a suspected phishing scam.

Casino reps say the property was having work done by a construction firm. A caller who reached executives with the Bally’s venue claimed they experienced a problem with their work email and that a new email address would be used. That person then emailed Bally’s with a bank account and routing number for payment of the work that was done.

Bally’s officials say the casino paid the $212,671 invoice only to later realize that the telephone call and subsequent email and bank account were part of a con. No other details were provided by the police or Bally’s. An investigation is ongoing.

Bally’s Evansville is a land-based casino on the Ohio River. The 45,000-square-foot casino is equipped with 950 slot machines, 30 electronic and live dealer table games, and a William Hill Sportsbook. The casino is complemented by 350 guest rooms, four restaurants, and wedding and event space.

Gaming & Leisure Properties, Inc. (GLPI) acquired the casino, then known as Tropicana, in 2011 from Caesars Entertainment for $480 million. Bally’s paid GLPI $140 million to acquire the operating rights to the property. Bally’s pays GLPI $28 million a year in rent.

Casino Cybercrime

Casinos have made many unwanted headlines of late for being targeted by cybercriminals. MGM Resorts and Caesars Entertainment were the two highest-profile victims, with each company being targeted through cyberattacks this year.

MGM refused to pay a ransom, which resulted in lengthy resort operating disruptions at its U.S. properties. A cybergang reportedly gained access to MGM’s IT systems through a phone call where a culprit posed as an employee needing their login credentials reset.

A cybergang known as Scattered Spider claimed to have made the 10-minute telephone call to a help desk. The call resulted in the hacking syndicate gaining access to MGM’s internal systems and networks.

The FBI issued a Joint Cybersecurity Advisory last month advising casinos to be on high alert for data extortion schemes structured through social engineering manipulation. The FBI recommended that casinos take immediate steps to enhance their IT security.

The Bally’s Evansville incident doesn’t appear to be a cyberattack, but the case is yet another criminal assault on a casino owned by a major gaming operator. Before the MGM and Caesars attacks, casinos owned by tribal groups had been more commonly targeted by cybercriminals.

Evansville Scandals

Bally’s Evansville fired a former pit supervisor in March after local prosecutors charged him with running an illegal poker room.

Police say Edward Hill, 53, had been running illegal cash poker games for years. But his operations boomed during the COVID-19 pandemic when Bally’s Evansville was closed. Hill was charged with three felonies for running “Ed’s Poker Club” inside an Evansville office building.

In August, security at Bally’s Evansville busted a woman on the state’s casino exclusion list after she presented a fake $100 bill. Shatanya Bennett was charged with counterfeiting, cheating at gambling, false identity, and criminal trespass.