SARASOTA, Fla. (WFLA) — Kimberly Mallette’s heart sank when her roofing company knocked on the door to collect payment for a repair following Hurricane Ian.

That’s when she realized the $1,800 deposit she thought she’d already paid the company through the online payment platform Zelle actually went to someone else.

“I couldn’t believe it,” Mallette said. “There were no red flags.”

Mallette then learned that the crook who took her money was part of a sophisticated scheme hitting area contractors. It was crooks, she was told, who hacked into her contractor’s email system and sent her an email requesting payment through Zelle. Since the email appeared to come from the same company email address she had been corresponding with, she had no reason to believe this email wasn’t from her contractor.

“It was so believable,” Mallette said. “I want to warn other people so this doesn’t happen to anyone else.”

Officials at the roofing company say they recently realized their email system had been compromised, and they’ve been dealing with this for about six months. They say they know of at least one other company going through the same thing.

The company said it has made changes to secure its email system and did not make victims make their payments a second time.

What happened to Mallette could happen to any customer of any business, particularly contractors. And especially now, when so many Florida homeowners are taking on expensive home improvement projects. Following Hurricane Ian, many homeowners are replacing and repairing roofs.

Keep in mind, most contractors don’t accept payment through mobile payment apps. If you receive any email from any business with payment instructions, it’s best to call that person yourself – using a phone number you have used before, not one listed in the suspicious email – to confirm payment instructions.

This Zelle payment scheme is a twist on another hacking scam Better Call Behnken has reported on for years. Hackers have off and on targeted real estate and title companies in the same way. Emails and particular deals are sometimes monitored for months before the hacker strikes, sending the victim an email that changes the wiring instructions for a down payment, sending that money directly to the crook.

Home buyers have lost hundreds of thousands of dollars through this scam.

If you are the victim of any email transaction scam, you should report it to your local law enforcement agency and to the FBI.

Mallette credits Well Fargo with holding onto the money for four hours so had to time to alert them of the scam. Better Call Behnken reached out to Wells Fargo and asked if this is a new policy and how many similar complaints the company received and whether there’s any data to show how much money crooks tried to get in this type of scheme.

A spokesperson for Wells Fargo sent this statement about the incident:

“To help protect our customers, their accounts and the general public from fraud and scams, Wells Fargo has various resources, practices and strategies in place. We do not share information about specific fraud prevention systems to protect their effectiveness.”