“Just One More Payment”: The Rise and Fall of a Midwest Banker

When it came to money, Shan Hanes should have been a difficult man to fool.

He grew up on his family’s farm outside Elkhart, Kansas, graduated near the top of his class, and spent the next three decades building a career in community banking. He eventually helped assemble the group of investors that acquired the local bank, became CEO of Heartland Tri-State, chaired the Kansas Bankers Association, and testified before Congress on rural banking issues.

Hanes’ life in Elkhart extended well beyond the bank. He raised three daughters in town with his wife, Michelle. He preached at the Elkhart Church of Christ and served on the local school board. When his daughters took up competitive swimming, Hanes became a swim official so he could spend more weekends with them.

He was the kind of guy people were accustomed to trusting. Even after Heartland collapsed, his defense would argue that many of the people most devastated by his actions could still remember times when Hanes had quietly helped them.

It’s tempting to read what happened next as the story of one unusually gullible banker. But social engineering has never depended on finding stupid people. It depends on understanding the target well enough to know which story they’re most likely to believe.

Hanes had spent most of his adult life making sound financial decisions. They’d carried him from humble beginnings to the halls of Congress. Then, in late 2022, Hanes received a whatsapp message from someone who called herself Bella.

The public record tells us remarkably little about what Hanes saw in Bella. We don’t know whether he enjoyed the attention, trusted her investment advice, or simply saw an opportunity too good to ignore.

We know the conversations were friendly. Over time, Bella introduced a new topic: cryptocurrency. She spoke about an aunt who supposedly operated a successful crypto investment business in Australia and suggested Hanes try it for himself.

Hanes wasn’t an amateur investor chasing internet hype. He’d spent a career in finance, understood markets, and managed a community bank. Whatever he believed about Bella and the opportunity she described, he decided it was worth testing with approximately $5,000 of his own money.

The investment seemed to be performing exactly as promised. Every time Hanes checked the account, the balance had hit another gear. What began as a cautious experiment with a few thousand dollars grew into six figures, then seven.

By the time Hanes decided to cash out, he believed he was looking at one of the greatest investments of his life. The account showed more than $200 million.

There was only one problem. He couldn’t get the money out.

Before the funds could be released, Hanes needed to send some more cash. There were fees to cover, taxes to pay, new requirements standing between him and his new fortune.

Against $200 million, what was another payment? So Hanes paid. When the money still didn’t come, he paid again. The $200 million was still trapped, and now Hanes had even more money tied up trying to reach it.

At $5,000, walking away meant admitting he’d made a bad investment. After the next payment, it meant accepting a larger loss. Then a larger one.

As long as the fortune remained on the screen, none of the money was really gone. One more payment, and he could get it all back.

Eventually, Hanes ran out of his own money. He emptied roughly $60,000 from his daughter’s college savings account. Now walking away no longer meant just accepting his own losses, but his daughter’s as well.

So Hanes found more money. He took $10,000 from the Santa Fe Investment Club, a local investment fund he managed. Still, the fortune remained out of reach.

Then came $40,000 from the Elkhart Church of Christ, where Hanes preached.

With every new line he crossed, stopping became harder. Find money somewhere, anywhere, and the story might still have a different ending. Stop, and every terrible thing Hanes had already done would become real.

Years later, standing in federal court, Hanes would describe the trap he’d found himself in: “What I thought was just getting the money back was making it worse.”

But Hanes had one more card to play. He still had access to a bank.

On May 30, 2023, Shan Hanes sent $5 million of Heartland Tri-State Bank’s money to a cryptocurrency wallet. Getting $40,000 out of his church had required Hanes to cross a moral (and legal) line. But this $5 million required other people to follow him across it.

Heartland employees processed the wire transfer dutifully. Hanes was their CEO, and according to federal investigators, his influence over the bank was so substantial that employees circumvented internal controls at his direction.

Among them was Heartland’s chief financial officer, Mandy Burton. She would later tell a federal judge that Hanes lied to her, offering explanations convincing enough that she approved a total of eight fraudulent wire transfers.

At this juncture, most people would have thrown up their hands and accepted that the jig was up. But as long as $200 million still existed on the screen, another ending remained possible. The moment Hanes stopped sending money, every terrible decision he’d already made would become irreversible.

Investigators would later identify what Hanes had fallen into as a pig-butchering scam, a form of social engineering in which attackers spend weeks or months cultivating a relationship before using that trust to convince victims to send increasingly larger sums of money. The name comes from the idea of “fattening up” a target before the financial extraction begins. The initial text wasn’t pig butchering so much as prospecting. By answering, Hanes identified himself as someone worth the scammers’ time. What followed—the months of conversation, trust-building, and escalating financial requests—was the pig butchering.

Between May and July, millions of dollars poured out of Heartland. When the bank needed more money to keep the transfers moving, Hanes drew on credit lines from a correspondent bank and the Federal Home Loan Bank.

The people in charge of the crypto platform kept demanding more, and Hanes kept finding new rocks to turn over to come up with the next payment.

Less than two months after the first fraudulent wire transfer, he had sent $47.1 million through a series of wire transfers into foreign cryptocurrency wallets. The bank was insolvent.

On July 28, Kansas regulators closed Heartland Tri-State Bank. The jig finally was up.

Bank employees, investors, and investigators watched as the smoke cleared, revealing an enormous crater where their money used to be.

To the people of Elkhart, there would have been little practical difference between a trusted banker who deliberately stole millions and one who lost them chasing a phantom fortune. Either way, Shan Hanes looked to the 2,000 residents of his midwest community like the second coming of Bernie Madoff.

When Shan Hanes finally walked into federal court, there was very little left to argue about. He had admitted sending $47.1 million out of Heartland Tri-State Bank.

The bank was gone. The money was gone.

The town demanded an explanation. What kind of man does something like this? Or, as former Heartland VP Dan Smith said during the trial, “I’d just like to know why [Shan] would do this… For whatever reason, you burned it to the ground.”

There are two ways to tell Shan Hanes’s story.

The defense tells a tale not unlike that of George Bailey, fictional banker and community folk hero from 1946’s It’s a Wonderful Life.

A farm kid from western Kansas. A near-perfect student. A community banker who spent three decades helping build the institution that anchored his hometown. Father of three, church preacher, school board member. The kind of man people trusted with their savings because, frankly, he’d earned it.

Hanes never intended to become a thief, insisted the defense. He just made one catastrophic mistake after another. Each decision became a more desperate attempt to put everything back before anyone realized what a mess he’d made. By the time he understood there was no getting the money back, he’d crossed so many lines that turning around meant surrendering the entire ethos he’d built up over the last several decades.

“He was to take some of the money, and the rest of the money was supposed to go back to the bank,” said defense attorneys.

For his part, Hanes told the court: “From the deepest depth of my soul, I had no intention of ever causing the harm that I did… I’ll forever struggle to understand how I was duped…”

In the prosecution’s story, Hanes looks more like Wallstreet’s Gordon Gekko, not because he coveted Ferraris or private jets, but because success had become part of his identity. He’d become convinced his own judgment could solve any problem. A brilliant overachiever whose life had rewarded his confidence at every turn. Top of his class. President of his bank. Chairman of the Kansas Bankers Association. A man who’d become accustomed to getting anything he set his sites on.

His life rewarded confidence. His authority opened doors. His instincts catapulted him from a little farm to the C-suite. Then, for the first time, those instincts failed him. Rather than accept the loss, he doubled down, tripled down, and so forth. Protecting the illusion became more important than protecting the people who trusted him.

“Hanes’ greed knew no bounds,” said the Kansas DOJ of Hanes. “He trespassed his professional obligations, his personal relationships, and federal law.”

In that story, the first successful investment wasn’t a mistake. It was the first tantalizing whiff of victory. The numbers kept going up. The wins kept getting bigger. And as more and more evidence pointed to the whole operation being a house of cards, Hanes couldn’t accept losing. Every wire transfer became another attempt to stay in the game. Every lie bought him one more chance to chase the fortune that would prove he’d been right all along. It’s a cautionary tale about greed.

As Heartland Tri-State Bank’s chief financial officer, Mandy Burton’s job was to make sure money left the bank for the right reasons. For years, one of the people giving her those reasons was Shan Hanes.

Like most finance officers, Burton wasn’t expected to investigate every decision made by the chief executive sitting a few doors down the hall. She was expected to ask questions, review documentation, and rely on the integrity of the people charged with leading the institution. For years, there had been no reason to believe that wasn’t enough.
As Heartland Tri-State Bank’s chief financial officer, Mandy Burton’s job was to make sure money left the bank for the right reasons. For years, one of the people giving her those reasons was Shan Hanes.

Like most finance officers, Burton wasn’t expected to investigate every decision made by the chief executive sitting a few doors down the hall. She was expected to ask questions, review documentation, and rely on the integrity of the people charged with leading the institution. For years, there had been no reason to believe that wasn’t enough.
At Hanes’s sentencing, Burton told the court she approved eight wire transfers because Hanes lied to her about what they were for. No sophisticated malware or forged credentials. No breach of the bank’s security systems. Just a trusted colleague explaining away a transaction, and another trusted colleague believing him.

When the bank collapsed and Hanes became embroiled in a federal investigation, Burton remained behind. Someone had to stick around to face the music.

“I was left to deal with regulators and investigators,” she told the court. “I worked twenty-one days straight.”

Burton and her husband were also shareholders in the bank. When it failed, they lost a lot more than twenty-one nights of sleep.

Trust has a way of cascading. The people of Elkhart trusted Hanes to run their bank. Hanes trusted Bella. Mandy Burton trusted Hanes. Each decision made perfect sense to the person making it. When the chain finally broke, there were hundreds of people in the blast radius. Said one Heartland shareholder, “The only thing we’re guilty of is that we trusted that man too much.”

The presiding U.S. District Judge John W. Broomes had heard enough. He issued a sentence of 293 months (over 24 years) in federal prison, telling Hanes, “Out here on the southern plains there’s still a sense that community means something, a man’s word is his bond.” He continued, “Your conduct has injured your community in a way that’s not easily captured with words.”

Addressing the community at large, Judge Broomes stated: “[Hanes] had many opportunities to stop his criminal behavior. A sentence is required that will deter future conduct. There is no basis for a downward variance,” as well as “People need to leave here feeling that justice is done.”

Both the defense and the prosecution built their stories out of the same core facts. The prosecution reconstructed Shan Hanes to contextualize his sins. The defense reconstructed him to contextualize his humanity.

But the people behind Bella had already put Shan Hanes on trial months before the courtroom ever did. They were trying to predict him. Every conversation was another opportunity to test that prediction against reality.

If Hanes was George Bailey, exploit his need to fix things.

If he was Gordon Gekko, exploit his need to win.

If he was lonely, offer companionship.

If he was ambitious, offer opportunity.

If he was afraid, offer hope.

The profile determines the lie.

While lawyers in Wichita debated whether Shan Hanes was a fundamentally good man or a fundamentally greedy one, the people responsible for the entire affair were thousands of miles away. They would never see the inside of the courtroom. They probably didn’t even know Shan Hanes’s name until after he answered the first message.

Bella almost certainly never existed. She was a carefully-constructed persona. The person who sent the opening message may not even have been the same person with whom Hanes continued to engage. By the summer of 2023, “Bella” had likely become a relay of different operators, specialized teams, and carefully rehearsed scripts. The operation doesn’t require a master manipulator. It was designed that way.

Across parts of Myanmar, Cambodia, Laos, and neighboring countries, organized criminal syndicates have built sprawling scam compounds dedicated to exactly this kind of fraud. Many are staffed by people who were themselves trafficked into the compounds after accepting what they believed were legitimate job offers. Once inside, passports are confiscated, movement is restricted, and workers are often beaten, threatened, or tortured if they fail to produce enough money from victims abroad.

Every morning, thousands of those workers sit down in front of rows of computers and begin sending messages to strangers all over the world.

Most never receive a reply. But that’s okay, because finding victims is a numbers game. This isn’t a fisherman with a rod and a hook. It’s a dragnet cast wide into the open ocean.

Former workers, leaked training manuals, and academic researchers describe an operation that resembles a modern call center more than a traditional confidence scheme. One team specializes in initiating contact. Another takes over once a target shows interest. Others focus on fake investment platforms, payment extraction, or keeping victims engaged after they’ve begun sending money. At any given moment, thousands of nearly identical schemes are unfolding around the world. Hanes’ story has a particularly dramatic outcome, but the process that created it is exceedingly common.

The manuals are surprisingly ordinary. They don’t teach hacking so much as conversation. Ask about work. Ask about family. Mirror the target’s language. Reveal carefully fabricated details about your own life so they’ll reveal genuine details about theirs.

Researchers have fancy names for these techniques—Social Penetration Theory, Impression Management, linguistic accommodation—but the objective is pretty straightforward. Learn enough about another human being to predict what they’ll do next.

Whoever Bella needed to become, Bella became. Whether Hanes was motivated by duty, ambition, loneliness, greed, or some combination of all four ultimately mattered very little. To the people behind Bella, those were operational questions rather than moral ones. Every answer simply pointed toward a different version of the story.

The defense, the prosecution, and the town of Elkhart were all trying to understand Shan Hanes. But Bella wasn’t. She was trying to predict what he wanted, what he believed, and what kind of loss he couldn’t bear to accept.

In a traditional spearphishing campaign, most of the reconnaissance happens before the victim ever sees the first email. In Hanes’s case, much of that same work unfolded after the initial contact, allowing us to watch the attacker gradually build a profile through months of conversation. Either way, the objective is the same: before an attacker can manipulate someone, they first have to understand them.

Most social engineering attacks hide that process. Hanes’s story is unusual because it unfolded slowly enough for us to watch the reconnaissance happen one conversation at a time.
As organizations invested billions in endpoint detection, vulnerability management, and network security, technical intrusions became more expensive to develop, more difficult to execute, and more likely to be detected. Persuading a person often became far cheaper than exploiting a system.

Convincing someone to click a link, disclose information, or approve a wire transfer is often far less expensive than developing or buying an exploit capable of bypassing modern security controls.

The economics now favor reconnaissance and persuasion.
In Hanes’s case, the people behind Bella appear to have gathered most of what they needed through months of conversation. Today, much of that work can happen before the first message is ever sent through professional biographies, corporate websites, public records, social media, breach data, and data brokers.

Bella spent months learning what many attackers can now discover in minutes.

Seen through that lens, publicly available personal information looks less like a privacy issue and more like an institutional security issue. Every piece of information an attacker has to earn instead of finding online increases the cost of reconnaissance. Every detail removed from an executive biography, every employee profile removed from a data broker, every unnecessary piece of information taken out of public circulation increases the cost of reconnaissance before the first conversation ever begins.