MIDLAND, Texas (KOSA) – A Midland woman is accused of stealing more than $60,000 from her employer after an employee changed payment information in response to a phishing email.
According to an arrest affidavit, Kiyah Holman is charged with theft of property valued at $30,000 or more but less than $150,000, according to the affidavit.
The case began after a company employee reported the theft to Midland police on Feb. 24, the affidavit states.
According to the affidavit, the employee told police that on Oct. 31, 2025, she received what appeared to be an email from a business client requesting that the client’s accounts be changed.
The employee was instructed to change the account receiving payments.
The employee made the requested changes and subsequently sent current and future payments electronically to a different account, according to the affidavit.
The employee later learned the original email was a phishing message after the company received a call on Feb. 11 from a business saying it had not received outstanding payments, the affidavit states.
The affidavit initially lists a total of $63,599.38 in 10 electronic payments.
The transactions listed include payments of:
- $10,360
- $747
- $16,710.77
- $17,607.33
- $30
- $3,296.33
- $3,116.69
- $9,925.34
- $248.59
- $1,557.33
Police later subpoenaed bank records.
According to the affidavit, the account identified through the investigation was solely owned by Holman.
The records showed nine deposits from Permiacare totaling $62,042.05, including most of the transactions identified in the original report.
The affidavit does not explain the discrepancy between the $63,599.38 reported loss and the $62,042.05 in deposits identified in the records.
Investigators also got a comprehensive report on Holman in May.
The report showed four email addresses, with one matching an email address associated with the bank account, according to the affidavit.
It also identified two Social Security numbers, one of which matched the bank account, as well as multiple mailing addresses and eight driver’s licenses.
Police first subpoenaed records from a mortgage company, but the subpoena returned information showing the company did not have the requested bank-account information.
Investigators sent another subpoena requesting the bank records, according to the affidavit.
Holman was arrested and charged with theft of property valued at $30,000 or more but less than $150,000.
Copyright 2026 KOSA. All rights reserved.
