June 25, 2024

January 25th marked a celebratory occasion for Fort Lauderdale, Fla., with Mayor Dean Trentalis and Police Chief William Schultz declaring at a media briefing that a misappropriated electronic payment of $1.162 million, intended for Moss Construction, was finally retrieved. This payment had been unlawfully obtained in September via email phishing subterfuge.

The FBI, the U.S. Secret Service, and the local police force had together probed the misrouted funds, which were a compensation for work done on a $100-million police headquarters—a three-level edifice.

Dissimilar to another recent photographic email scam where a building payment was purloined—last year’s thievery of a $735K down payment for a warehouse in Minnesota—this inquiry got underway shortly after the money was miscued.

As per a press release from the U.S. Secret Service, “the incident” transpired on Thursday, Sept. 14, 2023, and the theft was disclosed by the city six days later.

In comparison, the Minnesota phishing scam went undetected for a month, as alluded to by courtroom documents in lawsuits and liens arising from that vanished payment.

If additional weeks had lapsed, it’s plausible the money wouldn’t have been recouped as the Florida scam—orchestrated by an international criminal syndicate—was vying to translocate the funds from the temporary accounts they were stashed in. All three accounts were held by other prey of the malefactor group who were tricked into launching them as part of email love affair traps.

A diagram conceived by city officials shows the funds were secured while in transit via checks from the primary account into which the contractor’s compensation was erroneously dispatched via a $491,000 personal check and a $550,000 cashier’s check.

City authorities demonstrated how funds were retrieved in the three-story police headquarters phishing scam.
Screenshot: WTVJ-Ft. Lauderdale

“They pinpointed them rather swiftly, froze the assets, and then accomplished retrieving them back” prior to their transformation into cryptocurrency or relocation into a foreign bank account, articulated Schultz at the briefing.

The online robbers managed to amass forms and process required for Fort Lauderdale to disburse the progress compensations. “They possessed all that,” Trentalis remarked.

After an employee from the city’s Finance Bureau delivered the funds on September 14th, the finance section alerted the police department’s economic crimes investigators, who “instantly embarked on tracing the money,” as stated by the city police in a January press release.

The identities of the malefactors behind the theft and recovery of the payment are still under wraps, as are any related arrests, according to a police department spokeswoman.

In a January pronouncement, Fort Lauderdale-based Moss Construction affirmed that the firm’s “systems were never breached, and our data remained safe and secure.

“The facts are transparent: malicious actors exploited our solid reputation and general public data recoverable from a rudimentary internet hunt to inflict harm,” the statement read.

With phishing thefts of building payments escalating, some contracts now incorporate fraudulent funds transfer provisions. These may encompass obligatory security measures, notification procedures, and apportionment of obligation for misplaced funds. The U.S. Secret Service advocates calling a known point of contact via phone rather than modifying banking data via email, sending emails directly to a known address instead of replying to a conversation, and scrutinizing the email domain title.

Security experts generally recommend utmost caution if an email, regardless of how genuine it seems, demands a switch in the method or the account where a payment ought to be disbursed.