Scammers snag county payment to contractor
From the Wakulla County Sheriff’s Office to FDLE and the FBI, a number of law enforcement agencies have been working to track down scammers suspected of purloining a payment of more than $195,000 sent by Wakulla County to pay a contractor, Shoreline Foundation, which investigators discovered was the victim of a business email compromise.
Shoreline Foundation has worked on rebuilding the pier at Mashes Sands, and the county’s bill for the work completed thus far was about $500,000.
According to a July 28 administrative report from the Wakulla County Sheriff’s Office , Steven Baird, the finance director for the Clerk of Court’s Office who also functions as the county’s budget, finance and accounting director, reported April 21 to the sheriff’s office that about $500,000 was possibly missing from county coffers.
This prompted the investigation.
According to the WCSO report, Baird said Shoreline submitted their first of two invoices to the county for $195,241.20, and asked that the payment be made via check submitted by the county via Federal Express to a Truist account maintained by Shoreline. The county also received an email purported to come from Shoreline asking that the payment come via Electronic Funds Transfer to the same Truist account.
In subsequent emails purported to be from Shoreline, the county was asked to send the funds via EFT to a Chase bank account instead. Baird said, according to the email purportedly from Shoreline, the reason for the change was that the Truist account was temporarily unable to accept EFT payments, so the county sent the $195,241.20 payment to the Chase account via EFT, and it posted on April 1.
The county received a second invoice from Shoreline for $311,220.75, and paid the second invoice to the same Chase account, which posted April 18.
After the second payment was made, Baird said Shoreline contacted Wakulla County to ask why neither invoice had been paid.
Once the suspected fraud was reported, law enforcement developed an investigative plan including contacting the FBI and FDLE Cyber Crimes, reviewing all emails and documents related to the two electronic payments, identifying fraudulent emails and their dates, reviewing bank documents by subpoenaing Truist and Chase Bank account data, and asking Shoreline Inc. to have an independent audit of their computer technology.
As part of the investigation, a special agent with FDLE assigned to the FBI Cyber Crimes Task Force discovered that on March 28, the domain SHORELIINE FOUNDATION.COM was created (note the two I’s instead of one), with an address listed in Harrisburg, Pennsylvania. There were also three suspect email addresses for the domain. On April 26, an attorney for Shoreline Foundation noted there were two contractor payments incorrectly sent to a third party based on fraudulent emails – for a total of more than $506,000. On May 25, that attorney reported that Shoreline’s independent IT audit revealed someone had put a filter on the company president’s email account, rerouting all of his incoming emails from Wakulla County to his junk mail. Investigators assumed this is how they bought themselves enough time to receive the wire without it being detected.
Using information provided by Chase JP Morgan Bank, investigators have tracked down the account where the Wakulla County payments went. Investigators have also used surveillance video to identify two suspects in the Houston, Texas, area making withdrawals from the Chase JP Morgan account. Local law enforcement there is also involved in looking for these suspects.
On July 1, WCSO was notified that the United States Department of Justice had accepted the case for a federal investigation, which would begin jointly with the Wakulla County Sheriff’s Office.
On July 7, 2022, investigators determined that Shoreline Foundation was the source of the phishing scam and had their business email compromised. That spoof domain is the source of the “spoof” emails used to correspond with Wakulla County.
The county’s payment of $311,220.75 was successfully retrieved from Chase Bank. The payment for $195,241.20 has not.
While the administrative investigation opened by the Wakulla County Sheriff’s Office has been closed, the criminal investigation is ongoing.
Investigators also recommended that the county conduct an independent audit of its computer technology as it relates to security protocols, strengthening firewalls and malware intrusion. WCSO also recommended that the county develop a written policy governing electronic payments to decrease the likelihood of funds being paid to an unintended bank account, and notify the payee by phone call or in writing to verify any changes or omissions for the payment process.
