Elida S. Perez

El Paso Times

City officials publicly acknowledged Wednesday that they had fallen victim to email phishing scams that directed $3.2 million, a majority of which was intended for the Downtown streetcar project, to fraudulent bank accounts.

The El Paso Times first reported details of the scam on Wednesday, which involved someone posing as a vendor to obtain payment from the city. After the story was published on the newspaper’s website, city officials hastily called a press conference to address “talk” that the city had been scammed out of money and to defend its decision not to make information about the scam public.

Mayor Oscar Leeser, who was flanked by city officials and members of City Council, led the press conference, which lasted less than eight minutes and allowed for few questions from the media. He said the city chose to keep the information secret because it could hinder the investigation by law enforcement.

“It’s an ongoing investigation and we never wanted to jeopardize the ability to regain the taxpayers’ money and also to hamper the ability of law enforcement to be able to do their jobs,” Leeser said. “So, it was very important to us that we did everything possible to keep it from going out public and then ruining the possibility of ever recovering the money and, then again, stopping law enforcement from ever doing their job.”

Officials learned about the scam in early October after a vendor informed the city that it had not been paid.

Chief Financial Officer Mark Sutter said staff discovered that a $300,000 electronic payment to a vendor had been misdirected to a different account. The city then realized that a second electronic payment of $2.9 million on behalf of the Camino Real Regional Mobility Authority for the city’s streetcar project also had been misdirected.

City officials said they reported the incidents to the police and FBI in early October. They did not say how much time passed between learning of the fraud and notifying law enforcement.

Sutter said $292,000 was recovered by law enforcement from the first payment and nearly $1.6 million was recouped in the second case. The city has also reverted to issuing its vendors paper checks until further notice.

Initially, city officials said in a press release that they “did not immediately inform the public about the phishing scam at the request of law enforcement.”

But City Attorney Sylvia Firth acknowledged during the news conference that law enforcement did not direct the city to withhold the information from the public, rather law enforcement advised “that more discretion would allow for a better investigation and a better chance of recovery of the funds.”

Firth added, “So, there has been a couple of weeks delay in sharing information but in that time, as you can see, we have recovered a substantial amount of the money.”

City officials did not say when they had planned to inform the public about the fraud. They did so after the Times began asking questions on Wednesday.

The FBI declined to comment on the investigation, but described the role it can play when fraud is discovered.

Keith Byers, assistant special agent in charge of the El Paso office, said the FBI is uniquely positioned to investigate financial crime and fraud schemes because it has 56 field offices throughout the United States and 60 overseas offices.

“Whenever the FBI is promptly notified that a corporation or government entity has been the victim of such a scheme, we potentially can work with the banking industry to recover the victim’s funds,” he told the Times.

"The FBI encourages businesses and government agencies to be skeptical and cautious whenever receiving any emails directing the recipient to send wire transfers to a new account or monetary payments to a new physical address," Byers said.

Nationally, the FBI has released several warnings about fraud schemes, known as business email compromise scams, which have resulted in losses of more than $2.3 billion. In one example, a business that has a longstanding relationship with a vendor is sent an invoice and asked to wire a payment to a fraudulent account. The scam is also known as “the bogus invoice scheme,” “the supplier swindle” and the “invoice modification scheme.”

Leeser said he could not disclose additional details about the scheme or the city’s response because of an ongoing investigation. He said law enforcement agencies are still trying to recover the remainder of the stolen money, primarily from the $2.9 million payment made on behalf of the Camino Real Regional Mobility Authority for the streetcar project.

The CRRMA is a political subdivision of the state that was created by the El Paso City Council in 2007 to handle major transportation projects like the Downtown trolley.

The El Paso city government acts as the fiscal agent for the CRRMA, including paying vendors.

“I couldn’t say at this point who approved the payment, but we are aware of it and at this time we want to make sure that it doesn’t happen again moving forward,” Leeser told the Times before the press conference.

Brian Cassidy, an attorney for the Camino Real Regional Mobility Authority, said the agency didn’t make the fraud public out of fear of prejudicing an ongoing criminal investigation.

He said the regional authority was not asked by law enforcement to withhold the information from the public, but made the decision on its own.

Cassidy, an attorney with the Austin office of the Locke Lord law firm, declined to say when the fraud occurred, or how long the agency had been aware of it.

Other officials from the Camino Real Regional Mobility Authority, which oversees a number of major transportation projects in the El Paso area, declined to comment on the fraud.

Leeser said that the timeline for the streetcar project has not been affected by the financial scam and the city is hoping that the budget is not affected either.

“We haven’t gotten to that point yet because we are really optimistic and hopeful that we’ll be able to recoup our money,” Leeser said.

Work on the $97 million project began in late December and has thus far remained on schedule and within its budget, despite a number of change orders that have been recently issued for various aspects of the project.

Funding for the project came from the Texas Department of Transportation.

TxDOT spokesman Mark Cross said the state agency is aware of the scam.

“We are available to assist the Camino Real Regional Mobility Authority in any way possible to help rectify the situation,” Cross said in an email.

Cross said he could not comment on questions about whether there are procedural requirements for municipalities receiving state dollars to report such fraud to the department of transportation or if the city and the regional mobility authority followed such procedures.

He also said he could not confirm who reported the loss to TXDOT, but said the agency was informed of the incident before Wednesday.

“All that I can tell you is that our internal audit staff is looking into the matter and we are coordinating our efforts with law enforcement, which is now involved in the issue,” Cross said in an email.

Elida S. Perez may be reached at 546-6137; eperez@elpasotimes.com; @ElidaSPerezEPT on Twitter. El Paso Times investigations coach Zahira Torres and editor Robert Moore contributed to this story.