After keeping quiet for days, the city of El Paso, Texas, has finally admitted that it has fallen prey to "CEO fraud" emails that saw scammers funnel $3.2m from the authorities using bogus invoices.

The city is building a $97m streetcar project in its downtown district, but red flags were raised in October when a key contractor complained that its invoice hadn't been paid. An investigation showed a $300,000 payment had been diverted to an unknown bank account, and a second transfer of $2.9m has also been redirected.

"It's an ongoing investigation and we never wanted to jeopardize the ability to regain the taxpayers' money and also to hamper the ability of law enforcement to be able to do their jobs," said Mayor Oscar Leeser, the El Paso Times reports [survey required].

"So, it was very important to us that we did everything possible to keep it from going out public and then ruining the possibility of ever recovering the money and, then again, stopping law enforcement from ever doing their job."

City Attorney Sylvia Firth later acknowledged that the city hadn't been instructed by the police to keep quiet about the fraud, but had simply been advised that it might be better to do so. The Reg is sure having the news break before the upcoming elections on Tuesday didn't factor into the city's decision to minimize publicity.

So far, $292,000 from the first invoice has been recovered and nearly $1.6 million from the second. In the meantime, the city is reverting to paper-only invoicing until it works out exactly what went wrong.

"I couldn't say at this point who approved the payment, but we are aware of it and at this time we want to make sure that it doesn't happen again moving forward," said Leeser.

The FBI has already warned that this kind of fraud is skyrocketing, with $3.1bn lost in the last year around the world – nearly a billion of that from US companies. ®