Fresno lost $400,000 to a phishing scam in 2020 and never told the public
THE LATEST: Fresno phishing scam dollar amount soars – and city wasn’t only victim, mayor says
The city of Fresno lost about $400,000 in 2020 after falling victim to an electronic phishing scam, and former Mayor Lee Brand’s administration failed to disclose the loss to the Fresno City Council and taxpayers, The Fresno Bee has confirmed.
Furthermore, the Fresno City Attorney’s Office in December 2021 rejected a public records request from The Fresno Bee seeking city communications regarding the fraud. The city told The Bee no records were located. However, The Bee recently obtained emails that existed prior to the records request.
The electronic fraud was disguised as an invoice from a subcontractor working on the construction of the new southeast Fresno police station, Councilmember Miguel Arias told The Bee. The invoice included the subcontractor’s letterhead, and only the account numbers were different. A city staffer completed an electronic money transfer, not knowing the invoice was a fake, he said.
In an interview Wednesday, current Mayor Jerry Dyer said two payments were made. Arias said city officials believe the money was sent to an account in Africa. (Update: Dyer said Thursday that the FBI believes the suspect is American.)
City officials first reported the incident to Fresno Police Department. The investigation was later handed over to the FBI after the federal investigators received a complaint from another jurisdiction involving the same suspect, Dyer said. The FBI asked city officials to keep the incident under wraps, so their investigation wasn’t compromised, Dyer said.
It appears less than $2,000 was recovered, and the rest of the money likely is lost, Arias said.
“It is my understanding that it’s the single largest loss for the city, in the case of a fraud,” Arias said.
“We want nothing more than to identify who took the money and to get it back and to hold those folks accountable, so they don’t victimize someone else,” Dyer said.
The Fresno City Council learned of the incident in 2021 when Dyer’s administration requested additional money from the general fund to cover the shortfall, Arias said.
In the interview with The Bee, Dyer said he learned of the loss about two months prior to taking office, and he put it on the council’s closed session agenda for the first meeting of 2021 after he took office.
“I felt the need as the incoming mayor to get off on the right foot and make sure that there was some transparency going on,” Dyer said.
“When he informed us of it, he was blindsided and surprised that council had not been informed of such a significant incident,” Arias said of Dyer. “So credit to the mayor for disclosing it to the city as he came into office, and shame on the previous administrative staff that kept it from the council and the public.”
Electronic fraud common
Online fraud has evolved from the Nigerian prince scam to become more elaborate. In 2020, vendor email compromise (VEC) was predicted to become the No. 1 electronic attack type. In a typical vendor email attack, scammers create fake invoices that look exactly like a real vendor’s, but they change the bank account information so that when a payment is issued, the money ends up in the scammer’s account.
“I think it’s important for the public to know that even organizations as large as the city, with its own police department and multiple safety measures in place, can be a victim of electronic products. It should be important for the public to take as many precautions as they can,” Arias said. “In this case, Fresno is not immune to folks attempting to defraud the city. They’re very complex financial schemes, so it’s unfortunate. Unfortunately, it happened to us.”
From his time as police chief, Dyer said he saw countless cases of online fraud.
“They would prey generally on people that were elderly, people who may be less suspicious,” Dyer said. “But I was not aware of these types of things are occurring in city government. Maybe there were others over the years that I may not have been privy to them. This is very rare, but I don’t think it’s going to be unique as we go forward in the future.”
Since the fraud occurred, the city has spent millions updating its IT infrastructure to protect the city’s private data and ward off additional scams, Arias said.
Dyer said the city controller’s office received additional training, and processes were modified to prevent similar situations in the future. For example, now multiple people look at invoices before transferring money, and employees may call vendors to verify invoices are real if there’s any suspicion they might not be.
The council also asked to be notified if a fraud case happens in the future, Arias said.
“If the city of Fresno, with all the protocols in place and safeguards, can become a victim of fraud like this, then the average citizen can much more easily be a victim. And I’ve seen those over the years,” Dyer said. “It really is important for people to be very careful when they’re on the internet or receiving any type of electronic communication.”
Public records denied
The Bee received a tip about the fraud case in 2021.
The Bee on Dec. 13 submitted a public records request to the city of Fresno requesting “any communication between Fresno City Councilmembers and Mayor Jerry Dyer’s administration regarding wire fraud during the calendar year of 2021.”
The city initially asked for an extension to fulfill the records request. Then, on Dec. 22, the city denied the records request, saying: “The City of Fresno has reviewed its files and did not locate records responsive to your request.”
However, earlier this week, The Bee obtained emails between Arias, former City Manager Thomas Esqueda, City Controller Michael Lima, and City Attorney Doug Sloan discussing the fraud.
In an email dated Dec. 1 with the subject line “$500k payment,” Arias asked Lima and Sloan, “What is the status of the payment we made to prince in Africa… Did we get our money back?”
Esqueda responded the same day, saying an FBI investigation was ongoing, and the city so far recovered about $1,600.
The email chain continued on Dec. 29, when Arias asked Esqueda and Lima where the loss would be accounted for in the budget.
“I can’t speak to why the administrative staff wouldn’t release something that’s clearly public interest and what I think is a public document, which is disturbing,” Arias said.
Dyer said the emails were privileged information since the city attorney was included. If the city rejected the request citing attorney-client privilege, that would’ve confirmed the existence of an FBI investigation, Dyer said.
Fresno Bee Editor Joe Kieta called the PRA denial “troubling.”
“When government officials deny the existence of records that clearly exist, it undermines public faith in the city in general and raises legitimate questions about transparency and whether those charged with handling public money are operating in good faith,” Kieta said Wednesday. “If they kept a nearly half-million-dollar loss secret for almost two years, what else haven’t they disclosed to the public?”
The loss was listed in the city’s 2020 comprehensive annual financial report, Dyer said, but it may not have been listed as a loss due to a crime.
Sloan explained that the city attorney’s office searched for the words “wire fraud.” Since those words didn’t appear in the emails obtained by The Bee, the city attorney’s office told The Bee there were no responsive records.
Dyer and Sloan insisted city staff did their due diligence.
Dyer agreed taxpayers should know about the loss, but he said the key was timing and balance in how it was reported.
“There is definitely a need for the public to be made aware of those things. It’s always about timing,” he said. “It’s like any type of criminal act that occurs. The primary focus or the priority is the investigation, trying to arrest somebody and then notification of the public or media.”
This story was originally published March 9, 2022 at 10:59 AM.
CORRECTION: An earlier version incorrectly stated which city office rejected The Bee’s public records request. It was the city attorney’s office.