According to NorthJersey.com’s report, payments were sent to a fraudulent bank account set up under the name of a legitimate and longtime vendor of the city — Smith-Sondy Asphalt Construction Co. of Wallington.
Patient Crooks Scam City with Fake Account
According to an October 2022 interoffice memo and public records obtained by media, the scammers attempted to set up an account to accept electronic payments — known as the automated clearing house (ACH) system — in April 2022, which the city’s chief financial officer initially denied. The Smith-Sonday Asphalt Co. had always previously been paid via paper check, reports said. Fraudsters reportedly improved their tactics in the coming months, with a second request in September. This follow-up change-of-payment request — which included signed W-9 forms and other official documentation with the correct address and an accurate tax ID number — was approved by the city’s CFO. The payment was approved by city council members on Sept. 10, 2022, and an ACH electronic payment of $592,757 was made shortly thereafter.
City Council Left in the Dark
According to the memo between the city’s chief financial officer Joseph Kunz, city manager Dominick Villano, and the city attorney, Clifton city officials reportedly became aware of the scam on Oct. 12, 2022, after receiving a suspicious activity alert from the fraudulent payments division of Woodforrest National Bank. Council members were reportedly taken aback that they were just notified of the fraud last week during a budget meeting, though city administration officials had known of the scam for at least five months. The incident and documents were not released publicly until now because they were part of a criminal investigation, reports said. “Someone could have been in cahoots,” Villano reportedly said in the memo, as the investigation had to first ensure it was not someone “in house” orchestrating the scheme. The city of Clifton has been able to recover $346,000 of the stolen funds through insurance and expects to receive the remainder, reports said. The city has also paid Smith-Sondy what it originally owed for paving. A Clifton city police detective, Lt. Robert Bracken, said the perpetrator did well to conceal the act, which complicates the investigation. “The investigation is multi-layered and complicated due to the measures taken to conceal the origin of where the act originated and has led investigators on a paper trail through multiple states,” Bracken told NorthJersey.com. A lack of regulation and control over fraudulent business entities also allows them to continuously spoof their IP addresses and hide behind VPNs, as well as use disposable phones, the detective added.
Scams Aren’t Going Anywhere
Hybrid scams that bridge the digital and physical worlds are on the rise. Criminals are mixing email, phone calls, and real-world documents to exploit oblivious groups of people or unprepared departments across small cities. This sentiment was echoed in cybersecurity firm Mandiant’s 2023 cybersecurity forecast, which predicted that scammers will be using physical items like USB keys, receipts, fake ads, package deliveries, and more to lead victims toward digital crimes like financial and identity theft. In another example, U.S. unemployment funds were stolen by cybercriminals and U.S. inmates. As of last year, the U.S. Department of Labor stated that $163 billion in pandemic unemployment benefits were linked to fraud. For more information, have a look at our business email compromise article on how to detect several types of fraud, including vendor fraud.
