The recent email spear phishing attack on the city of Ocala involved a fraudulent payment of nearly three quarters of a million dollars.
In September, scammers posing as an accounting specialist with Ausley Construction Co. sent an email instructing the city to “update” its bank account information and provided an electronics funds transfer form with a new routing number. On Oct. 17, the city made a payment of $742,376.73 to what it believed was Ausley Construction’s Fifth Third Bank account for work on a new terminal at Ocala International Airport, an Ocala Police report states.
The transaction was completed on Oct. 18 and the city became aware it was the victim of fraud four days later when Ausley Construction reported that it hadn’t received payment. The person whose name was used in the scam is a former employee of Ausley Construction and he told police he didn’t send the email, the report says.
Ocala Director of Finance Emory Roberts said city officials have no idea how the scammers gained knowledge of the relationship with Ausley Construction or the vendor number provided on the electronics fund transfer form. He also told officers that the woman who changed the banking information is no longer a city employee, the report says.
The city has filed an insurance claim in hopes of recouping the lost funds and is reviewing internal policies to avoid a similar situation from happening in the future. The scam has been identified as an isolated incident and an analysis confirmed that the city’s information systems and customer data weren’t compromised.
“While the City of Ocala recognizes governmental transparency, an active criminal investigation into bank fraud is under way and our ability to discuss this matter publicly is limited until the investigation has concluded,” said Ashley Dobbs, Ocala’s marketing and communication manager. “We take our city’s cyber security seriously and employees participate in mandatory trainings to arm them with the skills needed to identify and report these sophisticated campaigns. While we can’t change this outcome, we will continue to update and refine our cyber security systems and trainings to minimize future impacts.”
Roberts also advised officers that the City of Naples recently fell victim to a similar scam. An officer conducted online research and confirmed through articles written in August that Naples was the victim of a spear phishing campaign to the tune of $700,000. Naples also received an email from someone posing as a construction group that requested their routing number be changed for future payments, the report says.
Ocala officers planned to speak with Naples police detectives to learn more about the incident and hopefully determine if they are connected, the report says.