Emails reveal how City, regional mobility authority were scammed out of $3.2 million

The City has released a handful of emails related to the phishing scam that resulted in the misdirection $3.2 million in funds, most of it related to the streetcar project.

The City said it redacted the names of its employee and that of the Camino Real Regional Mobility Authority’s due to the ongoing investigation, although the CRRMA has only one employee, Executive Director Raymond Telles.

The first misdirected payment happened September 28, 2016 and involved $2.9 million in state funds for a project managed by the Camino Real Regional Mobility Authority (CRRMA), city officials said.

The second misdirected payment happened October 4, 2016 and involved $312,000 earmarked for city projects. The City has recovered $1.9 million and the investigation continues, city officials said.

The City has called the phishing scam “sophisticated.”

According to a timeline released by the City, on August 22, 2016, a fake vendor posing as “The Granite Construction Company,” a real company, exchanged a series of emails with the CRRMA.

During this exchange, the impostor allegedly submitted false checking account information that replaced the legitimate checking account information for Paso Del Norte Trackworks, city officials said.

A discrepancy in the vendor names was caught by a City purchasing department employee who brought it up to the attention of the CRRMA. According to the City’s timeline, the CRRMA told the purchasing department employee the vendor was just changing its checking account and to process the change.

CRRMA chairwoman Susan Melendez said it isn’t unusual for vendors to change account numbers.

“People do change banks, they sometimes change there name so those things do happen. In this case, remember this was a criminal element that created this fraudulent activity,” Melendez said.

The City is the CRRMA’s fiscal agent, meaning it handles all purchasing and financial matters.

In the emails, City employees appear to pick up on the discrepancies and ask the CRRMA for verification.

“Is this vendor going to be a regular vendor? If so, they are missing the CIQ and the Vendor information form. Please have them fill out the missing forms and send them to Vendor Management for processing,” an email from the City’s purchasing department employee states.

The CRRMA replied: “They are an existing vendor, but asked for the vendor forms because they changed their bank (I Think). Is that OK to submit like this then?”

The City’s purchasing department responded: “Yes. But do you know the vendor number? Will be much faster to process when you give me the vendor number. Thanks.”

The CRRMA then emails the vendor number to the the city employee.

The same day, the city received an email from the impostor Granite Construction: “Hi. Paso Del Norte Trackworks is a joint venture of Granite Construction Co. and RailWorks Track Systems Inc. We have a 65% of the contract, I believe. Would you require a different EIN (Employer Identification Number) number?”

The fake Granite Construction sent another email, stating, “I can get the direct deposit form resubmitted, does the joint venture (PDNT) we are managing have a separate EIN as I would have to get that form from (redacted) who has left the office.”

The CRRMA replies, “I think you can just resubmit with the PDNT (Paso del Norte Trackworks) information and that should take care of it.”

The purchasing department employee responds: “I noticed the Vendor number is for Paso Del Norte Trackworks. The W-9 that I received as an attachment is for Granite Construction Company, which has a different EIN number on the W-9. So if Paso Del Norte Trackworks changed their name and EIN number, then they have to resubmit all four forms and receive a new vendor number. Thanks.”

The impostor Granite Construction responded: “Please find attached the correct information. I just confirmed with (redacted) on the phone. No other details have changed other than banking details, despite this we have attached an up-to-date W-9 form. Thanks for the assistance.”

The CRRMA also responded to the city’s employee. “This is the original vendor form that you all submitted. Hope that helps,” and email states.

On September 19, 2016, the Granite Construction Company impostor allegedly contacted the CRRMA, the Comptroller’s Office, and the Purchasing Department to ask when the next payment will be processed.

An accountant in the Comptroller’s Office questioned the payment inquiry, but the CRRMA responded to the accountant and told him it has instructed Granite to contact it regarding all payment inquiries.

“I got word that the City received inquiries on payment status related to your question below. Can you please make sure and route any payment inquiries through me? The City is only the CRRMA’s fiscal agent. So, they won’t have any info on invoice reviews or payments – they only see an invoice once the CRRMA has reviewed it and is asking the City to cut a check. Thanks”

On September 29, 2016, the real Granite Construction Company contacted the CRRMA saying they had not been paid. The CRRMA did not contact the Comptroller’s Office, according to the City’s timeline.

On October 12, 2016, the Comptroller’s Office asked the real Granite Construction Office if they received the $2.9 million payments. The company said no, so the Comptroller requested Wells Fargo to recover the payment.

The CRRMA is an independent governmental entity formed by the City of El Paso in March 2007. It is regulated by the Texas Transportation Commission.

The City was granted authority to create the CRRMA and its board by the Texas Transportation Commission to study, evaluate, design, finance, acquire, construct, maintain, repair, and operate transportation projects.

The CRRMA has a seven-member board: six members are nominated by the Mayor and appointed by Council and its presiding chair is appointed by the governor.

During a special meeting Monday, El Paso Mayor Oscar Leeser asked the city attorney to look into whether the council can be the board that oversees the CRRMA. He said that, if the City will be held responsible for the phishing scam, they need to have oversight over the agency where it originated.

The City of El Paso provides the CRRMA organization with support services for its daily business operations, such as accounting, auditing, procurement and accounts payable, however the CRRMA executive director is the only one with the authority to approve vendors and invoices.

“I’ll tell you there were various things that in hindsight maybe we would have questioned but when you think you’re dealing with a legitimate entity then you treat them like you would normally do a regular vendor,” Melendez said.