City of El Paso duped out of $3.3 million in phishing scam

The City was “duped” and “robbed” of millions of dollars intended for the streetcar project, a source with knowledge of the investigation told ABC-7.

During a news conference Wednesday afternoon, city officials revealed a person or group pretending to be a vendor scammed the city out of about $3 million by using a phishing scam.

Phishing is when criminals pose as a legitimate person, business or agency to commit fraud. In this case, the fake vendor used email contracts to scam the city.

Dr. Mark Sutter, the city’s chief financial officer, said the first payment to the phony vendor was for about $300,000 and a second payment was for about $2.9 million.

The fraud was detected by the city’s Comptroller’s Office, according to a city news release. In early October, the comptroller notified the internal auditor the city may had fallen for a phishing scam resulting in about $300,000 lost. Internal controls were placed and law enforcement was notified, according to the city.

A couple of weeks later, during the investigation, the city and the Camino Real Mobility Authority or CRRMA found “an additional misdirection of funds” of about $2.9 million, said the release.

Sutter said the city has recovered about half of that money: nearly $1.6 million from the $2.9 million, and $292,000 from the $300,000 payment.

El Paso Police and the FBI are working on the investigation.

“We were able to work with the banks and law enforcement and were able to get that money back,” said Mayor Oscar Leeser.

Leeser, flanked by City Representatives Lily Limon, Cortney Niland, Carl Robinson, and Jim Tolbert, said little about the way the scam took place citing the pending investigation. He said giving more information could jeopardize the city’s ability to recover the rest of the money. Leeser said they’ve reviewed all vendor payments and were able to ensure this was the only problem.

City Manager Tommy Gonzalez said “We want to reassure the public that this situation is under control.”

City officials won’t reveal how the scam happened, whether it was an oversight or a failure of the vetting system and whether anyone will be held accountable.

The city’s news release states, “The City did not immediately inform the public about the phishing scam at the request of law enforcement to allow for an appropriate investigation and to increase the possibility of recovering the funds,” however, City Attorney Sylvia Borunda Firth said during the news conference law enforcement didn’t request that they not say anything, but advised them not to.

“More discretion will allow for a better investigation and more recovery of funds,” she said.

“I know you have a lot of questions,” said Leeser at the end of the brief news conference. “So do we.”