Agency chair claims emails released in EP phishing scam tell only part of the story

The chairwoman of an agency hit the hardest by a phishing scam that duped the city of El Paso out of millions of dollars says the recently released emails only tell part of the story.

The city of El Paso released a handful of emails related to the scam that resulted in the misdirection $3.2 million in funds, most of it related to the streetcar project.

The city said it redacted the names of its employee and that of the Camino Real Regional Mobility Authority’s due to the ongoing investigation, although the CRRMA has only one employee, Executive Director Raymond Telles.

Susan Melendez is the chairwoman of the CRRMA. She would to see the city release the remainder of the emails related to the scam.

“They may have reasons of their own, but it did not paint the full picture in my opinion. What’s missing? Well, there is information again that I don’t want to pre-empt the city. There are some additional emails that I think would close some of those gaps,” Melendez said.

The first misdirected payment happened Sept. 28 and involved $2.9 million in state funds for a project managed by CRRMA, city officials said.

The second misdirected payment happened October 4 and involved $312,000 earmarked for city projects. The city has recovered $1.9 million and the investigation continues, city officials said.

“It looked and appeared to be dealing with a legitimate party. Unfortunately, we all could be subject to that from the largest companies, to federal, to government agencies. These criminals are very sophisticated and very good,” Melendez said.

The CRRMA board has a meeting scheduled for Friday. Melendez said members will discuss what actions, if any, to take concerning Executive Director Telles.

The board will also discuss El Paso City Council members looking to take over as the board of the CRRMA. A move supported by City Rep. Cortney Niland.

“We need to know what checks and balances are in place when they are not good stewards for the money they have been appropriated. Because that it exactly what happened here,” Niland said.

Melendez wants the board left alone, and said the agency is considering hiring a second employee. The board will also discuss how to make up for the money not recovered from the scam.

According to a timeline released by the city, on Aug. 22, a fake vendor posing as “The Granite Construction Company,” a real company, exchanged a series of emails with the CRRMA.

During this exchange, the impostor allegedly submitted false checking account information that replaced the legitimate checking account information for Paso Del Norte Trackworks, city officials said.

A discrepancy in the vendor names was caught by a city purchasing department employee who brought it up to the attention of the CRRMA. According to the city’s timeline, the CRRMA told the purchasing department employee the vendor was just changing its checking account and to process the change.

Melendez said it isn’t unusual for vendors to change account numbers.

“People do change banks, they sometimes change their name so those things do happen. In this case, remember this was a criminal element that created this fraudulent activity,” Melendez said.

The city is the CRRMA’s fiscal agent, meaning it handles all purchasing and financial matters.

In the emails, city employees appear to pick up on the discrepancies and ask the CRRMA for verification.

“Is this vendor going to be a regular vendor? If so, they are missing the CIQ and the Vendor information form. Please have them fill out the missing forms and send them to Vendor Management for processing,” an email from the City’s purchasing department employee states.

The CRRMA replied: “They are an existing vendor, but asked for the vendor forms because they changed their bank (I Think). Is that OK to submit like this then?”

The city’s purchasing department responded: “Yes. But do you know the vendor number? Will be much faster to process when you give me the vendor number. Thanks.”

The CRRMA then emails the vendor number to the city employee.

The same day, the city received an email from the impostor Granite Construction: “Hi. Paso Del Norte Trackworks is a joint venture of Granite Construction Co. and RailWorks Track Systems Inc. We have a 65% of the contract, I believe. Would you require a different EIN (Employer Identification Number) number?”

The fake Granite Construction sent another email, stating, “I can get the direct deposit form resubmitted, does the joint venture (PDNT) we are managing have a separate EIN as I would have to get that form from (redacted) who has left the office.”

The CRRMA replies, “I think you can just resubmit with the PDNT (Paso del Norte Trackworks) information and that should take care of it.”

The purchasing department employee responds: “I noticed the Vendor number is for Paso Del Norte Trackworks. The W-9 that I received as an attachment is for Granite Construction Company, which has a different EIN number on the W-9. So if Paso Del Norte Trackworks changed their name and EIN number, then they have to resubmit all four forms and receive a new vendor number. Thanks.”

The impostor Granite Construction responded: “Please find attached the correct information. I just confirmed with (redacted) on the phone. No other details have changed other than banking details, despite this we have attached an up-to-date W-9 form. Thanks for the assistance.”

The CRRMA also responded to the city’s employee. “This is the original vendor form that you all submitted. Hope that helps,” an email states.

On September 19, the Granite Construction Co. impostor allegedly contacted the CRRMA, the comptroller’s office, and the Purchasing Department to ask when the next payment will be processed.

An accountant in the Comptroller’s Office questioned the payment inquiry, but the CRRMA responded to the accountant and told him it has instructed Granite to contact it regarding all payment inquiries.

“I got word that the City received inquiries on payment status related to your question below. Can you please make sure and route any payment inquiries through me? The City is only the CRRMA’s fiscal agent. So, they won’t have any info on invoice reviews or payments – they only see an invoice once the CRRMA has reviewed it and is asking the City to cut a check. Thanks”

On September 29, 2016, the real Granite Construction Company contacted the CRRMA saying they had not been paid. The CRRMA did not contact the Comptroller’s Office, according to the City’s timeline.

On October 12, 2016, the Comptroller’s Office asked the real Granite Construction Office if they received the $2.9 million payments. The company said no, so the Comptroller requested Wells Fargo to recover the payment.

The CRRMA is an independent governmental entity formed by the City of El Paso in March 2007. It is regulated by the Texas Transportation Commission.

The City was granted authority to create the CRRMA and its board by the Texas Transportation Commission to study, evaluate, design, finance, acquire, construct, maintain, repair, and operate transportation projects.

The CRRMA has a seven-member board: six members are nominated by the Mayor and appointed by Council and its presiding chair is appointed by the governor.

During a special meeting Monday, El Paso Mayor Oscar Leeser asked the city attorney to look into whether the council can be the board that oversees the CRRMA. He said that, if the City will be held responsible for the phishing scam, they need to have oversight over the agency where it originated.

The City of El Paso provides the CRRMA organization with support services for its daily business operations, such as accounting, auditing, procurement and accounts payable, however the CRRMA executive director is the only one with the authority to approve vendors and invoices.

“I’ll tell you there were various things that in hindsight maybe we would have questioned but when you think you’re dealing with a legitimate entity then you treat them like you would normally do a regular vendor,” Melendez said.