Southern Oregon University is far from the first public agency to be bilked out of large sums meant for construction payment.
A scam that defrauded Appalachian State University in North Carolina of $1.95 million in December is similar to SOU's in that they both involved large payments for construction projects being electronically intercepted, but the ASU case is farther along, and court records illustrate how the SOU scheme may have worked.
According to the Watauga Democrat newspaper in Boone, North Carolina, ASU's payment was for the school's new health and human services building. Nearly 80 percent of the stolen funds — more than $1.5 million — had been recovered as of the May 15 report.
Documents filed in U.S. District Court say that an ASU employee received an email from an unknown suspect who claimed to be a finance technician at the construction company, Rodgers Builders, with a deceptively similar return address. The genuine company's web address is rodgersbuilders.com, but the email used in the scheme was sent from email@example.com. Attached was a direct deposit form with instructions to change the builder's direct deposit account to another national bank.
ASU transferred the funds electronically using the Automated Clearing House network, and the scammer emailed staff saying that payment was successful, according to the Watauga Democrat.
A week later, the contractor said it hadn't been paid and the university learned something was wrong, the report says.
The FBI seized the account involved in the scam Dec. 27. Transfers from the fraudulent account were wired to national bank accounts with Bank of America, including $269,000 to Drone Media Centric, $150,000 to Earth Lab Inc. and a $460,000 cashier's check to Holding Properties.
In November, the city of El Paso, Texas, disclosed that two payments the previous month had been fraudulently intercepted — $2.9 million toward the construction of a streetcar project and $300,000 intended for a separate vendor, according to El Paso Times reports.
The most recent report doesn't say whether the two scams were related, but both involved phishing, the use of emails to obtain sensitive information such as usernames, passwords, and credit card details. Law enforcement has since returned more than $1.6 million from the larger payment, and $292,000 in the smaller payment. Suspects haven't been found in either case, reports show.
El Paso has since resorted to paper checks, the story said.