$2.3M Peterborough scam started months earlier

An email scam that bilked Peterborough taxpayers out of $2.3 million began months before fraudulent transactions were actually made, but nobody at Town Hall ever noticed email misspellings or discrepancies that could have signaled a crime in progress.

The town announced Friday the U.S. Secret Service has recovered $594,000 of the missing money, reducing the loss to $1.7 million.

Vendor payments intended for the ConVal School District and bridge contractor Beck and Bellucci were misdirected to the fraudster in July and August, but the scam actually began in the spring, Town Administrator Nicole MacStay said. That’s when those behind the fraud first posed as being with other organizations and sent emails to the town, all in furtherance of the ultimate plot to target public money meant for the school district and the contractor, the two groups that receive the largest payments from the town, MacStay said.

“There were a number of organizations that they were copying the emails of people we know of and deal with on a regular basis,” MacStay said in an interview.

The emails, which investigators think originated overseas, appeared to be authentic business communication from familiar places, but they did have some discrepancies.

“I’m not saying there were no tip-offs,” MacStay said. “If you look very closely you could see, but you have to look very closely and if you’re in a small office and busy you’re not necessarily giving every email the level of scrutiny to catch something like this.”

For example, the town does business with the engineering firm of Hoyle, Tanner & Associates. It appeared as though somebody in the firm’s accounting office sent an email to the town, but it was fake, and one clue was that Tanner was misspelled as Tanerr.

“If you look quickly, you’re not going to catch something like that,” MacStay said.

No money intended for Hoyle, Tanner was misdirected elsewhere, but emails like this, involving multiple organizations, set the stage for the $2.3 million fraud.

Scammers ultimately got the town to change vendor payment routing information so they could access money intended for the school district and the bridge contractor. They then converted the money to cryptocurrency so the transactions couldn’t be reversed. Aside from the tip-offs in the email, the scam could have been averted if town employees had verified the vendor payment change instructions that were received by email. Town policy calls for such verification, MacStay said.

Lisa Thompson, an attorney who is chair of the New Hampshire Bar Association Intellectual Property Section and conducts cyber security training for municipalities, said the length of time the scam went on makes it seem as though the town was being “groomed” as a financial victim.

She said most people know to be careful to avoid email fraud, a longstanding problem.

“Typically if you have a little bit of a critical eye there’s usually spelling or grammatical errors, or you hover over the email address that it came from and it’s probably not the correct email address,” she said.

“I get spoofed emails all the time in my personal account and my work account. In fact I got one this morning that looked like it was from my boss but then I click on the email address and it was from some scammer at gmail.”

She finds it incredible that more than one vendor routing address was changed by email and that three transactions went through before a halt was placed to electronic transfers.

“It seems like somebody was asleep at the wheel,” she said.

The problem came to light on July 26 when the ConVal school district notified the town it had not received its $1.2 million payment.

The town discovered on Aug. 18 that July 9 and Aug. 13 payments to Beck and Bellucci also went astray.

“That really keyed us in to this being some kind of breach in our system,” MacStay said. “With that information the computer firm and the Secret Service were able to monitor that this began to happen many months ago. Our system was compromised.”

All electronic fund transfers were then halted. If the halt had been initiated after the first, July 26, payment problem was noted, the Aug. 13 payment to Beck and Bellucci might have been saved. The public was notified via a news release on Aug. 23.

MacStay recalled when she first learned of the missing money.

“It was a really horrible day and then it was actually multiple horrible days,” she said.

The situation must have also been hard on local elected officials, but Select Board Chairman Tyler Ward declined to comment for this story.

“I’m afraid I would not have any comment regarding the email scam situation since there is an ongoing investigation and it involves personnel whose privacy is protected,” he said.

MacStay said certain employees targeted in the scam were placed on paid administrative leave, but she declined to say who they are or how many. She said it is believed no staff were criminally involved in the fund transfers.

Town Finance Director Leo Smith, 69, retired last Tuesday, eight days after the announcement that the town had been scammed. He did not return requests for comment.

A U.S. Secret Service investigation is continuing as is an insurance investigation. Town officials are waiting to see how much insurance coverage they may have for this.