What happened
Moss Construction was building Fort Lauderdale's new police headquarters. On 14 September 2023 the city paid $1.2 million in response to a request that appeared to come from Moss. It did not. Police announced the loss on 21 September 2023. The mayor, Dean Trantalis, told reporters that the paperwork was exactly like what the company had sent before.
CBS News Miami reported that the receiving bank flagged the transaction as potentially fraudulent and notified the city. On 25 January 2024 the Fort Lauderdale Police Department announced that it had recovered the full $1.2 million. The money had gone into accounts belonging to unwitting victims of romance scams, used to move the funds, and was frozen before it could leave the country.
The email
A city staff email quoted by StateScoop described the request. Someone sent a request for an ACH payment, filled out the paperwork, and attached a blank check. Accounts Payable checked that the names on the forms matched the company's corporate records. They did. The mayor stressed that it was more than an email: the documents looked like the real company's earlier submissions.
The sources do not publish the sender address. Moss said its own systems had not been compromised. It said the fraudsters had taken advantage of its good name and of information about the project that was public.
Why it worked
The city did check. It checked the wrong thing. Matching names against corporate records confirms that a company exists and who runs it. It does not confirm that the company sent the request. Anyone can copy public names onto a form.
A large public building project is a gift to a fraudster. The contractor's name, the size of the contract and the schedule are in council papers and local news. A payment request of $1.2 million to the builder of a new police headquarters fits exactly what the city expects to pay.
What it cost
All $1.2 million came back, so the city's direct loss was zero. The money was recovered only because a bank outside the city spotted the transfer and the funds had not yet moved offshore. The police chief advised afterwards that banking information should never be changed through email.
What would have helped
A call to Moss, on a number from the city's own contract file, before the first payment to new bank details. The check takes minutes. It also works when the paperwork is perfect, which is exactly when it matters.
What a warning inside the message would have shown. Antilure explains the sender of a message in its Details panel, including a first message from an address and a domain that imitates a known one. It marks wording that asks to change payment details, and its banner says: don't reply or pay, check with the sender another way. Neat attachments and matching names change nothing about where the request came from.
Sources
- City of Fort Lauderdale loses $1.2 million after falling victim to phishing scam, Marissa Bagg, NBC 6 South Florida, 21 September 2023.
- City of Fort Lauderdale falls victim to $1.2 million fraud scheme, WSVN 7News, 21 September 2023.
- Fort Lauderdale, Florida, taken for $1.2M in email scam, StateScoop, 25 September 2023.
- Fort Lauderdale recovers $1.2M stolen last year during cyber scam, officials say, CBS News Miami, 25 January 2024.