What's at stake?
The grand jury acknowledged new safeguards inside City Hall but still concluded that similar cases of fraud could happen again in Fresno.
Fresno finance department employees failed to follow loosely established safeguards that would have prevented a more than $600,000 internet phishing scam in 2020.
That was the conclusion the Fresno County Grand Jury reached in a new report out this week that gives city residents the first detailed account of the series of failures and missed red flags that ultimately cost taxpayers about $613,737.
“Policies designed specifically to guard against this kind of fraud were not followed which made it possible for two large payments, made over the course of several months, to be sent to a false bank account,” the grand jury report states.
First reported only quietly inside City Hall in 2020, the public didn’t learn about the scam until early 2022 when a Fresno Bee reporter confirmed the fraudulent payments. At the time, Mayor Jerry Dyer remained relatively tight-lipped, citing what he said was a need to protect an FBI investigation.
The mayor, however, did confirm the lost money and said internal investigations had already ruled out the possibility of an inside job.
He also said Fresno was just one of multiple major American cities that might have been targeted by the same scammer or scammers. However, it remains unclear — and the grand jury did not note — whether any arrests have been made.
“Over the past four years, little information has been released to the public,” the grand jury noted in its report.
Responding to the grand jury report on Thursday, Dyer said many of the report’s recommendations have already been implemented.
“While I appreciate that human error occurs, the City continues doing everything in our power to ensure we are not victimized in the future. New systems and ongoing training have been implemented, as well as a new Controller/Finance Director being hired in 2022,” Dyer said in a statement. “In addition, the City upgraded its financial software, with special attention paid to putting rigorous controls in place.”
Not an inside job
Grand jury investigators concluded that the still unidentified scammers “simply scoured the internet for large construction contracts being awarded by local governments.
“Using real data gleaned from the City Council agendas and minutes,” the report said, “they were able to identify this particular contract, used what information was publicly available, and initiated a successful phishing scheme on unsuspecting city employees.”
The construction job in question involved a new police substation in southeast Fresno, which began construction in April 2019.
About eight months later, on Jan. 6, 2020, someone later identified as a scammer emailed a city finance department employee.
The scammer, posing as an “accounting specialist” for the construction company, requested a change to the installment payments the city had been sending through the mail.
“Instead of physical checks, the construction company was now asking to receive payments via an Automated Clearing House (ACH) fund transfer,” the grand jury reported, while also noting that city employees acknowledged that such a request was “not common.”
“The Finance Department, assuming the perpetrator was an actual construction company employee, emailed an ACH form to the perpetrator who promptly completed and returned the form by email,” the grand jury reported. “The fraudulent emails appeared to come from the legitimate contractor, but they did not.”
The grand jury also noted the domain extension of the fraudulent email addresses ended in “.us” while the legitimate contractor’s email used “.com.”
“Even though an early response by the city to one of these fraudulent email addresses was returned as “undeliverable,” the fraud was not detected,” the grand jury noted. “The jury also observed that, during the multiple attempts to deceive City staff, the perpetrators gave multiple bank account numbers located in different states.
“This, too, did not alert city staff to the fraud.”
The city’s Finance Department authorized the first electronic fund transfer of $324,473 on Jan. 30, 2020. The second payment of $289,264 was sent five weeks later on March 5, 2020.
When the city finally discovered the fraudulent payments, Fresno police launched an investigation, which was quickly turned over to the FBI.
“Upon learning of the fraud, City officials made unsuccessful attempts to recover the fraudulent payments, the grand jury noted. “The City conducted an internal investigation and determined that there was no evidence of criminal actions committed by City employees.”
‘A high probability of similar losses in the future’
The grand jury concluded that city staffers failed to follow at least two specific procedures that were in place — although not in writing — at the time of the fraud.
Staffers failed to confirm that the automated clearing house form was authentic, a procedure the grand jury said city staffers were supposed to follow “any time an established city vendor requested the city start making payment via electronic funds transfer.”
Secondly, the grand jury said established procedure required a different staff member to review all “large disbursements” at the end of the business day to confirm and verify payment details. The grand jury said that never happened in this case.
And while the proper policies and procedures were in place at the time, the grand jury said it was unclear whether all employees knew the rules.
“The Finance Department Electronic Funds Transfers procedure was largely unwritten at the time of the incident,” the grand jury reported. “Training for the handling of these important money transfers was conducted verbally, and it appears that not all Finance Department employees were properly trained.”
The grand jury concluded that “suspicions should have been raised when the perpetrators asked for multiple ACH forms for different bank accounts located in different states.”
The grand jury noted significant changes to the city Finance Department since the fraud, including additional authentication and verification steps. Grand jury investigators noted “the incident resulted in serious reflection and introspection within the Finance Department.”
Dyer went on to thank the grand jury and reassure the public.
“I am also pleased with the Grand Jury’s confidence that internally updated procedures appear appropriate for preventing this type of fraud from happening again,” Dyer said. “I would like to assure the public we will do everything we can to ensure human error is minimized in the future.”
And while the report concludes that the new policies could prevent future fraud from occurring, it also warns the procedures must be “competently implemented by city staff.”
“Without strict observation and enforcement of new and existing internal controls, there is a high probability of similar losses in the future.”
