Florida city duped out of $1.2 million in phishing scam, police say

Scammers impersonating a construction company duped the Florida city of Fort Lauderdale out of $1.2 million, sparking a police investigation.

The city paid the sum on Sept. 14 after receiving what was believed to be a legitimate bill from Moss Construction, a company that's building a new police station for the coastal city, north of Miami, Fort Lauderdale Police Department spokesperson Ali Adamson wrote in a statement.

The bill was discovered to be a scam within a day.

"We would like to take this time to remind our community to exercise caution when fulfilling payment requests and to stay vigilant and aware of potential scams," she said in a statement.

Adamson told USA TODAY the Fort Lauderdale Police Department is working with appropriate law enforcement agencies "to determine exactly what occurred," but she declined to provide additional details, including where the money was sent.

What is phishing?

The Federal Trade Commission defines phishing as an online scam that targets people, businesses and agencies through messages sent via email, text, or direct message that appear to be from a reputable source. Phishing messages commonly ask for personal identifying information that is then used to invade existing accounts.

In what is commonly called spear phishing, an attacker may use information about a company and its employees to make their messages even more persuasive and realistic, according to the U.K.-based National Cyber Security Centre.

Last year, there were more than 4.7 million recorded phishing attacks, according to the Anti-Phishing Working Group.

The city wants money back

Dean Trantalis, the mayor of Fort Lauderdale, has told news outlets the city is trying to get the money back.

The mayor told WSVN the scam “wasn’t just an email, like, ‘Hey, this is Moss Construction. Send me $1.2 million,’ It was followed up with full documentation, multiple paperwork."

“It’s $144 million, so they’re in full construction mode, so it would’ve been consistent with the practice that we’ve been following,” Trantalis told the outlet, referring to Moss' large building project.

Trantalis was unavailable to comment on Monday because he was out of town, said Scott Wyman, the mayor's chief of staff.

'Proactive measures' were in place after previous phishing scams

This is not the first attack on the city, but it is the first successful one.

In a statement to USA TODAY, Fort Lauderdale City Manager Greg Chavarria said the city has been targeted in the past by phishing scams and has "taken proactive measures to mitigate such risks." He, however, did not provide any details about the security practices previously established to protect against such scams.

Chavarria declined to provide "any specific comment" on the incident "for the time being."

“This incident is under an active investigation," the city manager wrote. "The Police Department is working with a variety of agencies and resources to get to the bottom of it."

He added, "This is an important reminder that anyone may become a victim of fraud and we all must do everything possible to protect ourselves.”

Moss Construction in a statement to USA TODAY, said, “Malicious actors took advantage of our good name and publicly available information to attempt a scam."

"This is a fraud case that is being actively investigated by the City of Fort Lauderdale officials and police," the statement continued. "We refer all calls to the Fort Lauderdale Police Department."

How to avoid getting scammed

To avoid falling prey to a phishing scam, the Federal Trade Commission suggests that people use security software on their devices, update their cellphone software as much as possible and back up data regularly.

If you've received an email that looks suspicious, check for typos and confirm the sender is who they claim to be. Some signs that should raise concerns are messages with a generic greeting, those that say your account is on hold because of a billing problem and messages that invite you to click on a link.

The FTC also advises people to report phishing scams at ReportFraud.ftc.gov.