Feds recover $6.7 million cyberthieves allegedly stole from city of Portland

The FBI has seized $6.7 million

allegedly stolen by online scammers

who tricked a city of Portland employee into sending funds meant for a legitimate city contractor.

In February, someone posing as a city vendor wrote asking to change payment deposit information for the contractor. A city employee authorized the switch and Portland unwittingly sent $6.7 million to the thieves in March. The money had been intended to pay for work on Portland’s $2 billion Bull Run water filtration project.

The FBI somehow spotted the phony transaction, according to a lawsuit associated with the case, and stopped the payment. The U.S. Attorney’s Office in Portland said Friday that the money had remained in the scammers’ account and that it recovered those funds in April with a civil forfeiture warrant.

“This was only possible here because the crime was reported to law enforcement. The most important takeaway for the public is that if you find yourself the victim of a similar scam, do not delay in contacting law enforcement,” said Katie de Villiers, head of asset recovery for the U.S. Attorney’s Office in Oregon.

Authorities must still prove that the money is subject to forfeiture, according to federal authorities. Officials did not say whether they have identified the thieves in this case or whether they have made any arrests.

“While we anticipate that this process may take several months, we remain confident that all the funds will ultimately be returned to the city of Portland,” city spokesperson Carrie Belding said in an email Friday.

“In response to this incident, the city has taken multiple steps to strengthen the vendor payment process,” she wrote. “We cannot share specific details, but the focus is on increasing internal controls and training to reduce the risk of future incidents.”

Update: This article has been updated with comment from the city.

—

Mike Rogoway

covers Oregon technology and the state economy. Reach him at mrogoway@oregonian.com.

Our journalism needs your support. Please become a subscriber today at

OregonLive.com/subscribe