Accounts Deceivable Podcast Series: Season 1, Episode 1 - Devil’s In the Email

---

Speaker 1

I went upstairs and I talked to my husband immediately and was like, oh my god, I think we were a victim of a cybercrime and and I think we just had $650,000 stolen from us.

Speaker 2

Welcome to season one of Accounts Deceivable, a podcast about a growing category of white collar crime, invoice fraud, and the devastating impact it has on people, companies, and communities. Episode one is a story of shame and determination. It stars Sherry Williams, a director at nonprofit One Treasure Island, who lost $650,000 of charity money to an elaborate scam. Desperate to recover the money, Sherry's journey led her to the Secret Service and into a nerve racking trial by media. Could Sherry catch the criminals and get the money back? Sherry's story begins with hope. One Treasure Island is a nonprofit organization that helps homeless and low income families in San Francisco. Led by Executive Director Sherry Williams, one of the organization's goals is to build a new community of 8,000 houses on a man made island in San Francisco Bay. A quarter of the homes would be set aside for homeless and low income families, including veterans.

Speaker 1

We felt like that was important because it was a former military base that the first affordable housing project served those who have served our country.

Speaker 2

The island was originally built in 1939 for the World's Fair and was an operational military base until 1997. The new development will be a thriving hub of homes, shops, restaurants, businesses, and hotels. With over 300 acres of green open space, it is the biggest expansion of parkland in San Francisco since the Golden Gate Park was built over 150 ago. Sherry Williams has dedicated most of her adult life to solving homelessness in San Francisco. She started at One Treasure Island with a four month contract in 1995 and eventually found herself running the whole organization. To friends and colleagues, she describes the island as her personal mission. Her right hand man is Venicio Castro, administrative director. Venicio grew up in El Salvador and moved to San Francisco in 2007. Like Sherry, Venicio is passionate about public service. He worked for a number of other nonprofits before starting work on the island. Although he loved his other roles, he admits that One Treasure Island is the most satisfying job he's ever had.

Speaker 3

It was very fulfilling. You could see real work being done. Speaker 2 On the 01/27/2021 at 12:32 p. M, Sherry dialed into a Zoom meeting in her office *** yoga studio in the basement of her house. The meeting was with one of the organization's most important partners, an affordable housing developer responsible for building 130 of the project's houses. As she dialed into the call, Sherry felt a pang of excitement. After twenty five years of planning, they were finally ready to break ground on One Treasure Island. After swapping anecdotes about their Christmas holidays, the group got down to business. Item number one on the agenda was funding. Speaker 1 I said, oh, I'm glad that we got you guys all paid off. You could pay paid up. You could pay your architects and your engineers. And then they said, oh, well, actually, we've been meaning to contact you because we actually haven't gotten anything.

Speaker 2

Sherry's initial reaction wasn't worry. It was irritation. She knew that One Treasure Island had made three wire payments totaling $650,000 in December and January. Since it was Christmas and people were in and out of the office, she'd taken extra steps to make sure the funds had been received. Speaker 1 I was actually a little aggravated. I was just like, you're you're kidding me. We we've been you know, because we don't usually wire funds that much. So I was actually a little irritated, which I was just like, what are you talking about? I've been in contact with your person back and forth because I was really wanting to make sure that they were paid so that they could pay their architects so the project wouldn't be stalled in any way.

Speaker 2

After the meeting, Sherry immediately felt a sense of unease. She opened up her email and quickly located the chain between her, Venicio, her bookkeeper and the housing developers. On the surface, everything looked normal. One Treasure Island had received an invoice. Her bookkeeper had paid it. The developers had confirmed receipt. And then it happened. As she scanned carefully through the correspondence, she spotted something that made her stomach churn. It was almost invisible, barely perceptible, but it was there. A lowercase l in the developer's email address had been replaced with a capital I. She could feel the panic rising in her chest. Speaker 1 I went upstairs and I talked to my husband immediately and was like, oh my god, I think we were a victim of a cybercrime, and and I think we just had $650,000 stolen from us.

Speaker 2

Sherry ran back downstairs, picked up the phone, and hands shaking called Venicio. Venicio was sitting at his dining room table, working his way through emails and trying to block out the noise of his eldest daughter watching TV in the living room. Within five seconds of answering Sherry's call, he could tell something wasn't right. Speaker 3 Sherry is very, we say, cool, calm and collected. So she didn't sound desperate at all, but she sounded worried. And after all this year, I can kind of tell when she's holding something.

Speaker 2

Sherry immediately shared her concerns with Venicio.

Speaker 3

My first thought actually was a little on, oh my goodness, is this my fault? And I was scared. So then, I mean, just again, cool down and call IT and see what we can find out.

Speaker 2

Venicio called his IT manager and they started analyzing the email more closely.

Speaker 3

It was real up to a certain point, and after that the the people involved in the email, changed. So an O became a C, an L became an I. But we had no idea how that happened, because our system hasn't been breached. So, the parcel just appeared out of the blue, in the middle of the of the Inno thread.

Speaker 2

It gradually became clear that one Treasure Island had been the victim of a business email compromise scam, a type of white collar fraud that is growing exponentially. According to the FBI, businesses have lost $43,000,000,000 from scams like this in the last five years. Here's Shannon Kreps for Medius, a company that protects against invoice fraud, to explain more.

Speaker 4

Invoice fraud is really about fake invoices. It's about people sending in invoices for goods or services that never really happened, but they're assuming that you're so buried in paperwork that you're not gonna actually have time to check that out. If you're a fraudster, you could send in 100 invoices to 100 different organizations and you just hope that one of them hits.

Speaker 3

For a month, they were just sitting there silently checking her emails and seeing what can be taken. And our email came across with instructions to wire money, and they'd say, this is it. Speaker 2 Once the theft was confirmed, Sherry and Venicio felt crushed and in a state of shock.

Speaker 1

I had this feeling of just being absolutely flattened, but at the same time really wanting to find justice and wanting to find recourse to potentially recover the money.

Speaker 2

In a minute, we'll hear all about Sherry and Venicio's fight for justice, which takes them from San Francisco to West Odessa, Texas, and finally to Speaker Nancy Pelosi's office. Before then, a quick word from our sponsor, Medius.

Speaker 5

Invoice fraud is costing businesses billions of dollars every year. As cyber attacks grow in sophistication, more and more companies are accidentally paying out thousands, even millions, in bogus invoices. Medius is an accounts payable software platform that enables finance professionals to combat invoice scams by protecting the integrity of their supplier data, auditing the invoice process in real time, and monitoring for insider fraud. For more information or a demo, visit www.medius.com.

Speaker 2

Sherry's first move was alerting the authorities. She filed reports with the FBI and the San Francisco police and trusted them to start their investigation. At the same time, she called Dory, her board president, explained what had happened, and hastily arranged an emergency meeting of One Treasure Island's executive committee.

Speaker 1

Everybody had questions like, well, how did this happen? And can you even do that? And what what is this spoofy I mean, and what is this, you know, legitimate thread for the email chain?

Speaker 2

Sherry, Venicio, and the One Treasure Island board agreed that although it would be tough, it was critical to communicate quickly and transparently with its long list of stakeholders, staff, members, supporters, funders, other philanthropic organizations. Sherry alerted the staff, then brought in a PR agency to help explain the scam and try to protect the nonprofit's reputation.

Speaker 1

The decision to go public was very difficult because there is an enormous amount of shame involved when you're a victim of a crime like this. We take being stewards of, you know, public, you know, donated dollars very, very seriously and always had prided ourselves on having clean audits every year. The fact that something like this happened to us was extremely devastating. That took quite a while to kind of process like, some on a personal level.

Speaker 2

After a few days, Sherry called the San Francisco Police Department and was surprised to hear that no progress had been made. In fact, no one had even been assigned to investigate the case. She managed to get in contact with the head of the FBI in San Francisco, but the news wasn't encouraging.

Speaker 1

The FBI and the police departments, they were all just kind of overwhelmed with fraud cases, were rampant, especially during COVID. It was extremely frustrating. $650,000 to us is a ginormous sum of money, and it was to help build housing for homeless low income families. Unless it's a multimillion dollar, you know, case that they're because there are so many cases that they're choosing the ones that are of higher monetary value.

Speaker 2

Sherry and Venicio were in no mood to give up. That money had the potential to change thousands of lives. They decided to spread their bets and filed another police report, this time in the city that the scammer's bank account was based, West Odessa, Texas. Sherry and Venicio also started to do their own detective work, locating the individual whose name was on the scammer's bank account.

Speaker 3

They have a company, which is, of course, totally fake, but they have a website and everything. The address of the business is actually a house, also located in Odessa. And we have the name of the person. You can go online into his Facebook and you have a bunch of pictures. So we tap a little bit of his life story that is published on Facebook, but then you can do anything with it.

Speaker 2

Despite this seemingly important breakthrough, Sherry quickly discovered the bar for determining intent to defraud is high and was crestfallen when the authorities informed her that they were not in a position to pursue the fraudster. Let's just say she was

Speaker 1

Pretty darn angry.

Speaker 3

I'm frustrated.

Speaker 2

Frustrated. Venicio had another brainwave. Surely, the email scammers had to provide some kind of personal information in order to set up their domain. He did some research and found out the domains were hosted by Google. Could the tech giant help One Treasure Island track down the perpetrators?

Speaker 3

The only response was, we're going to look into this and thank you very much. You cannot go online without being asked for a phone number, full name, date of birth and a whole bunch of things. The only thing that they would do was to confirm that the email has been misused. They would just freeze the account, and that was it.

Speaker 1

So there's no responsibility on Google's part and then no responsibility for Google to, you know, provide the information of these fraudulent domains or that was very frustrating to us to discover.

Speaker 2

Meanwhile, despite blitzing West Odessa Police Department with calls and emails, Sherry wasn't making any progress and decided it was time to up the ante.

Speaker 1

I decided that we should go there in person because it's harder to, you know, blow people off if they're right in front of you versus if they're just on the phone or through email.

Speaker 2

In West Odessa, Texas, the weather matched their mood, gray and dreary. Sherry and Venicio took a cab from their hotel to the police station. When they walked into the police department, it was surprisingly quiet. After waiting for a few minutes in reception, an officer put her head around the corner and waved them into her office.

Speaker 3

She was surprised that we flew just to see her. She said, oh, I thought you had business here. And, yeah, she was shocked that she was the purpose of our flight.

Speaker 1

Yeah. Because I was like, well, know, 650,000 is a lot for a nonprofit to have stolen from them.

Speaker 2

Sherry and Venicio hoped that if the police knew they traveled 1,500 miles, it might encourage them to take the matter more seriously. But their optimism quickly faded.

Speaker 1

When we met with the detective, she seemed kind of defensive. And then it was her opinion that the money was already overseas in the hands of terrorists, there was very little that they were gonna be able to do anyway. After

Speaker 2

a short and unproductive discussion, Sherry and Venicio left the police station dejected, exhausted, and no closer to tracking down the stolen cash. Their next stop was the bank in West Odessa, where they finally caught two small breaks. Although, unsurprisingly, the fraudsters had drained the lion's share of the stolen money, $36,000 remained in the account untouched. Secondly, the bank had passed the case along to a fraud investigator who had found a more promising way into the US government via the Secret Service.

Speaker 1

That was the first time in three months of doing investigations that anybody had even mentioned the Secret Service. And most people associate the Secret Service with protecting the president. So I look up the San Francisco Secret Service office, and I called them up. And he said, oh, yeah. Cybercrime's in our wheelhouse. And I was just like, really? I mean, does the FBI know that?

Speaker 2

Sherry learned that the power to open a case or authorize a Secret Service investigation sat with the assistant US attorney. So she set about putting pressure on lawmakers through as many different channels as possible. She met with staffers in Senator Alex Padilla, Speaker Nancy Pelosi, and Senator Dianne Feinstein's offices. She also took the tough decision to go public with her story, despite the shame she felt for losing so much of the charity's money.

Speaker 1

We also contacted a reporter for the San Francisco Chronicle who was very interested in doing a story, and then also, The Wall Street Journal, both of whom did stories on the case, which we felt was important because we at this point really wanted to help others to prevent it from happening to them and also keep it, you know, the pressure on the authorities to do more and better on these types of cases.

Speaker 2

The media interviews were nerve racking, and Sherry had to dig deep to get through them. Her friends, family, and colleagues played a critical role in building her confidence.

Speaker 1

You're not the perpetrator here. You are the victim of a crime. People have done something to you. And so that had to really be drummed into me because I really did have that mindset of, like, I did something wrong, I did something bad, I did something shameful, I did something, you know, unprofessional or whatever. And so once that was sort of drummed into me, I I started getting the message, but it it took a while.

Speaker 2

Sherry's bravery and persistence kept the case alive. An investigation into the theft is ongoing, and she remains hopeful that the perpetrators will be brought to justice. As important to Sherry, the mayor's office also stepped in and put up the funds to make the housing developer whole. This means that the vital work One Treasure Island is doing can continue. The bruising episode has made Venicio and Sherry determined to tell their story so other individuals and businesses can learn to protect themselves. Venicio believes that by implementing certain approaches and best practices, companies can significantly reduce their susceptibility to a BEC attack.

Speaker 3

I think our main learning is you are on your own. Unless it's an astronomical amount of money, nobody's going to do anything for you. And so it's better to be, alert at all time, be proactive, get cyber insurance. It's not going to cover all your losses, but it will cover something. Implement simple practices, like get a verbal confirmation before and after any kind of wiring. Don't follow links or don't call phone numbers that come in the email. Use the one that you already have, the ones that you already know.

Speaker 2

Shannon from Medius has this advice to offer.

Speaker 4

The moment you get a request to change a bank account should be a big red flag. That doesn't happen often. Suppliers don't do that on a whim. And if you see a bank account change and you make that change in your system, it means every invoice you pay then goes to that new bank account.

Speaker 2

For Sherry, the biggest lesson was understanding just how fragmented the government's response is to this growing cyber threat. Speaker 1 I completely sympathize with how overrun and overwhelmed they are, especially during COVID. But I feel that there are some sort of simpler things that they could do. One of the reporters for the San Francisco Chronicle suggested this, and I thought it was actually a brilliant idea. And that is why not have a small claims court for anything under $1,000,000 and then have a coordinated task force for that? I think that they should look after the low hanging fruit. Maybe they need to make an example of some of the quote unquote money mules or the people opening up these accounts because then if they're doing it with impunity, what kind of disincentive do they have from continuing it?

Speaker 2

It's not just the financial cost of the crime that weighs heavily on Sherry. It's also permanently shaken some of her inherent positivity and optimism.

Speaker 1

So I had this old college professor that said, just because you're paranoid doesn't mean they're not out to get you, and I actually don't find it very funny anymore. I mean, you have to have a level of paranoia now that is not natural to me. That's why this constant, like, being on alert and questioning and education part is so important because I think for most people being suspicious and paranoid is not natural.