How the Puerto Rican Government Was Scammed Out of Millions

By: Marcus Day

New York —It turns out cybersecurity for the government isn’t as strong as you’d hope. Two Puerto Rican agencies were recently scammed out of $4.1 million.

The first was Puerto Rico’s Industrial Development Company, a government-owned corporation created to attract private capital into the territory. The company was swindled out of $2.6 million on January 17th.

José Ayala, the head of an anti-fraud unit, told the Associated Press an unknown person hacked into a computer at the Employee Retirement System. The hacker then posed as a government employee and directed staff to transfer money tied to remittance payments to a new account, claiming there had been an official change.

The staff fell for the ruse, transferring the several million dollars soon after.

“This is a very serious situation, extremely serious. We want it to be investigated until the last consequences.” Manuel Laboy said to The Associated Press. Laboy is the executive director of the affected agency.

There are disputed claims on how exactly the plot was discovered, though one source reports the employee who was hacked detected a discrepancy of funds. The hacker is still unknown, although the police say they have several suspects.

An almost identical scam took place only a couple of weeks earlier in December of 2019. A scammer was able to embezzle $1.5 million from the Puerto Rico Tourism Company. The agency’s Director of Finance received an email with instructions to redirect payments to a new account in the United States.

The effect the $4.1 million will have on Puerto Rico’s battered economy and infrastructure is still unknown (Cr: islandsofpuertorico.com)

According to El Nuevo Dia, a local Puerto Rican newspaper, the hacker forged a letter in which he falsy informed the official of the change of the Retirement System Administration’s bank account. The official then sent pension payments to the new account without verifying the information or its origin.

Since both of these scams occurred within a three-month period and targeted the same retirement fund, investigators have not ruled out that the same person is behind both events.

These scams occurred in a wave of several other phishing rackets. Nikkei, a Japanese publishing conglomerate, was tricked out of $29 million when a hacker impersonated an in-house executive. Most recently, a Texas School district lost $2.3 million to an email scam last month as well.

This situation comes as Puerto Rico is sunk in a 13-year recession that has forced the government to already cut back on several services. The island has also been rattled by multiple earthquakes in the last year, decimating local infrastructure, leaving 300,000 without water and two-thirds of the island without power.

Unfortunately, it is unclear whether the money will ever be recovered.