It began in August, when Interim County Auditor Constance Sanchez first announced the breach. In October, the county confirmed that the money was fully recovered.
CORPUS CHRISTI, Texas — Nueces County leaders say they’ve successfully recovered nearly $2 million dollars that was stolen during a phishing scam back in August, and they did it without any help from cybersecurity insurance.
RELATED: Nueces County recovers nearly $2 million lost in phishing scam
The recovery comes just two months after county officials first revealed that the money had been diverted through a fraudulent email scheme.
“It was a business email compromise, and there wasn’t really anything fancy about it,” Nueces County Sheriff J.C. Hooper said.
Although the scam was simple, it was effective. Hooper said several “well-crafted emails” convinced county employees to send funds to fraudulent bank accounts.
“Those vendors that were due payment by the county started complaining and said, ‘Hey, we didn’t get our payment,’” Hooper said.
That’s when officials realized something was wrong.
According to county leaders, Frost Bank played a key role in recovering the funds. The bank helped connect Nueces County with other financial institutions where the stolen money had been transferred. Together, the banks froze those accounts before the funds could disappear or be turned into untraceable crypto currency.
What was expected to take up to 120 days was completed in roughly half that time, and the county was able to recover the full amount.
The investigation began in August, when Interim County Auditor Constance Sanchez first announced the breach. In October, the county confirmed that the money had been fully recovered.
Sheriff Hooper said the FBI remains involved in the investigation, but prosecuting those responsible is still up in the air.
“It doesn’t look good because, as is the case frequently, the offenders aren’t even in the country,” he said.
Dr. Carlos Rubio-Medrano, a cybersecurity expert and Assistant Professor at Texas A&M University–Corpus Christi, said these kinds of scams are becoming increasingly common.
“They study the way organizations operate. They learn the names and roles of people in the organization,” Rubio-Medrano explained. “They also get to the point where they analyze the levels of the organizational hierarchy.”
Rubio-Medrano said that like this one, many of these cyberattacks originate outside of the country.
“Most of them are international bands. They’re operating overseas, but we cannot discard that some of these groups are also operating here in the United States,” he said.
Since the incident, Sanchez said the auditor’s office has tightened internal protocols to prevent future breaches.
“Whenever a department director or anyone would tell us to do something, we would just do it,” Sanchez said. “Now we’re going to take extra steps, make the phone calls to numbers we have on file, not necessarily the ones in an email. Just to verify that the request is valid.”
Hooper said the recovery was a rare stroke of luck.
“We had insurance involved, but no insurance claims were processed,” he said. “This was the real money that was diverted in the first place.”
County officials say the investigation is still ongoing.
Rubio-Medrano advises both residents and business owners to stay alert for suspicious emails, especially those related to payments or account changes.
He recommends only making online payments when you initiate the transaction, know the organization personally, and have done business with them before.