The City of Athens is trying to reclaim some of the nearly $722,000 it lost in November to a cyber scam when city officials tried paying an invoice for its new firehouse.
According to a civil lawsuit the city filed against the unidentified defendants, the online scammers emailed the city, portraying themselves as Pepper Construction Company of Ohio LLC, the company that built the city’s new fire station headquarters on Stimson Avenue.
The cybercriminals requested city officials send $721,976.26 to Republic Bank and Trust Company in Louisville, Kentucky, via an electronic payment authorization form, the suit said.
“Being the victim of a crime, especially at this scale, is sickening and stressful and is quite frankly angering,” Deputy Service-Safety Director Andrew Chiki wrote in an email.
The city is making headway in gaining some of the money back as it tries to recover $349,522.10 from the fraudulent account, according to the recent motion Republic Bank filed Jan.10 Chiki said.
Filed Civil Suit and Pepper Construction
The City of Athens filed a civil suit against unknown cyber criminals Dec. 4, 2024, in the Athens County Court of Common Pleas to recover the lost funds.
According to the complaint, the scammers contacted the city by email Nov. 14, 2024, impersonating Pepper Construction, a contracting company in Dublin, Ohio with headquarters in Chicago, Illinois, hired for the new fire station.
The cybercriminals requested that funds be transferred from the City of Athens’ bank account at JP Morgan Chase Bank to an account at Republic Bank, then filled out an authorization agreement for the electronic payment of over $700,000.
According to Exhibit A in the civil suit, the perpetrators signed the authorization as Senior Project Accountant of Pepper Construction Evan Grootenhuis, forged his signature and wrote down incorrect contact information.
The email written on the authorization misspells construction, and the phone number has a Tampa, Florida, area code.
The authorization agreement was settled Nov. 18, 2024, for a transfer of $721,976.26 to pay an invoice by the city to Pepper Construction, according to the complaint.
After discovering the fraud, the city took immediate action.
“The city became aware of the fraudulent activity within a few days of payment and was discovered by an employee of the City Auditor’s Office,” Chiki wrote in an email. “After notifying the Athens Police Department, a subsequent notification was made to federal law enforcement by APD.”
The complaint requested an injunction for the account to be frozen to prevent more fraud while the City of Athens goes through the recovery process.
Pepper Construction’s Vice President of Corporate Communications Shannan Ghera said the company could not provide any relevant information on this matter at this time. According to Chiki, the company was notified of the situation.
Recovered Funds and New Victim
The city is in the process of making motions to recover the lost funds. According to an update from Chiki, a bank account where the city’s funds were transferred was identified, and $349,522.10 was recovered.
Republic Bank filed a motion Jan. 10 in the city’s civil case, which included a request for the court to decide how the recovered funds should be distributed and repaid.
However, Regency Center LP, a real estate investment trust that develops and owns shopping centers, transferred $326,874.06 into the same Republic Bank account used for the Athens cyber fraud, according to the motion.
The filing states, “Republic is in great doubt as to whether the City or Regency Centers is entitled to the Recovered Funds.”
“While this isn’t the full amount that the city was defrauded of, it is a substantial sum that may be recovered,” Chiki wrote in an email. “We will allow our legal teams to work with the courts on their efforts to recover the stolen funds and bring them back to the city.”
Residents Demand Answers
Almost three-quarters of a million dollars is a large loss for any city, let alone Athens, which has one of the highest poverty rates in Ohio at 41.6 percent, according to the U.S. Census.
Athens residents have expressed shock and confusion at how this occurred, as well as feeling uninformed about the situation. At the City Council meeting Dec. 16 following the news of the fraud case filing, Melina Miller, an East Side resident, shared her concerns.
“I come from the business world … having run and worked for really large businesses, there is always a check and balance system,” Miller said.
Community members questioned what tools could have prevented this from happening, as stated by Megan Weber, digital literacy manager at Athens County Public Libraries.
“I would like to know what safeguards are being put in place. What can be done so that this is not going to happen again,” Weber said. “It is ridiculous that it happened in the first place.”
After the general election in November passed five levies - two renewals, two replacements, and a new levy for emergency medical services - Athens residents are finding it difficult to swallow the large sum lost.
“The people of Athens are hardworking, resilient and proud of our community,” Weber said. “We cannot be expected to shoulder the burden and also trust the city to do what is in our best interest if things like this are going to happen, because I think you have lost the trust of the people of Athens, and I think that needs to be restored before you put something on the ballot and you ask us for more money.”
Cybersecurity Training, Preventions and the Path to Recovering Funds
Chiki listed the examples of cybersecurity training the city’s IT department has conducted with city staff, including phishing scam and email link tests for evaluating awareness and required fraud, waste and abuse training.
In response to the cyber fraud, an external organization is assessing the city’s “current cyber environment” to suggest additional recommendations to better their practices and training for staff who handle money, Chiki said.
Chiki also said the city has enacted a review by the City Auditor's Office of Financial Controls and a review of invoicing contract conditions.
The city also has cyber coverage as part of its insurance policies, Chiki wrote in an email, but “like any claim, the policy, exclusions and investigation results will dictate what provisions in the coverage are applicable and activated.”
Chiki said the final steps in the city’s procedure for paying invoices generally include the project coordinator creating a voucher including the invoice and pay application. The voucher then goes to the City Auditor’s Office to be processed, and then the payment is added to a project fund tracker spreadsheet.
“These types of fraud are so common, and no one believes that it can happen to them,” Chiki said via email. “The truth is that anyone can be susceptible, including local governments.”
