Newly released documents shed light on how cybercriminals deceived city officials into authorizing a nearly $722,000 payment last fall.
The scammers posed as employees of a legitimate construction company and infiltrated ongoing email conversations with city staff, starting as early as Oct. 21.
The city is working to retrieve what it can of the missing funds, according to Deputy Service-Safety Director Andrew Chiki.
“The fraud incident that impacted the City of Athens is deeply concerning and highlights broader systemic vulnerabilities rather than only the actions of a single individual,” Chiki wrote in a criminal investigation update. “While some want to look at a single point or person of failure, the reality is that there were multiple weak points along the way.”
According to a civil lawsuit the city filed against the unidentified defendants Dec. 4, the online scammers emailed the city portraying themselves as Pepper Construction Company of Ohio, the company that built the city’s new fire station headquarters on Stimson Avenue.
Emails were included in the released documents following the completion of the police investigation.
The cyber criminals used two separate email addresses to impersonate Senior Project Accountant Evan Grootenhuis and Project Manager Clay Wilson, Pepper Construction employees.
The scammers directly communicated with two city employees, Grants Administrator Patricia Morris-Witmer and Account Administrator Jessica Covert. All email communication with the scammers had cc'd Chiki; Andy Stone, Service-Safety Director; Edward McCall, owner of McCall Sharp Architecture; and Katie McCall, designer at McCall Sharp Architecture.
The email addresses used by the online scammers contained misspellings. The first set ended with pepperconstructIon.com and the other with pepperconstrcution.com, different from Pepper Construction’s regular domain, pepperconstruction.com.
Rishabh Das, an assistant professor in the Scripps College of Communication, specializes in critical infrastructure cybersecurity and said he found the scam impressive.
“That activity itself, it’s quite hard from a cybersecurity perspective, so we are looking at a pretty sophisticated attacker,” Das said. “Unfortunately, the transaction that was happening with Athens … was quite significant.”
Morris-Witmer and Covert communicated with the scammers for 31 days, emailing about the 16th payment for Pepper Construction and acquiring the documents necessary to authorize it.
The criminals requested Nov. 14, to switch from paper checks to an Electronic Funds Transfer, or EFT.
“Can the Pay App #16 Payment be paid directly to our company’s account instead of a check? We have fully moved to a new payment method to streamline our receivables and ensure those subcontractors get paid on time, as the payment is holding them back with their work,” the scammer wrote to Morris-Witmer.
Email from scammers impersonating Pepper Construction’s Senior Project Accountant Evan Grootenhuis on Nov. 14, 2024, requesting a change in payment details for a city project.
The city government said it did not find this activity worthy of being a potential scam.
“Pepper Construction had originally been set up for electronic funds transfer (EFT), specifically an Automated Clearing House type of EFT, and then changed to paper checks early in the construction project,” Chiki wrote. “The request to change back to EFT, while unusual, was not suspicious.”
The bottom of each of the Pepper Construction project invoices released states in capital letters, “Pepper Construction will never initiate a change to banking information via phone or email. Please reach out to a known Pepper contact should you receive this type of request.”
Morris-Witmer handed off the signed voucher to Covert the morning of Nov. 14, according to an email she sent Covert at 8:11 a.m. The cyber criminals sent the payment authorization voucher back to Morris-Witmer via email, which is included in the court case documents. In the contact information, the scammers typed in one of the incorrect email addresses and a phone number with a Tampa Bay, Florida area code.
The almost $722,000 was added to an account at Republic Bank and Trust Company in Louisville, Kentucky, Nov. 18, according to Chiki.
A few days later, Thursday, Nov. 21, the scammers emailed Covert, claiming Pepper Construction’s mailboxes were vandalized and requested she update records with an alternative bank account for the next payment.
It was afterward Covert raised suspicions to Morris-Witmer.
“You might want to reach out to whoever you deal with at Pepper and tell them that someone is trying to change the banking information in the system,” Covert wrote in the email. “Look at the email from this one. egrootenhuis@pepperconstructIon.com…The other emails were from egrootenhuis@pepperconstrcution.com.”
The scammers also claimed in an email to Morris-Witmer and Covert there was a restriction on payment 16, and their bank account was under investigation, preventing them from accessing the funds.
The following Monday, Nov. 25, after Covert and Morris-Witmer received multiple emails from the scammers claiming their account had been jeopardized, they took action.
“I can’t take back an ACH payment,” Covert wrote in an email to Morris-Witmer. “They need to talk to their bank. I think this is a scam. Look at the email address. I think someone needs to physically call this guy.”
Email from Account Administrator Jessica Covert on Nov. 14, 2024.
From there, Morris-Witmer emailed the real Grootenhuis and Wilson and asked if they originated messages from the “suspicious” addresses.
Email from Grants Administrator Patricia Morris-Witmer on Nov. 14, 2024.
The real Grootenhuis denied, writing in an email, “Yes, this is NOT US and appears to be a scam!”
Email for Pepper Construction's Senior Project Accountant Evan Grootenhuis on Nov. 25, 2024.
Morris-Witmer also included Lukas Huston, systems administrator of the Athens City Information Technology Department, to alert him of the suspicious activity, who suggested someone’s information was compromised either with the city or Pepper Construction.
“I would advise everyone in this email to change their passwords if they have not already,” Huston said.
The next day, Nov. 26, a City Auditor’s Office staff member discovered the EFT payment for pay 16 was fraudulently made, according to a document laying out the scam's timeline.
The city’s bank, the Athens Police Department and the local field office of the FBI were then alerted, and the city submitted an Internet Crime Complaint Center report.
“While the final point of transaction for transferring money was carried out by one person, the real issue lies in the lack of robust safeguards at multiple levels that would prevent a fraud of this magnitude to begin with – specifically, the security measures within banking institutions, the cybersecurity practices of outside entities, and the training necessary to identify evolving fraud attempts,” Chiki wrote.
Das said he agreed with Chiki’s explanation, saying that the employees were “just following their marching orders,” but a lack of training in both the city staff and Pepper Construction allowed for the scam to occur.
“No one took the correct action,” Das said. “That’s basically a layer of governance that is lacking, and they do not know the correct hierarchy that they need to follow in this kind of situation.”
Das emphasized there is software that could successfully block scammers.
“It’s not about correct resources, it’s having those layers of security that would often prevent these kinds of attacks from happening,” Das said.
Investigations are still underway for the court case, leaving little evidence available to the public.
The Post requested records of the city’s communication with external agencies, cybersecurity firms or law enforcement related to the mid-December breach. The Athens County Independent sued the city for both internal emails and emails between the scammer and city officials.
In an email sent Dec. 10 by Chief of Police Nick Magruder to Chiki, Magruder wrote “all emails and documents related to the ongoing criminal case involving the fraudulent payment the City of Athens made to John Doe, acting as Pepper Construction, shall be withheld from public records by revised code section 149.43 (A) (2).”
The Athens County Independent filed a writ of mandamus, a court order that compels someone to perform a legal duty, Feb. 21 with the Supreme Court of Ohio, which is still an open case.
Although the city is working to retrieve the lost funds, Das said he has little confidence they will see the money again.
“It would be extremely challenging to retrieve something like this,” Das said. “(Scammers) usually take the money and try to transfer it right away, and it is extremely hard to track something like that once it leaves the parent bank and circulates in the system.”
