Florida Attorney General’s Office sent nearly $71,000 to a suspected imposter

Anyone can fall victim to cyber-attacks, including the government. The same Attorney General’s Office that aims to protect you from getting ripped off, with tips, lots of educational videos, even a cyber fraud unit working alongside other law enforcement agencies dedicated to solving cyber crimes, may have turned over close to $71,000 to an imposter.

“Cyber crime is a growing threat and we’re fighting hard to take down those who use the internet to prey on Floridians,” Florida Attorney General Ashley Moody said in a February 6th Consumer Alert video.

It’s not quite the Nigerian Prince email scam the FBI has warned everyone about for years. But it does start with an email, and the 27-page court document says it ends with a suspect in Nigeria. This case gets messy, involving the AG’s office, a Sarasota law firm, a man in Nigeria and a Charlotte County woman.

“The best way to fight cybercrime is to make sure Floridians have the knowledge and resources needed to avoid online schemes,” Moody said in her February 6th Consumer Alert video.

According to court documents, the AG’s Office’s Senior Operations Manager got an email from the Robertson Law Firm asking the state to wire close to $71,000 for the firm’s work on a lawsuit. A week later, the money was sent. But a month after that, the law firm let the office know they never got the funds.

A spokesperson later told me the Attorney General’s Office regularly spoke with an attorney from the firm on the phone and through his official, verified email account, not a spoofed account. 

While this case is still under investigation, court documents explain the law firm’s email was hacked and traced to a man all the way in Nigeria. 

“This attack can be very, very dangerous,” said Dr. Cheugyi Qu, a Computing and Software Engineering professor and Cybersecurity expert at FGCU.

He described this as a “man-in-the-middle” attack.

“Both our sides assume that we are talking with each other, but there’s like a man in the middle, mimicking the conversation,” Dr. Qu explained. “They want to get information from both sides.”

Florida Department of Law Enforcement investigators revealed in the court filing that the AG’s Office didn’t send the money to the suspect directly. They actually unknowingly sent the $71,000 to a bank account registered to a Charlotte County woman’s LLC, thinking it was the law firm’s account.

It appears she’s a victim of a romance scam. Records show she met the man on an online dating site and he had her set up accounts to transfer money around, including cryptocurrency.

“Hackers will use social engineering to attack you,” Dr. Qu added. “So they will use your emotions, they will use your, like, depression, background. They will try to use this kind of field to attack or to gather anything you have.”

• Related: Florida ranks top 5 for most dangerous places to online date; FGCU students react

Now the Attorney General’s Office wants its money back. A spokesperson said the account has been frozen and they are in the process of forfeiture proceedings. The court documents show they’ve seized all of the suspect’s cryptocurrency and are asking the court to let them reclaim the roughly $71,000.

Dr. Qu said the best way to make sure you don’t lose money like this is to call the person on the other end and confirm all information before sending over any funds.

“We also call that zero trust,” Dr. Qu explained. “Zero trust means that you don’t trust anyone and don’t trust any action. So, although you have been cooperating with this guy for a long time, but if they have sensitive data they are asking from you, you need to double check their authentication.” 

WINK News Consumer Investigator Andryanna Sheppard asked the AG’s Office multiple times if they followed a similar policy or had a policy that required a superior to sign off on sending money. Even though they responded quickly to every other email she sent, they never responded to the three emails referencing this policy. But still they offer a few words of advice.

“And now with higher concerns about online safety, we must remain proactive and prepared to guard against cybercrime,” Moody said in a video on Oct. 20, 2021. 

Sheppard spoke with the Robertson Law Firm but he said since this case was still under investigation, he didn’t want to comment just yet. FDLE also said this was an active investigation and would not be providing any other information.