An international computer hacker recently tried to steal funds from a bank account used by the Schuylkill County Municipal Authority, the authority said at its March meeting Tuesday.
"Last week, we had some bank fraud. It was very serious and very alarming for us," Mark T. Catranis, the authority's controller, said in the authority's boardroom at its headquarters at 221 S. Centre St., Pottsville.
According to Catranis, a hacker tried to steal funds from an authority account at Sovereign Bank, Pottsville. Using numbers for the account, the hacker developed a scheme using checks.
"But it wasn't a checking account. It was a transfer account," said Patrick Caulfield, the authority's executive director.
The authority only used the account to deposit funds to pay loans owed to the Pennsylvania Infrastructure Investment Authority, or PennVEST, Catranis said.
The authority is working with Pottsville police and Sovereign Bank during the investigation, Catranis said.
At Tuesday's meeting, Catranis informed the board members about the situation.
"Someone fraudulently created and wrote checks using the authority's Sovereign Bank account information. We don't have any checks for this account. So they created a check with our routing number and our account number. And the checks were written in range amounts from $500 to $2,450.37. The account is not a check-writing account, as I said before. It's only used for monthly PennVEST ACH loan transactions," Catranis said.
The authority became aware of the scam when it received calls from people who received the checks, Catranis said.
"People called our office and said, 'Why did you send me this check? I didn't do business with the authority.' We received about 25 calls from people from places like Tennessee, North Carolina, South Carolina, Georgia, Florida, Alabama, Ohio and Texas," Catranis said.
The hacker sent instructions along with the checks, telling the recipients to cash the checks in their bank and then send back a percentage of the money via "money gram," Catranis said.
According to one of the callers who contacted the authority, Catranis said, the hacker had devised a way to launder the money, and it involved people who used online forums.
"It appears it was triggered when someone answered an ad for employment or was selling merchandise," Catranis said.
"That came from one person who got a check that we had on the phone. That was their assumption. That's up to the fraud department or the police to figure out," Caulfield said.
Catranis said the authority immediately called Sovereign Bank in Pottsville, Sovereign Bank's fraud division and the Pottsville police department to launch "a full investigation."
"The Pottsville police department said the scam originated in Nigeria. Sovereign informed us at the point in time that we called the bank, there were no checks cashed on the account," Catranis said.
Franklin K. Schoeneman, the authority's assistant treasurer, asked a series of questions.
"What's the bottom line? So the checks were written. They were sent to people all over the country, and as far as we know, was anything cashed?" Schoeneman asked.
"No," Catranis and Caulfield said in unison.
"No checks made it through," Catranis said.
"So there's no dollars lost at this point?" Schoeneman said.
"Zero," Caulfield said.
"How were they signed?" Schoeneman said, referring to the checks.
"Stamped signature," Caulfield said.
"One that we got back was signed with a made-up name," Catranis said.
"And Sovereign's fraud division said they're going to put a freeze on the account, only allowing our deposit to go in to fund the PennVEST payment that comes out on the first of the month," Catranis said.
"We going to set up a meeting with the branch manager at Sovereign down here to discuss it. I'm not sure if we're ever going to find out what exactly happened. I made the executive decision to close that account," Caulfield said at the meeting.
"We're opening up a new account," Catranis said.
"We've actually opened it up in M&T, which is where we do most of our other daily transactions," Caulfield said.
However, later Tuesday afternoon, Caulfield said the authority may not close the Sovereign Bank account.
"I would like to retract that we are moving the account at this point. It remains in Sovereign Bank. We are investigating the possibility of changing the accounts," Caulfield said.
When asked how much money on average was in that account, Caulfield said The Republican-Herald would have to file a Right-To-Know request form.
Meanwhile, the authority is encouraging anyone who received one of the fraudulent checks to contact its office at 570-622-8240.
"We put together an email to all the staff that if any calls come in, get the following information. And if the person would be so kind to either email us a copy of the scam check or fax it to us, we'd appreciate it," Caulfield said. "So far, we've gotten about 20. And they look different, which is the scarier part. They look different. They're printed different. But you'll see our entire routing number on the bottom and it has Sovereign Bank's logo and their name up on the top."
Rene Medina, branch manager at Sovereign Bank, Pottsville, was not in the office Tuesday, according to a bank spokeswoman. When asked if another bank representative was available for comment, the spokeswoman referred all calls to Sovereign Bank's corporate office.
Bryan Hurst, a Sovereign Bank public relations specialist based in Boston, Mass., said Tuesday he could not comment until he did further research into the matter.