The most populous county in Texas nearly lost $888,000 last year, after a local government employee fell for a spear phishing campaign that used Hurricane Harvey as a lure, the Houston Chronicle has reported.
According to the Chronicle, the auditor's office at Harris County – which includes much of the city of Houston and is home to almost 4.1 million citizens – received a series of emails beginning on Sept. 21, 2017, from someone claiming to be an accountant at D&W Contractors, Inc., a company hired to clear debris and perform repair work on a parking lot damaged by the hurricane in August.
The email reportedly asked the county to deposit $888,000 into the contractor's new bank account. Only after the payment was executed on Oct. 12 did county officials receive an alert that the account did not actually belong to D&W, and the contact person who sent the emails was a fraud. Fortunately, the county was able to recoup the money.
Harris County Precinct 1 Constable Alan Rosen told the Chronicle that the county the county is working with the FBI, as the group responsible for the phishing attack has apparently tried similar scams against other county and city governments. He did not specify what group this is.
Last August, the US-CERT issued a warning that scammers could seek to capitalize on Hurricane Harvey, much like they have following other disasters.
