City official’s direct deposits rerouted in phishing scam

Paychecks of other employees also might have be targeted in scheme

Public Works Director Regina Wheeler pulls in an annual salary of more than $130,500 a year, making her among the highest-paid employees at the city of Santa Fe.

But earlier this year, a female fraudster hundreds of miles away was the one cashing in, according to police.

The woman, 53-year-old Laura Johnson of Twin Falls, Idaho, fraudulently rerouted Wheeler’s paycheck by direct deposit, police said, making Wheeler and the city a victim of a new phishing scheme the Internal Revenue Service says is on the rise.

Johnson filled out a direct deposit form using Wheeler’s name, and also sent a fake and voided check from Green Dot Bank, also with Wheeler’s name, to the city’s payroll office, according to police, who said everything was done by email.

“The payroll [office] processed the direct deposit form [and] then Ms. Wheeler’s pay began going to an account at Green Dot Bank,” the complaint states.

Police spokesman Greg Gurulé said late Thursday he didn’t know whether Johnson had been arrested. Asked how an out-of-state suspect charged in a criminal complaint in Santa Fe would

arrested, Gurulé said he didn’t know all the specifics.

“It would depend on the level,” he said. “This looks like it’s going to be an arrest warrant, so it takes a little more priority than a bench warrant, and in that case, we would work with the local department, I believe, to try to reach her.”

Police said Wheeler realized her paychecks weren’t going into her bank account “after three pay periods had been successfully deposited to the Green Dot Bank account.” The three paychecks totaled more than $9,400.

In a brief telephone interview Thursday, Wheeler expressed great happiness that a suspect had been identified.

“That’s freaking awesome,” she said. “Thanks for that news.”

Wheeler said she was willing to talk about her experience but was reluctant to do so for fear of jeopardizing the case.

“My understanding was that a number of high-level officials were targeted,” Wheeler said. “They took a bunch of [organizational] charts or whatever and they were like, ‘Hey, there’s some big paychecks. Let’s get those.’ ”

City spokeswoman Lilia Chacon said she didn’t have any additional information, including whether other high-salary employees had been targeted. However, Chacon said any type of fraudulent activity is a concern for the city.

“The bad guys do this all day long until they can chisel their way in,” she said. “It’s just a game of whack-a-mole. We do what we can to protect ourselves on every front, but this is what the bad guys do, and they make their living doing this.”

In December, the IRS warned of “an uptick in phishing emails” involving fake payroll direct deposits and wire transfers.

“These emails generally impersonate a company employee, often an executive, and are sent to payroll or human resources personnel,” the IRS said. “The email from the ‘employee’ asks the payroll or human resource staff to change his or her direct deposit for payroll purposes. The ‘employee’ provides a new bank account and routing number, but it is actually controlled by the thief. This scam is usually discovered pretty quickly, but not before the victim has lost one or two payroll deposits.”

The warning almost mirrors what happened to Wheeler.

According to the criminal complaint, filed Thursday in Magistrate Court, Johnson is accused of sending the city an email or series of emails with an altered voided check bearing Wheeler’s name, as well as an authorization agreement for automated payroll deposit into an account with Green Dot Bank, which police said is affiliated with Walmart.

Johnson allegedly used an AOL account but made her email “look to appear as a city of Santa Fe employee email,” though she misspelled Wheeler’s name, using two l’s instead of one, according to the criminal complaint.

After obtaining a search warrant, police identified the account holder as Johnson with the help of Michael Menz, senior director of the bank’s Security and Fraud Intelligence Department.

“Mr. Menz informed me that at a later time I would be emailed all account information I requested in my search warrant,” Officer Derick Romero wrote in the criminal complaint. “Mr. Menz then told me he was looking at Ms. Johnson’s purchase history for the months of April and May of 2019 and there were large purchases between $1,000 [and] $3,000 at different Walmarts in Idaho, but mostly the city of Twin Falls, during the dates the deposits were made by the city of Santa Fe.”