Batavia company defrauded of more than $27k in 'spear phishing' scam

BATAVIA – A Batavia company that ships processing and heating elements for industrial processes was the victim of “spear phishing,” a type of fraud involving emails sent from a known or trusted sender intended to get confidential information.

In the case of Ash Equipment Company, 155 Oswalt Ave., Batavia, it was a loss of $27,238.05 in fraudulent purchases that was reported to police July 9.

According to police reports, electronic communication equipment was ordered via email from a known customer, Watch Commander of Investigations Eric Blowers said in an email.

The company shipped it to Ohio and learned later that the order was fraudulently placed because the known customer did not place it, Blowers said in the email.

The Federal Trade Commission warns on its website, www.consumer.ftc, that in phishing or spear phishing, scammers send emails or text messages that look like they're from a known or trusted company. The FBI's Internet Crime Complaint Center reported that victims lost $30 million to phishing schemes in one year.

Ash Equipment owner Denise Petitti said the company discovered the fraud “totally by accident” and was able to prevent a second fraud from occurring.

“They had placed an order initially in April,” Petitti said. “We had fulfilled that order, and then they immediately placed another order. … We received these items in the second order July 8 and shipped them out.”

The second order, for $26,800, was for similar items but made by a different manufacturer, Petitti said.

“Just by chance, (an accounts payable employee) called the customer to ask when they were going to pay the invoice for the first order,” Petitti said. “That’s when she was told the first order was a fraud, so the second order was a fraud, too.”

Petitti began working with UPS to prevent the second order from being delivered.

She also called the mail drop and was assured that they would not allow the package to be picked up if it was delivered.

Petitti said the company has a generic email address they use for quote requests. The emails involved in the frauds were targeted at a salesman who worked with that customer.

“I thought that was someone the salesman knew,” Petitti said.

In more than 50 years, this is the first time the company was defrauded, she said.

Now that it has been defrauded, Petitti said she realized she missed some red flags.

One was the dollar amount of the order, as they usually get orders for $10,000 or less.

Another red flag was that the email address was slightly altered and grammar in the email was off. But when working with large companies with overseas buying groups, Petitti said she overlooked it.

Another red flag was that the shipping address was to a mail drop in Cincinnati, not to the company’s actual address, she said.

In pursuit of stopping the fraudsters, Petitti called Cincinnati police, who redirected her to Green Township Police. A detective told her she needed to file a police report in Batavia – which she did – and she believed the two departments would work together.

Blowers said he could not comment about an ongoing investigation.

Going forward, Petitti said she will be more skeptical of large orders and funky emails.

“It’s ironic that the afternoon we discovered this was fraud, we received an email at the generic email address from a different company also looking for a piece of electronic equipment.

“To the salesman’s credit, he tried to not get this order. He tried to ignore them and they were very persistent,” Petitti said. “They were all ready to process it and my sales manager said, ‘No. It’s fake.’ ”