Local contractor scammed out of $731K for work on DCU Center

• Posted by Mark Henderson Aug 18 - Filed in Business - #DCU Center  #Worcester  #Fraud  #Stutman Contracting  #email  #U.S. District Court  - 9,319 views

  

  WORCESTER — A fraudster who gained access to a local contractor's email system diverted more than $731,000 in payments intended for a company that installed seating at the DCU Center, according to a recent federal court decision.

  The scheme unfolded in 2023 after Stutman Contracting Inc. hired Hussey Seating Company to supply and install seating at the Worcester arena under a $1.09 million subcontract. Hussey completed the work and submitted invoices eventually totaling $731,861, according to a July 29th decision by U.S. District Judge Margaret R. Guzman.

  The 016 attempted to contact representatives of Stutman Contracting and Hussey Seating for comment and were not successful.

  In July 2023, a third party gained unauthorized access to at least 1 account in Stutman's Microsoft email system, the court said. The person, or someone working with the person, registered internet domains resembling those used by Stutman and Hussey and created an inbox rule that diverted legitimate emails from Hussey away from their intended recipient. A forensic expert found evidence of unauthorized access to a Stutman employee's email account. A cybersecurity review found no evidence that Hussey's systems had been compromised, court documents revealed.

  Using an email address made to appear as though it belonged to Hussey, the fraudster told a Stutman employee that Hussey had changed its banking information and asked to be paid by wire transfer. The fraudster then supplied instructions for an account that did not belong to Hussey. Stutman did not independently verify the change with Hussey before sending the money, according to the decision.

  According to Stutman's original complaint, the scheme relied on email addresses that closely resembled Hussey's legitimate addresses. While Hussey used the domain husseyseating.com, the fraudulent messages came from addresses using husseyseatnig.com, transposing letters in the word "seating."

  Radio Worcester (11:44): B.B.B. warns of phishing scams and fake emails. Listen here.

  Stutman employee Jillian Baker received a July 25th, 2023, email appearing to come from Hussey Treasury & Credit Manager Brian Harrington claiming the company was experiencing banking difficulties and asking that payments be made electronically, according to the complaint. 2 days later, the person posing as Harrington supplied information for a bank account and instructed Stutman to send payments there.

  Stutman alleged that after it sent the first $178,634 payment on August 8th, the fraudster responded from the fake Harrington address but mistakenly copied a Hussey project manager at his legitimate company email address. Stutman argued that should have alerted Hussey to a discrepancy between Stutman's assertion that it had paid and Hussey's records showing it had not received the money.

  Hussey disputed Stutman's account of responsibility for the breach. In its response and counterclaim, the company alleged that inadequate security on Stutman's computer system allowed the scheme to occur and said its own computer systems had not been infiltrated. The court's later decision said a forensic examination found evidence of unauthorized access to a Stutman employee's email account, while a cybersecurity review found no evidence that Hussey's systems had been compromised.

  The scheme also involved communications in which someone posing as a Stutman employee obtained payroll records from Hussey. Those records were later used to help convince Stutman that the fraudulent payment instructions were legitimate, the court said.

  Between August and October 2023, Stutman made 3 wire transfers totaling $731,861 to the fraudulent account. At the same time, the fraudster separately communicated with Hussey while impersonating Stutman and assured the company that payment was on the way.

  The fraud was discovered October 12th, 2023, after Hussey contacted Stutman about the missing payments and the companies determined they had been communicating with a third party. Stutman reported the incident to local law enforcement, and the U.S. Secret Service later became involved in the investigation.

  The missing money led to a dispute over who should bear the loss. Hussey filed a claim against a payment bond Stutman had obtained to secure payments to subcontractors and suppliers. Stutman then sued Hussey, asserting several claims, including breach of contract, negligence and violation of the Massachusetts Consumer Protection Act.

  Guzman ruled that Hussey did not breach its subcontract by seeking payment because the company never received the $731,861. The contract required Stutman to pay Hussey for its work, the judge wrote, rather than simply send money to a third party impersonating the company.

  The judge granted summary judgment to Hussey on Stutman's breach-of-contract claim and dismissed Stutman's remaining claims without prejudice for lack of subject matter jurisdiction, finding Stutman had not established an actual or imminent injury when it filed the lawsuit. Hussey's counterclaims were not resolved by the decision.

  It is not clear what Stutman's recourse is or if Hussey has be paid.