$1.2 million stolen from Sebastopol reserves through fraudulent wire transfer

An ostensibly routine wire transfer involving Sonoma County’s treasury office turned out to be a scam that bilked Sebastopol of $1.2 million in property taxes at the end of April.

The theft was committed via a fraudulent email requesting a transfer from a pool of Sebastopol’s funds held by the Auditor-Controller-Treasurer-Tax Collector office, which oversees more than $3 billion in public money.

Sonoma County Treasurer Erick Roeser wouldn’t specify the exact contents of the seemingly authentic email because of an ongoing investigation, but he said it had an account number for the transfer and a Sebastopol official’s email address.

“It appeared to us it was coming directly from staff of the city of Sebastopol,” Roeser said.

“This is the first fraudulent transfer I’m aware of that has been successful,” he said.

Protocols are undergoing a full evaluation in response, and the office will communicate with a cyber security firm for recommendations on how to combat cybercrime.

“We’re doing an internal investigation as well to see where things occurred and if there’s anything we could have done differently. But nobody’s been reprimanded at this point,” Roeser said.

The stolen funds are equivalent to about 10% of the city’s annual operating budget. They included property tax receipts collected by the county and other moneys parked with the county and pooled with revenue from other cities to be held and invested until they were needed, said Sebastopol City Manager Larry McLaughlin, who doubles as city attorney.

Sebastopol’s Finance Department discovered the transfer in early June, and the matter has been under investigation ever since by unidentified law enforcement agencies, as well as the city’s insurer, in collaboration with the city and the county.

Roeser said his office became aware of the theft around June 9 and the FBI, Santa Rosa and Sebastopol police departments were notified, but he didn’t know which agency was currently involved in the investigation.

Nothing was publicly disclosed about the theft until Friday, when Sebastopol leaders announced the loss ahead of Tuesday’s budget discussions, which the City Council believed could not proceed without acknowledging the theft, city officials said.

“We’re working collaboratively with the county, with our insurers and with law enforcement,” Mayor Una Glass said. “And we expected to get this resolved. But we felt it was proper to disclose this to the public before we pass our budget.”

McLaughlin said the city hoped to recover the funds but did not have assurances from its insurance providers that the money would be reinstated.

“If we had assurances we would have the money reinstated, we would have said so,” he said.

Santa Rosa attorney John Friedemann, who specializes in complex transactions and business litigation, said it could take up to 12 months before insurance providers decide if a loss is recovered and that will depend heavily on who’s deemed at fault.

He described the theft as a “smash and grab” and said it’s unlikely authorities will find the fraudster or money.

“This stuff is gone like a puff of smoke,” he said.

McLaughlin would not disclose what agencies were involved and said that the decision to say anything about the matter at all was “because we felt we needed to be transparent at the time the budget is approved on Tuesday.”

The city policy is that 15% of the final budget be kept in reserves. The proposed general fund is $11.2 million.

Although the city has other reserve funds, the effort to maintain that threshold while the status of the unrecovered money remains unknown means certain actions contemplated in the budget will have to be delayed as part of a public discussion, McLaughlin said.

He and Glass said the theft is unrelated to a police department computer system failure reported earlier this week that some have speculated could have been the result of a computer hack.

McLaughlin said the police department and the city remain fully functional.

You can reach Staff Writer Mary Callahan at 707-521-5249 or mary.callahan@pressdemocrat.com. On Twitter @MaryCallahanB.