Scammers are posing as town officials in phishing scheme targeting planning/zoning applicants

Riverhead Town officials are sounding the alarm about an email phishing scam targeting local residents.

Scammers are emailing residents who’ve had some interaction with the town planning or zoning board, spoofing official Riverhead Town correspondence, and advising recipients that they must wire funds to the sender to cover fees associated with their application. 

The fake documents bear the town’s official seal and are accompanied by an email message that purports to be from a town official.

Scammers appear to be targeting individuals who have pending applications before the planning or zoning board, perhaps scraping information that appears on board agendas and application documents posted on the town’s website, officials said.

At least one individual received an email message purporting to be from Zoning Board of Appeals Chairperson Otto Wittmeier, with attachments including an invoice for $4,000 and an “itemized breakdown of application approval fee,” detailing the services for which the fees are being charged.

The email came from an email address close enough to the town’s official email address that a quick look might not arouse suspicion. The email addressed used was “planning.townofriverhead.gov@usa.com”. Riverhead Town emails all use the town’s web domain, eg. “@townofriverheadny.gov”.

The correspondence includes “remittance information” for a wire transfer to a bank in Kansas City, Missouri. It recites a routing number that is actually associated with the bank named, according to the Federal Reserve FInancial Services database. 

The Town of Riverhead does not use wire transfers to collect fees of any kind from applicants, Riverhead Senior Planner Matt Charters said during a Town Board works session discussion today. 

“We’re never going to ask you for a wire transfer for anything like that,” Charters said.

“If you get a suspicious email for a planning department application, always call [the planning department],” Charters said. The department’s number is 631-727-3200 ext. 240, he said. 

The town is aware of fewer than a dozen of these phishing emails, Charters said in a phone call after the meeting. There were some at the beginning of the year and a few more recently. 

“We don’t know if people who’ve received them haven’t contacted us,” he said. The town is aware of one person so far who wired the requested funds as instructed.

“For the public, you’re never going to get something from us asking for a wire,” Town Attorney Erik Howard said. “So if you see something like that, that’s when you contact us.”

Riverhead Police Chief Ed Frost said the police department has not received any complaints about this particular phishing scam as yet. The email phishing scams being used to victimize people are too numerous to list, he acknowledged.

The City of Raleigh, North Carolina has posted warnings about an apparently identical phishing scam it became aware of last fall. The emails purporting to be from the city’s planning department used an email address at the usa.com domain, targeted people who had recently interacted with the City of Raleigh, and requested payments.

A phishing scam is a form of cybercrime where criminals impersonate legitimate organizations or individuals via email, text, or calls to trick victims into revealing sensitive information. These scams, often creating a false sense of urgency, typically steal passwords, credit card numbers, or login credentials via fake, spoofed websites, according to the Federal Trade Commission. 

How to Spot a Phishing Email:

Check the sender’s email address. The email may look official, but comes from a suspicious or unofficial address.

Look for urgent or threatening language. Scammers often use high-pressure words in the email to get you to act without thinking.

Hover over links in the email before you click on them. The text might say it’s going to a legitimate website, but the actual URL is different.

Be suspicious of requests for personal data. The Town of Riverhead will never ask for your Social Security number, bank account information, or passwords by email — and will never ask you to wire funds in payment of any fees.