Even before the email popped up on his computer screen, Monday, Oct. 19, was bound to be a fateful day for Richard Rosen.
In a few hours, the Whitman developer’s plan to transform the former Salvation Army church on Carver Street into condos would face a crucial vote by the Zoning Board of Appeals – the last major hurdle in a long review process. After months of meetings and revisions, Rosen was anxious about the outcome.
“I was pretty stressed out,” he said this week. “I wanted it to be approved. Even though I’m a veteran developer, I’ve never worked in this town. Then I get an email saying, ‘The staff have recommended approval of the application,’ which to me was like, ‘Wow, this is awesome.’ It took a little of the stress off.”
The message, topped with an official-looking Town of Plymouth seal, said it came from Town Planner Spencer Dancause. It contained details such as the project’s map location and lot number. There was also a bill for $3,950 to cover “the application review and approval fee associated with the processing and administration of your application.”
“The timely settlement of this invoice is necessary to streamline the approval process and avoid delays in final authorization,” it explained. “While staff have recommended approval, finalization cannot proceed until the associated review fee has been remitted.”
Eager to avoid an 11th-hour delay, Rosen immediately replied.
“Is it possible I can pay this by check tonight?” he asked. “If not, I will wire the funds in the morning.”
The response came quickly.
“Please be advised that checks and cash payments are not accepted for this type of application fee,” it read. “Attached, you will find the official invoice and wire transfer instructions for completing the payment.”
There was a link to follow, but Rosen did not click on it. Instead, he forwarded the messages to his engineer.
It was a smart move.
As you have likely figured by now, the payment demand did not come from Town Hall.
“This is a scam,” Rosen’s engineer told him. “They’re not going to email you and ask for money.”
That evening, the Salvation Army building project won a unanimous sign-off from the ZBA. But the scammer or scammers apparently did not keep abreast of the news. Two days later, Rosen received a third email.
“I hope you are doing well,” it read. “This is a friendly reminder regarding the outstanding payment for the attached invoice, which is now overdue.”
By then, Rosen had alerted officials to the fraudulent solicitation. They posted a warning on the town’s website and Facebook page.
This type of online thievery, abetted by the dizzying acceleration of artificial intelligence, is becoming increasingly common in cities and towns across the country. “Bad actors” use the technology to comb meeting agendas and other public information, mining for potential victims, said Joseph Young, Plymouth’s IT director.
In this instance, the scammers found an agenda for the Oct. 19Zoning Board of Appeals meeting, “got the information, case number, his name, the name of the engineering company,” Young said. “They probably did a quick Google search for Richard Rosen in Plymouth and were able to obtain his email address. And then they sent an email looking to get some money from him.”
A town IT review of the messages yielded clues about their inauthenticity – such as an email address with a “gov@usa.com” suffix – but did not provide a digital trail that led back to the culprit or culprits. In most cases, they are untraceable.
“Transparency and full disclosure sometimes come back to hurt,” Young said. “We put these agendas out there so the public knows what’s going on. But people are finding ways to capitalize on that.”
He urged applicants with business before the town to be suspicious of emails purportedly from government employees seeking money for approvals or permits.
“Our message to the public is, if you get something like this, don’t reply to the email you got because it’s going back to that bogus address,” Young said. “It’s not going to the employee. Go to the town’s website, find contact information for the employee, call them, visit Town Hall … The town doesn’t really deal with wire transfers. We definitely don’t deal in bitcoin.”
Before the advent of easily accessible AI agents, schemes like the one that nearly ensnared Rosen required tedious online searches of agendas and minutes to find information related to a building permit or development proposal. Today, Young said, criminals are “writing programs to scavenge massive amounts of data” in seconds. Minimal effort can yield lucrative returns.
“They play on people’s emotions to get them to send the money,” he said.
Answering an email request by itself does not necessarily put someone at risk, he said – as long as they don’t provide routing and account numbers, passwords, or other sensitive information.
But Young urged people who do engage with a scammer to immediately change relevant passwords, such as for Gmail or bank accounts, and to use multifactor authentication whenever it’s offered. That usually entails generating a one-time numerical code as a second step in logging on to a website.
Following the Rosen incident, the town on Tuesday held a meeting with department heads to review payment safety measures.
“We used [his] email as an example to have any department that accepts money talk to the people, to educate them that we are only going to accept payments in person or through approved means,” Young said.
Meantime, Rosen – who admits he’s not savvy about AI tech – is still reflecting on his close call.
“It’s scary,” he said of the risky exchange. “It’s really scary.”
Mark Pothier can be reached at mark@plymouthindependent.org.