Valencia County scammed out of $2 million in email phishing ploy

A scammer played the long con, emailing a Valencia County finance department employee for nearly eight months before getting them to send $2.02 million in taxpayer dollars.

In an interview Friday following a press release posted on the county’s website on Thursday, March 12, Valencia County Manager Jhonathan Aragon said the county received two emails in April 2025 — one was marked as spam but the other was forwarded to the county’s finance department. The email came from someone posing as the chief finance officer for Bradbury Stamm, the contractor building the county hospital.

The faux CFO wanted to arrange for payments to the company be made via Automated Clearing House, an electronic transfer system that processes transactions between financial institutions. Banks commonly use an ACH network to process electronic payments, such as when a customer sets up and uses a bill payment feature with their bank to pay monthly bills.

“A finance department employee was in communication with this fraudster for the better part of 2025,” Aragon said.

When the scammer made contact with the employee, the county wasn’t using an ACH system, the manager said, but it was an option under discussion.

“We contract with a lot of smaller, local businesses and, as a matter of efficiency, we like to get them paid sooner rather than later,” he said. “Sometimes, for these smaller, mom-and-pop businesses net 30 terms (meaning the full balance owed is due within 30 days of invoicing) don’t work well.”

The ACH system was set up in September 2025 and when the real invoice from Bradbury Stamm came in December, the new electronic system was used to pay it to the account set up by the scammer. Up through November 2025, Aragon said Bradbury was paid by a physical check, like the majority of the county’s other contractors and vendors.

“The online payment was sent in January,” the manager said. “When Bradbury told us they hadn’t received the payment and our finance director said it was paid through ACH, we knew there was a problem.”

Aragon said an internal investigation into everyone involved in the process was conducted by Albuquerque attorney Jonlyn Martinez.

“There was an extremely bad mistake made, but it wasn’t intentional or malicious,” the county manager said. “We have recommendations from Ms. Martinez in relation to what we need to do in terms of that employee. I really can’t say more, since it is a personnel issue. I can say there are no criminal charges.”

The county commissioners were told about the fraud immediately, Aragon said, and the county’s bank and the New Mexico State Auditor’s Office were notified.

“There are very capable, appropriate authorities involved with this investigation,” he said. “The reasoning for the delay in releasing this information is we’ve were asked to hold off because there’s the very good potential of recovering this money. Obviously, that’s not 100 percent, but the indication is there’s a good chance.”

Aragon said the agency investigating the fraud has directed the county to not disclose its name at this time, so as to not jeopardize the investigation and possibility of recovering the $2 million.

“The agency investigating the criminal aspects is purely investigating the fraudster,” he said. “They don’t feel this was malicious on the part of the employee.”

The manager said communication between the scammer and employee was confined to email; no one with the county called Bradbury to verify it wanted to transition to ACH payments rather than physical checks.

The employee was able to set up a payment account via ACH independently, Aragon said, and the investigation by Martinez recommended if the county uses an ACH system in the future, they implement processes to double check the account is set up correctly and properly authorized.

“There’s not an appetite to continue with ACH, obviously,” Aragon said. “We had about 15 accounts set up on it and under the direction of the investigators continued with business as usual so they could make sure we weren’t being monitored through our system, that this person didn’t hack into our system. They didn’t find that to be the case.

“Hindsight is always 20/20. Looking back, it’s very obvious. As the investigation was happening, in talking to people, I found out this happens a lot. ACH fraud, check fraud. People and businesses don’t think it will happen to them, until it does. It’s surprisingly common.”

The money sent to the scammer came out of an account which held the legislative appropriations and ARPA funds set aside for the construction of the hospital, Aragon said, emphasizing the account with the mil levy funds for operation for the hospital was untouched.

“The project is 100 percent still on track. We will finish the hospital. We are going to have to kick in some funding from the general fund,” he said. “We do ask for grace. Nobody was maliciously trying to do this. We are a large organization and a lot of payments run through here. This was an extremely unfortunate event. I don’t wish this on anybody; it’s very much something that could happen to anybody.”