The NJCCIC continues to receive reports of threat actors impersonating multiple New Jersey local planning and zoning officials to steal sensitive information and funds and exploit public trust. These local officials handle property use regulations, master plans, zoning permits for structures, and application reviews. Threat actors leverage publicly available information to identify potential victims for these fraudulent schemes.
Threat actors impersonate local planning and zoning officials to send unsolicited emails that appear to be legitimate. The sender’s display name is “ PLANNING AND ZONING DEPARTMENT” and the sender’s email address originates from a non-governmental domain, such as “usa[.]com.” The phishing emails display a subject line of “ACTION REQUIRED FINAL APPROVAL” and reference property addresses, permit information, and/or zoning application numbers. The threat actors include the official’s purported email signature and attach wire instructions for paying the invoice. If this fraudulent scheme is successful, the threat actors steal the funds and use the victim’s sensitive information to commit identity theft and other malicious activity.
Recommendations
- Exercise caution with communications from known senders, especially unsolicited communications claiming you owe money.
- Be suspicious of any urgent demand for payment via wire transfer, gift cards, or cryptocurrency, as these payment methods are unusual and difficult to trace, reverse, and recover stolen funds.
- Confirm requests from senders using contact information obtained from verified, official sources before taking action, such as opening attachments or clicking links.
- Keep systems and browsers up to date.
- Review the FBI PSA on Criminals Impersonating City and County Officials in Phishing Emails for Planning and Zoning Permits.