SAN JUAN, P.R. — As if Puerto Ricans needed another reason to worry about where their tax money was going, a senior official told the police on Wednesday that the island’s government had unwittingly handed over $2.6 million to thieves after being fooled by a bogus email message.
And it wasn’t the first time.
Rubén Rivera, the finance director of the government-sponsored Puerto Rico Industrial Development Company, said in the police report that the email message contained instructions to transfer money intended for the public pension system to a different bank account than had been used before. Mr. Rivera said his office sent the money to a foreign account on Jan. 17.
Whose bank account that was, and what happened to the money, is under investigation.
The police said the email had been disguised to seem as if it had been sent by a government employee who handles pension fund transfers. “We think that the hacker might have breached the system through the retirement agency,” said José Ayala, director of the bank robbery division of the island’s police force.
The theft was discovered when the pension-system employee called to ask why the money had never arrived.
Similar attacks, known as business email compromises, have grown increasingly common across the country in recent years, often targeting municipalities. A school district in Manor, Texas, said it lost $2.3 million to a similar fraud in January, The Associated Press reported.
Mr. Ayala said the development company, known as Pridco, had apparently been tricked out of another $63,000 the same way in recent months, and that another government entity, the Puerto Rico Tourism Company, had been fooled into transferring $1.5 million. He said the cases had been handed over to federal officials and were no longer under his jurisdiction.
Osvaldo Soto, the island’s public affairs secretary, said the government had been working with federal law enforcement agencies as well as those on the island since Jan. 23 to investigate the frauds, which he said had also affected the island’s Roads and Transportation Authority and Commerce and Exports Agency.
“Special resources have been assigned” to the investigation, Mr. Soto said.
He said the thefts did not threaten the pension system’s ability to issue benefit checks, at least for now. “People with pensions will continue to receive their payments as per usual without any irregularities,” he said.
Manuel Laboy, the island’s secretary of economic development and commerce and the head of Pridco, said the development agency was trying to recover the $2.6 million, The A.P. reported. Mr. Laboy’s office said in a statement that he would hold a news conference on Friday.
The incidents have come to light at a time when public trust in Puerto Rico’s financially strapped government is already very low. There have been dozens of street protests on the island since last summer, when millions of residents took to the streets to demand the resignation of Gov. Ricardo Rossello, whose administration was mired in scandal.
“We believe there is a lack of competence and neglect from the government,” said Federico Torres Montalvo, 74, a top public-sector labor leader. “Any embezzlement is the government’s fault. I heard that the governor assured that the pensions will not be affected by this, but right now, people have very little confidence in government institutions.”
Aury Curbelo, an information technology expert and a professor at the University of Puerto Rico, said the situation spoke to a lack of cybersecurity training in government offices.
“Training is forgotten because it costs,” Ms. Curbelo said. “Hospitals have to have them because they have to comply with regulations. Government agencies have no regulations.”
A spokeswoman for the island government’s information technology office did not respond to requests for comment.