Canyon Lake builder allegedly involved in email spoof scam

Email spoofing is a technique to trick people into thinking a message came from someone they know or trust. The messages often come with instructions to re-direct payments to accounts controlled by scammers.

Crime & Courts: Judge stacks 5 more years onto Andre McDonald’s prison term following evidence tampering hearing

KKR has not publicly disclosed that it lost the money, but court documents reviewed by the San Antonio Express-News show the firm sent the money in two separate wire transfers after getting spoofing emails in March 2022.

The company and Chase Bank have been frantically trying to recover the funds. Records show the firm has traced and recovered $9 million, with the help of other banks and federal authorities.

KKR has not responded to questions sent by the Express-News.

Federal court records show that since last spring, the U.S. Secret Service officials in San Antonio have helped KKR recover some of the $5 million that passed through Nelms’ bank accounts, though at least half of that amount appears to have been wired offshore, where it is more difficult for U.S. authorities to recover.

Federal authorities seized $1.6 million after investigating Nelms, but has not charged him.

Nelms did not respond to detailed messages seeking comment, or through a lawyer he hired.

Last week, the U.S. Attorney’s Office in San Antonio filed a forfeiture lawsuit against the $1.6 million to see who else, besides KKR, might file claims to that money.

The Secret Service won’t discuss cases that are under investigation, but court documents describe Nelms as a “money mule” — a middleman recruited by con artists to move ill-gotten funds. In many cases, money mules are recruited by email to receive money in their bank accounts and then send it to another account or divvy it up into several others. They are paid a portion of the money.

“Most of them believe they are doing a legitimate job. They don’t know they are doing something illegal,” said Dan Morales, acting special agent in charge of the Secret Service in San Antonio. “That’s how the crooks wash their (dirty) money.”

The technique also puts some distance between the ringleaders, who are usually based in a foreign country, and police.

Morales said the Secret Service in San Antonio seized $20 million in 2022 connected to scams involving money mules.

“This office is pretty close to leading the nation in seizures,” Morales said.

A Secret Service affidavit said KKR was trying to pay quarterly distributions last year to Great Wall Asset Management. But instead of sending the $12.67 million to Great Wall, someone at KKR followed instructions from a spoofed email that closely resembled a real email from Great Wall.

KKR sent nearly $5.8 million on March 18, 2022, to a Chase Bank account. Twelve days later, KKR transferred $6.9 million to the same bank account.

A lawyer for KKR told the Secret Service that, after receiving a third email with similar, fraudulent payment instructions, the company began an internal review, and discovered discrepancies in the emails. KKR contacted Great Wall and found that it had not received either of the two wire transfers, and that Great Wall never sent new payment instructions.

By April 2022, the Secret Service-led South Texas Regional Task Force was on the case. An investigator with Wells Fargo Bank told one of the federal agents that $5 million — a portion of the $12.67 million — was transferred to Nelms from the Chase Bank account of Horizon Devco LLC in Phoenix, Arizona.

The affidavit said Nelms then appears to have transferred most of the money to various accounts, including $560,000 to accounts in the name of his deceased mother, more than $142,150 to an account for lawyer Sheldon Vann in Florida, and more than $2.4 million to a law firm, Lorium Law, in Fort Lauderdale, Fla., among others. The Wells Fargo investigator told agents that $1.6 million on hold. That amount is the basis of the forfeiture lawsuit filed in San Antonio.

The affidavit said that the $2.4 million went from Lorium Law’s Truist Bank account to an account at the Bank of Oklahoma.

An investigator with the Bank of Oklahoma told federal agents that “the account was virtually depleted with most of the funds wired to the United Kingdom,” the affidavit said.

In a statement, Lorium Law told the Express-News that Nelms has never been one of the firm’s clients.

“At this time, we are unable to comment on pending matters and investigations,” Lorium Law said.

The affidavit said Vann told agents that he represented Nelms and that Nelms got “mixed up” in a cryptocurrency scam involving the purchase of “discounted” Bitcoin. He said his law firm received funds originating from this scam for work for his client. Vann said he was willing to return the funds to the victim.

Vann also said that Nelms was in contact with two individuals as part of the deal.

“These two individuals purported to be the owners of the funds, and represented that the funds were related to real estate transactions,” the affidavit said. “They directed Nelms to purchase Bitcoin on their behalf for ‘investment purposes’. Vann advised that his client (Nelms) was unaware of the actual source of the funds, (and) that in fact the funds originated from KKR.”

Agents have been unable to locate the pair, the affidavit said.

Vann told the Express-News that he was one of several escrow attorneys that Nelms used.

He said Nelms portrayed himself as an expert on cryptocurrency, and said he would pay Vann for his escrow services when Nelms’ first investment deal went through. Vann believed Nelms lived in a suburb of Orlando, Florida, and was unaware Nelms lives in Texas.

“I was never part of any deal involving millions of dollars,” Vann said.

Vann said the Secret Service froze the $142,150 that went into his account, which contained part of what Nelms was supposed to pay him.

Vann said he has not heard from Nelms since December.

guillermo.contreras@express-news.net| Twitter: @gmaninfedland