Valencia County Loses $2 Million in Hospital Construction Phishing Scam

Valencia County has lost over $2 million after a scammer impersonating the chief financial officer of Bradbury Stamm Construction, the contractor building the new Valencia County Hospital in Los Lunas, tricked a county employee into authorizing a series of electronic payments through an Automated Clearing House system.

The fraud began in April 2025 when the county received two emails purportedly from Bradbury Stamm's CFO requesting that payments be arranged via ACH, an electronic transfer system that processes transactions between financial institutions. One email was flagged as spam. The other was forwarded to the county's finance department, where an employee independently set up an ACH payment account and processed the transfers. The county paid over $2 million before the fraud was discovered.

County Manager Jhonathan Aragon posted a press release on the county's website on Thursday, March 12, and spoke publicly about the incident the following day. "Even with thorough technological training, robust testing as well as internal processes, a mistake happened as a result of human error," Aragon said in a statement.

The stolen funds came from an account holding legislative appropriations and American Rescue Plan Act funds earmarked for hospital construction. Aragon emphasized that a separate account holding mil levy funds designated for hospital operations was not touched.

After discovering the fraud, the county contacted its bank, the state auditor, and legal authorities. A third-party investigation was commissioned to determine how the scam succeeded and to recommend safeguards. Investigators also examined whether the county's systems had been hacked or monitored by the fraudster. "We had about 15 accounts set up on it and under the direction of the investigators continued with business as usual so they could make sure we weren't being monitored through our system, that this person didn't hack into our system," Aragon said. "They didn't find that to be the case."

The investigation, conducted by an investigator identified only as Martinez, recommended that if the county uses ACH in the future, it implement processes to verify that accounts are set up correctly and carry proper authorization before payments are processed. Aragon made clear that such a future is unlikely. "There's not an appetite to continue with ACH, obviously," he said.

Aragon reflected on the broader pattern behind the scheme. "Hindsight is always 20/20. Looking back, it's very obvious. As the investigation was happening, in talking to people, I found out this happens a lot. ACH fraud, check fraud. People and businesses don't think it will happen to them, until it does. It's surprisingly common."

Despite the financial loss, Aragon told KOB4 that the hospital construction timeline remains intact and the Valencia County Hospital is still expected to open this fall. Key questions remain unanswered, including whether any of the stolen funds have been recovered, whether criminal charges have been filed, and what administrative consequences, if any, the involved employee faces.