Milford Entities of NYC allegedly scammed out of $19M — thanks to single phishing email

A well-known city firm that owns and manages luxury properties was allegedly scammed out of nearly $19 million thanks to a single phishing email, The Post has learned.

Milford Entities/Management Company — whose tony properties include Liberty View and Liberty Luxe in Battery Park City — was the victim of thieving cybercriminals in early July, sources and emails show.

The “spoofing’’ email led to the gargantuan sum getting accidentally transferred to a TD Bank account posing as the Battery Park City Authority, according to sources with knowledge of the situation and the internal correspondence.

The Department of Homeland Security is now leading a multiagency task force investigating the whopping fraud, according to sources and emails obtained by The Post. 

“Last month, Milford Management was the victim of a fraud involving the theft of funds through the creation of a fraudulent bank account in the name of the Battery Park City Authority,” the Manhattan-based company said in a statement.

“The theft involved buildings directly owned by Milford Management-related entities, as well as others the company manages,” it said.

“As this fraud is the subject of an ongoing law enforcement investigation, we will have no further comment on the matter.”

The BPCA — a state entity that maintains and develops the Hudson River-side Manhattan neighborhood — confirmed it did not receive the company’s quarterly payment due in early July.

The lifted funds involved ground-lease payments and taxes, or PILOT fees, that are collected from Battery Park City apartment owners and sent to the BPCA on a quarterly basis. 

PILOT fees — or “Payment In Lieu Of Taxes” — are essentially property taxes paid by condo owners to their building, which then sends the funds to the BPCA to cover operations.

Milford Entities owns three buildings in Battery Park City and is the management company of at least six others in the trendy downtown neighborhood — collecting PILOT fees and ground-lease payments from more than 2,000 units.

---

Every morning, the NY POSTcast offers a deep dive into the headlines with the Post’s signature mix of politics, business, pop culture, true crime and everything in between. Subscribe here!

---

The board of managers at one luxury Battery Park residential tower managed by the firm was informed July 18 that $3.5 million worth of its quarterly dues were lost in the scam, an email shows.

The BPC Homeowners Coalition, a non-profit composed of elected members representing 18 condos and 5,000 homeowners in the neighborhood, also sent out an email obtained by The Post warning residents in buildings unaffected by the scam to review their cybersecurity policy.

“This appears to have been the first cyber-attack in BPC, but it will not likely be the last,” the letter said.

Justine Cuccia, president of the BPC, wrote, “This is time for open, verbal dialogue between the condominium Boards, as this could have happened to any one of our building management agents, and so, to any one of us.’’

BPCA said in a statement to The Post, “The Battery Park City Authority has been made aware of a cyber incident resulting in payment issues that affected several buildings in Battery Park City.

“BPCA was not involved in this incident and its operations are not impacted.

“BPCA will continue to work with residents of the affected buildings, the property management company, and law enforcement agencies as the investigation continues.”

DHS did not respond to The Post’s request for comment.