By QUINTON SMITH/YachatsNews
The FBI is investigating a computer fraud that cost Lincoln County more than $100,000 after an employee paid invoices thought to be for Oregon State University but instead ended up in a scammer’s bank account somewhere else.
The fake OSU invoices were paid Jan. 27, but the fraud was not discovered until April when OSU asked about a missed quarterly payment, county officials told YachatsNews.
The issue only came to public light through a tip to YachatsNews and comments made by county administrator Tim Johnson during a budget committee meeting last month.
The fraudulent invoices arrived through the county’s email system on Jan. 12, seemingly a request from the business office at OSU to the Lincoln County Fair for $18,039 and another for “educational extension, demonstration and field work” for $91,654.
Johnson told YachatsNews that is work that OSU routinely performs for the county.
The county made the electronic bank transfer of $109,693 to what it thought was an OSU bank account on Jan. 27. But it was not, according to a series of emails between the county and a fictitious OSU and bank official.
In response to a records request from YachatsNews, the county released a series of emails directing the payments to a new account that said OSU had set up at Chase Bank. That was fake.
Once it learned of the mistake, Lincoln County officials turned the issue over to the sheriff’s office, which asked the FBI to investigate.
Johnson told YachatsNews that it was not an OSU invoice or the university’s issue, but that “some unscrupulous person used them as a vehicle.” Johnson declined details on how the scam was uncovered, saying it would only aid others or help scammers work around the county’s new safeguards.
“There are groups out there who are constantly trying to break into computer systems or using emails as scams,” he said. “There are bad guys out there who are constantly trying to run scams.”
Johnson said all county employees are now required to go through twice-monthly video training sessions on computer fraud.
Confidential data OK
The county issued a statement to YachatsNews acknowledging it was the victim of fraud involving its email system. But the statement said “there is no indication of unauthorized access to the county’s internal network nor to confidential data, including personnel and voter records.
“After discovering the fraud in April, the county reported the incident to the Federal Bureau of Investigation,” the county said in its statement. “That agency’s investigation is ongoing. The county also alerted other local municipalities to be on the lookout for similar fraud attempts. Following the fraud incident, the county implemented additional security awareness training to ensure employees can recognize signs of fraudulent online activity.”
OSU officials also issued a statement, saying the university “recently became aware of this fraud and are very disappointed that someone would take advantage of Lincoln County and the county’s longstanding relationship with Oregon State University and OSU Extension.”
“OSU will cooperate fully with Lincoln County and law enforcement officials in their investigations into this matter,” university spokesman Steve Clark said in the statement. “We ask that anyone receiving suspicious e-mails about the university or suspicious messages seeking to represent OSU, to please report these matters to OSU’s IT security office at D-Fend@oregonstate.edu.”
Johnson emphasized that the Lincoln County incident was one employee who fell victim to an email phishing scheme – not a ransom ware takeover of the county’s entire computer system like occurred to Curry County government in late April.
That incident on the southern Oregon coast wiped out the county’s entire computer capabilities, stopping all of its business and electronic communication and requiring it to rebuild its system at the cost of hundreds of thousands of dollars. Commissioners there called it a “cyber catastrophe.”
“The Curry County situation is the reason we take this very seriously,” Johnson said. “And, I want citizens to understand that some of our costs are increasing because unscrupulous people are trying to scam us.”
- Quinton Smith is the editor of YachatsNews.com and can be reached at YachatsNews@gmail.com
I hope that Lincoln County has tightened up its payment system.
No payments should be issued to non-proven accounts. If there is no vendor number in the system and the payment request is not cross referenced to a bank account already in the system then it should be no payment. There has to be accountability somewhere. Who checks and who authorizes these payments (shouldn’t be the same person)?
Like I said I hope Lincoln County has taken action to ensure this won’t happen again