Highland County is reeling after a cyber scam led to the unauthorized transfer of over $450,000 of taxpayer dollars to a fraudster posing as a legitimate vendor. According to a report from the Auditor of State's office, the scam occurred due to a lack of proper safeguards and training for employees to vet payment redirect requests. The report revealed that in September 2024, a county employee erroneously sent two payments totaling $450,120.58 to a fraudulent account.
The misstep has resulted in a finding for recovery by auditors, specifically pointing out an issue that resulted from the county's failure to independently verify the legitimacy of the payment redirection. Auditors noted that the county did indeed manage to "recover $184,073.73 from the bank involved, and the county’s insurance company paid $263,546.85 of the lost funds." However, to cover all the bases, the county was required to repay a $2,500 deductible that was part of the audit findings.
This incident has cast a harsh light on Highland County's financial practices, especially considering another finding for recovery was issued against the county. This time, it concerned the payroll clerk who failed to "remit and file portions of tax payments in fiscal years 2019, 2020, 2021, and 2023," which accumulated $1,100 in late fees and penalties. "These charges would have been avoided had the withholdings been remitted by the required due dates by the payroll clerk," auditors declared.
The Auditor of State's Office, responding to the incident, issued a bulletin in 2024 to set clear standards and expectations in an attempt to mitigate such fraud from occurring. According to the bulletin, "Prior to accepting the changes to payment information, none of the bulletin’s recommended steps were taken to independently verify that the request was legitimate. In addition, the county auditor had not adopted a policy or implemented training for employees in his office and in other county offices to recognize vendor redirect schemes." This reflects a systemic issue that the county is now forced to reckon with and to correct swiftly.
