Pulaski County officials say roughly $1.9 million in payments meant for the company that provides medical care at the county jail was quietly diverted for months after someone impersonated the vendor by email. The scheme began with a single message in June and wasn't caught until the vendor itself flagged missing payments in late October. One recent payment was recovered as the investigation continues.
According to Arkansas Business, the county announced this week that it is investigating after $1.9 million in vendor payments were diverted in a suspected email scam. The money was intended for Turn Key Health Clinics LLC of Oklahoma City, the company that provides medical services for the Pulaski County jail, the outlet reports.
How the Scheme Allegedly Started
The fraud traces back to June 19, 2026, when the Pulaski County Sheriff's Office received an email that appeared to come from a Turn Key accounts receivable representative, according to the Arkansas Times. The email instructed personnel to switch Turn Key's payment method to ACH and update the company's banking information for future payments, the outlet reports.
The sheriff's office then sent the payment voucher and the file containing the new banking details to the county's Accounts Payable Department to make the requested change, per the same account. That department entered the updated information into the county payment system, and the County Treasurer's Office followed its established procedures to verify the banking institution tied to the account. Payments then went out using the updated information over the following several months, the outlet notes.
A Vendor's Call Blows the Scheme Open
The scheme unraveled on October 23, when a Turn Key representative contacted the sheriff's office to say the company hadn't received payment in several months. Turn Key had never requested a change to its payment information, the representative told KARK.
The sheriff's office notified the county Purchasing Department, whose information technology team determined the original payment-change email appeared to be fraudulent, the station's report states. The most recent payment, totaling $126,344.87, was recovered after the suspected fraud was identified — though the station does not detail how much, if any, of the earlier $1.9 million has been clawed back. The investigation is ongoing, and officials said the FBI has been notified, per the same outlet.
County Leadership Responds
Pulaski County Judge Barry Hyde is urging the sheriff's office and all other departments that handle payments to review their existing policies and procedures and implement any additional safeguards needed to prevent financial fraud, according to the Arkansas Times. Hyde said the county takes the protection and responsible stewardship of public funds seriously, and county government remains committed to transparency and protecting public resources, the outlet reports.
Not an Isolated Playbook
Pulaski County's experience mirrors a pattern cropping up in local governments and businesses elsewhere. Pender County, North Carolina, lost approximately $650,000 last year after an outside party impersonated a vendor, fraudulently changed banking details, and received four payments over several months, according to StarNewsOnline.com. Officials there later said a required phone call to verify the banking change with the vendor was never made, and the county has since added a multi-step approval process requiring banking-change requests to pass through three separate people, along with phishing training.
A similar scheme hit a Weld County, Colorado business starting in June 2026, when scammers posing as an existing vendor convinced the company to update its payment information; the business made roughly $200,936.23 in payments over four months before discovering the money never reached its intended recipient, North Forty News reported. The Weld County Sheriff's Office advised businesses to independently verify any unexpected vendor-payment changes by calling a previously verified phone number rather than relying on email alone.
The FBI has described this type of fraud broadly as business email compromise, in which a criminal actor uses email to impersonate a business executive or other employee to request fraudulent payments. Losses reported to the FBI's Internet Crime Complaint Center surpassed $20 billion in 2025, with business email compromises ranking among the leading categories behind investment-related fraud, according to the bureau's annual report.
Pulaski County's case was also reported by KATV.
