Sawyer said the money, which totaled around $667,000, was meant for the Lower Cape Fear Water and Sewer Authority (LCFWSA). The fraudulent payments date back to September 29, when the scammer — posing as a vendor — requested a change to their bank transfer details.
"Now, I'm not harming the investigation to say [the request] appeared very valid," Sawyer said during the meeting.
According to Sawyer, the county received the request while it was in the process of fulfilling a legitimate invoice totaling roughly $581,000 to LCFWSA. On October 1, the county changed the bank details and sent the money to the scammer. The county would make three more payments on Oct. 7, Nov. 13, and Dec. 4.
The water and sewer authority inquired about the missing funds on Nov. 17.
"I'm going to own it here as staff, that message… was either not seen or it wasn't responded to. We don't know if it was seen or it wasn't. There was no read receipt sent back, so we don't know that that message was ever seen," Sawyer said during the meeting.
The county would go on to discover the scam on Dec.12. Since then, the FBI and SBI have launched criminal investigations into the matter, according to the county.
During the commission meeting, Sawyer held forth about the county's internal reckoning with the fraud scheme. Pender County has since requested assistance from State Auditor Dave Boliek, whose office has agreed to complete a review of the county's IT and cybersecurity systems, as well as a full financial audit.
Finance Director Meg Blue told commissioners that Pender County has long been a target of phishing attempts.
"We receive these requests very frequently, actually a lot more frequently than anyone realizes. Probably I'd say anywhere between two to five [times] a week," she said. "And we successfully prevent them every other time, I assure you."
Blue said that prior to discovering the scam, the department's process for payment changes involved either confirming the vendor's identity over the phone or by confirming invoice details — including invoice number, amount, and dates — with the vendor over email.
"In this particular instance, we trusted the communication because of the perceived legitimacy, and that phone call was not made," she said.
Since the county discovered the scam, Blue says the finance department has conducted "enhanced phishing training" for all employees involved in county payments and invoices. She also confirmed that moving forward, the county will require multiple points of contact with vendors prior to any financial changes.
The county has not released the names of any employees involved in the transaction. Blue said that the stolen money was not taxpayer money, but enterprise funds, meaning money from utility ratepayers.
Pender County spokesperson Brandi Cobb told WHQR in an email that while it was still "too early to know" how much of the money could be recovered, county officials are "fully committed to making that happen."
Read more:
- WHQR: Pender County loses hundreds of thousands of dollars in fraud scheme
