Iowa Auditor Warns Local Governments After Email Scam Threatens $655,000 in Taxpayer Funds

Good local journalism takes time. Your support helps make it possible. DES MOINES, Iowa — Iowa State Auditor Rob Sand is urging local governments to strengthen safeguards against email scams after a city reported a fraudulent payment request tied to a public works project that could cost taxpayers $655,000. The city clerk who reported the incident told the Office of the Auditor of State that a fraudulent email requested electronic payment for an invoice that appeared legitimate and matched the amount the city expected to pay its authorized contractor. The city discovered the scam when the contractor requested payment, according to an advisory issued by Sand's office. The advisory did not identify the city or specify when the incident occurred. A separate payment of $211,000 to the same fraudulent account was recovered by the city's financial institution, the advisory said. The city also submitted an insurance claim in hopes of recovering additional funds, notified law enforcement and began implementing additional procedures to prevent future fraud. The incident marks the second time in less than a month that Sand's office has received notice of an email scam targeting local governments, the auditor said. "We bring this to the public's attention, not to point fingers, but to alert everyone that fraudsters are using increasingly sophisticated ways to pick taxpayers' pockets," Sand said in the advisory. The warning urges government officials to independently verify electronic instructions involving changes to bank routing information and establish procedures to make fraudulent payment requests more difficult to carry out. Sand recommends that government employees call vendors or other recipients directly to confirm any electronic instructions to change banking information. They should not reply to the email containing the request. Instead, they should use contact information already on file to reach the intended recipient. The advisory also recommends that government entities consider sending electronic payment notifications to vendors at email addresses already established in their records. Those notifications should ask vendors to confirm receipt of the funds promptly and immediately contact the government entity if the payment was not deposited into the correct account. Sand said his concern about email fraud extends beyond the latest incident. In 2022, he was the target of a similar scam when Iowa's Human Resources Department received an email directing that his salary be deposited into a different bank account. A human resources associate called Sand directly before making the change, preventing the fraudulent instruction from being carried out. The auditor's office is urging government entities to rely on independent verification rather than electronic messages alone when handling sensitive financial instructions. The advisory also recommends that recipients carefully examine email addresses and website URLs, watch for grammatical errors or unusual wording, avoid clicking links in unsolicited emails or text messages and refrain from downloading attachments from unknown senders. Government officials who discover fraudulent emails or other schemes intended to steal taxpayer funds must notify the Office of the Auditor of State of suspected embezzlement, theft or other significant financial irregularities, according to the advisory. The reporting requirement is established under section 11.6(7) of the Iowa Code. The auditor's office also directs government representatives to report such incidents to the FBI and local law enforcement. Keep up with your community. Get Decorah News in your inbox.