Town officials are considering cybersecurity upgrades after taxpayers lost $2.3 million in an email scam earlier this year.
One possibility is multi-factor authentication so it would take more than just a username and password to sign in to an email account. An overall security upgrade costing $80,000, as recommended by Information Technology Director Fash Farashahi, was discussed during a recent Select Board retreat.
The email account of a town employee was compromised in the fraud, under which electronic payments to the town’s two largest vendors were improperly routed to the perpetrators of the scam. The town changed the routing based on a false email request. Even with better technical security in place, town employees remain the first and last line of defense, Town Administrator Nicole MacStay said. These workers need to verify any request to change payment arrangements, she said.
“There was town-wide, mandatory training last month,” MacStay said. “It wasn’t meant to present new information, but to drill home, ‘These are the things you need to look out for.’ It was a clear reminder about who is being targeted, what to do, how to respond, how to report messages, what to do in case you make a mistake, what steps to take.”
MacStay said it’s not possible for an email system to reject any potential fraudulent message. To do so would be to miss out on real, important communications.
On Oct. 29, the town received an email purporting to be a Microsoft password expiration notice from the “Help Center.” The email actually came from a hijacked email account from a university. Farashahi used the email as a learning opportunity for town employees in his own email, titled “Tech Tuesday — Don’t get Phished.”
Phishing is the fraudulent practice of sending emails purporting to be from reputable companies in order to get people to reveal personal information such as passwords and credit card numbers.
“As of now, Microsoft does not send you any notifications of Password Expiration or Password Resets,” Farashahi wrote in his email to town employees. “Do not click on anything in these types of emails. Use Outlook Report Message button and Report as Phishing. Do not fall for these attempts!”
The $2.3 million lost in the scam consisted of $1.2 million intended for the ConVal School District and the rest was for Beck & Bellucci, the Main Street bridge contractor. The Secret Service recovered nearly $600,000 of the money intended for Beck & Bellucci and the town repaid the balance of the money it owed to the contractor. A $3 million unrestricted fund balance, which accrues after obligations are met, was available to the town.
The town also reached an agreement with the school district to pay an additional $125,000 per month through December with the understanding it would pay the balance owed to the district as soon as it is able.
MacStay said the town will be refinancing bond debt to realize lower interest rates, and this should improve the town’s financial picture. Under the refinance, the due date for a nearly $350,000 payment will be moved from this fiscal year to next. Over the life of the bonds, there will be $550,000 in savings on interest alone.
Meanwhile, the town is hoping to recoup some of the fraud losses through insurance coverage, but there has been no word yet from Primex, the insurer, on any potential insurance settlement.
MacStay said although the fraud was first reported in August, the complicated nature of the insurance claim is making it harder to process.
“This isn’t a straightforward, simple claim,” she said. “I wouldn’t say frustration is settling in among folks. If you’re used to a rapid response, it seems like it would go faster, and it would if it were a fender-bender or damage at a park. Falsified instructions led to the theft and that adds to the complexity. We hope for some coverage decision before the end of the fiscal year. We haven’t given up hope. It’s taking more time than expected, but the communication has been good and ongoing.”
Finance Director Leo Smith took his long-planned retirement after the fraud was revealed. Lilli Gilligan was hired as the town’s new finance director.
Shannon Kelley resigned as town accountant in the wake of the fraud. MacStay said the town has hired accountant Tania Rose to replace her.
MacStay said the investigation into the crime did not show any criminal activity on the part of town employees.