Hi,
An email arrives from the contractor doing your paving work. Same signature block, same project name, correct invoice number. They have changed banks, and could you please update the remittance details before the next payment.
Everything about it is right, because almost everything in it was taken from public record.
This is where public entities are unusually exposed, and it has nothing to do with how careful your staff are. Your budget is published. Your approved contracts are published. Your council or board minutes name the vendor, the project and the dollar amount. Your staff directory lists who does what and their email addresses. An attacker does not need to breach anything to know that you owe a specific company a specific amount at a specific time, and who signs it off. They read your website.
The approach lands in a handful of predictable shapes:
- A vendor changes banking details by email, shortly after a large contract is approved in an open meeting
- An employee changes their direct deposit, usually a few days before payroll runs
- A request from the superintendent, mayor or executive director to process something urgently and quietly, sent while that person is visibly away at a conference
- A reply inside a real email thread, because a mailbox somewhere in the chain is already compromised and the attacker is answering your genuine questions
- A request for W-2 or employee data from someone in authority, in January
What makes this different from the internal control problems most finance offices worry about: the money leaves legitimately. Someone with authority approved a payment they intended to make, to a vendor they really owe. Nothing in your reconciliation looks wrong until the real contractor calls asking where their money is, usually weeks later.
Two consequences catch entities off guard:
- Recovery is measured in hours, not days. Once funds are withdrawn from the receiving account, they are usually gone. A recall has a realistic chance only if the bank and law enforcement are engaged almost immediately.
- Your insurance may not cover it. Crime and cyber policies frequently draw a line between theft and voluntary parting with funds, and payment made on a fraudulent instruction can fall on the wrong side of it. Coverage for social engineering fraud is often a separate endorsement that has to be bought deliberately. This is worth reading before you need it, not after.
The controls that actually stop this are procedural and cost nothing:
- Never accept a banking change by email. Call the vendor back on the number you already have on file, not any number in the request.
- Treat a bank detail change as a change to the vendor master file, requiring a form, a second approver, and a record of who verified it and how.
- Apply the same rule to payroll direct deposit changes, which are the version most entities have no process for at all.
- Confirm urgency out of band. A request that is urgent, confidential and from a senior official is the exact combination worth one phone call.
- Multi-factor authentication on every mailbox. Most of these start with one compromised account, often an account nobody uses much.
- Decide now who calls the bank, who calls law enforcement and who tells the board, so the first hour is not spent deciding.
This is the kind of work that sits alongside the audit rather than inside it:
- Internal control design for accounts payable, vendor master file and payroll changes
- Review of your payment authorization workflow and who can approve what
- Audit, Single Audit and Yellow Book engagements, ACFR and AFR preparation
- Fund accounting bookkeeping, grant compliance and board or council ready reporting
Reply to this email by Friday and we will set up a free 15-minute call with one of our senior government specialists. Tell us how a vendor changes their banking details with you today, start to finish, and we will tell you on the call exactly where the gap is.
Sincerely,
—
George Dimov, CPA
Licensed and Insured
(833) 829-1120 toll free
(212) 994-8081 Fax
www.dimovtax.comHi,
An email arrives from the contractor doing your paving work. Same signature block, same project name, correct invoice number. They have changed banks, and could you please update the remittance details before the next payment.
Everything about it is right, because almost everything in it was taken from public record.
This is where public entities are unusually exposed, and it has nothing to do with how careful your staff are. Your budget is published. Your approved contracts are published. Your council or board minutes name the vendor, the project and the dollar amount. Your staff directory lists who does what and their email addresses. An attacker does not need to breach anything to know that you owe a specific company a specific amount at a specific time, and who signs it off. They read your website.
The approach lands in a handful of predictable shapes:
- A vendor changes banking details by email, shortly after a large contract is approved in an open meeting
- An employee changes their direct deposit, usually a few days before payroll runs
- A request from the superintendent, mayor or executive director to process something urgently and quietly, sent while that person is visibly away at a conference
- A reply inside a real email thread, because a mailbox somewhere in the chain is already compromised and the attacker is answering your genuine questions
- A request for W-2 or employee data from someone in authority, in January
What makes this different from the internal control problems most finance offices worry about: the money leaves legitimately. Someone with authority approved a payment they intended to make, to a vendor they really owe. Nothing in your reconciliation looks wrong until the real contractor calls asking where their money is, usually weeks later.
Two consequences catch entities off guard:
- Recovery is measured in hours, not days. Once funds are withdrawn from the receiving account, they are usually gone. A recall has a realistic chance only if the bank and law enforcement are engaged almost immediately.
- Your insurance may not cover it. Crime and cyber policies frequently draw a line between theft and voluntary parting with funds, and payment made on a fraudulent instruction can fall on the wrong side of it. Coverage for social engineering fraud is often a separate endorsement that has to be bought deliberately. This is worth reading before you need it, not after.
The controls that actually stop this are procedural and cost nothing:
- Never accept a banking change by email. Call the vendor back on the number you already have on file, not any number in the request.
- Treat a bank detail change as a change to the vendor master file, requiring a form, a second approver, and a record of who verified it and how.
- Apply the same rule to payroll direct deposit changes, which are the version most entities have no process for at all.
- Confirm urgency out of band. A request that is urgent, confidential and from a senior official is the exact combination worth one phone call.
- Multi-factor authentication on every mailbox. Most of these start with one compromised account, often an account nobody uses much.
- Decide now who calls the bank, who calls law enforcement and who tells the board, so the first hour is not spent deciding.
This is the kind of work that sits alongside the audit rather than inside it:
- Internal control design for accounts payable, vendor master file and payroll changes
- Review of your payment authorization workflow and who can approve what
- Audit, Single Audit and Yellow Book engagements, ACFR and AFR preparation
- Fund accounting bookkeeping, grant compliance and board or council ready reporting
Reply to this email by Friday and we will set up a free 15-minute call with one of our senior government specialists. Tell us how a vendor changes their banking details with you today, start to finish, and we will tell you on the call exactly where the gap is.
Sincerely,
—
George Dimov, CPA
Licensed and Insured
(833) 829-1120 toll free
(212) 994-8081 Fax
www.dimovtax.com