Boulder County sends $238,000 check to fraudulent account

Matthew Bennett, Daily Camera, Boulder, Colo.
·2 min read

Sep. 30—Thinking it was going to one of its vendors, Boulder County mistakenly sent a $238,000 check to a fraudulent account, according to a news release issued Friday.

Hackers, who were acting as the vendor, sent a spear phishing email to the county, which resulted in the check being "sent incorrectly," the release stated.

"Although the county has safeguards in place to prevent these types of frauds from occurring, and we successfully thwart attacks by fraudsters several times a year, we did not catch this one in time to prevent the check from being cashed," Boulder County Administrator Jana Petersen said in the news release. "Fraudsters continue to get more and more creative in their approaches, and we continue to enhance our safeguards to make sure to minimize the risk to taxpayer dollars."

The county has insurance for criminal activity that it expects will cover most of the lost $238,000.

The Boulder County Sheriff's Office will investigate the crime with help from federal law enforcement officials, the news release said.

"We take great pride in our work and in the controls we have in place to detect and prevent fraud," Petersen said. "It's so frustrating that this happened, and we will learn from the experience and continuously work to review and enhance our controls."

Citing the ongoing investigation, Boulder County Public Information Officer Gloria Handyside declined to comment on the vendor's identity.

"To make a payment, one staff member enters the transaction, and it is reviewed and approved by another staff member in the department and again by centralized accounting staff," Handyside said in a follow-up email. "Staff are trained on financial controls and how to spot fraud before given access to the financial system. Additionally, all county staff with system access must complete cybersecurity training annually."

Handyside said the county sees five or six "significant" fraud attempts per year.

No information was immediately available concerning when the county may receive its insurance payout.