College Prevents Case of Fraud

By Brooke Schultz

A phishing attempt early last month could have cost Washington College $170,000.

“The issue of fraud is something we take many measures to protect against,” said Rahel Rosner, vice president for finance and administration. “In this case, we learned of the fraud after it had been perpetrated because of the relationship we have [with the vendor] and how quickly we were able to detect it, we were able to recoup the funds. There was no loss to the institution.”

The case is being investigated by police and a Maryland department that specializes in bank fraud.

The payment was to be made to a vendor that the College has worked with before and knows well, Rosner said.

The College received an email from someone impersonating the contact in the company, who supplied the account information, the invoice number, the dollar amount for the contractual services, and a description of the services rendered.

“They had all of the details and the expectation of payment. With that, they say, ‘Hey, our banking information has changed, can you please send it to this new bank?’” Rosner said.

Since changing bank information isn’t unheard of, they went forward with the transfer.

They posted the payment on Friday, Sept. 8. On Monday, Sept. 11, they got a call from the vendor stating that they had not received payment.

There was a period of 36 hours where there was concern that the money had been lost. Due to the payment being posted on Friday, the money was held at the bank through the week and was still in the process of being transferred when the College was first alerted to a problem.

“That’s everyone’s nightmare,” said President Kurt Landgraf, “that somebody would take money from the school.”

“It’s disconcerting they [the scammer] had details that only that company knew about,” Rosner said. “All of our systems are predicated on phishing, not knowing the details.”

She said she gets frequent emails from hackers posing as President Kurt Landgraf or Chair of the Board of Visitors and Governors Larry Culp, and this particular instance was much more sophisticated, showing an evolving phishing system.

“We sat down as a business office team and developed additional guidelines,” she said.

When the College enters into an agreement with a vendor, each party is sent a set of contracts. The vendor and the College go through each other’s copy and mark changes. Once the changes are agreed upon, each party signs off on the contract. Now, Rosner said that once the banking information is agreed upon in the contract, it won’t be changed unless the contract is revisited.

“We have had another opportunity to once again look at our systems to put in additional safeguards, that’s basically what’s happening in the world of fraud prevention. You think about what can you anticipate and what can you procedurize,” she said. “This was the latest procedural update. That’s what the finance and business office does. We acknowledge that this world is evolving and changing. We also acknowledge that we cannot anticipate all of the holes. Each time something happens, we reflect, could this take place at WC? No it can’t, because that’s not how our system works or yes it can, this is what we’re going to change.”

Landgraf said that the control measures also make sure that there are always at least two people looking at those kinds of transactions, ensuring that an abnormality is avoided. For instance, several people would check to make sure the vendor’s bank had actually changed, he said.

“Unfortunately in the world we live in now, that is not uncommon,” he said.

While this is a case that could have affected the institution, she said it is a good opportunity to remind students to be aware of their payments.

“My plea of students is they begin to take responsibility for their credit, for their identity. Look at your payroll. Know what you should be paid, know what you are being paid. As you go out into the workplace, look at your payroll slips; fraud happens there,” said Rosner. 

Leave a Reply

Your email address will not be published. Required fields are marked *