'Stupid Mistakes' Lead to Vermont Town Losing Nearly $250,000 in Email Scam

Norwich, Vermont fell victim to an email scam over the summer, losing nearly $250,000 as a result, according to Valley News. Town Finance Director Donna Flies said she made "stupid mistakes."

According to an investigative report, Flies made four Automated Clearing House (ACH) payments totaling just under $250,000 without first gaining the approval of the board. Flies believed the communications were from Town Manager Herb Durfee, even though they came from an email address not used by town government employees. Durfee was on vacation when Flies received the first email, but Flies told investigators she believed Durfee was using his personal email address.

The emails asked for money to be transferred to a Donald S. Jefford Jr., in order to pay off outstanding invoices. The payments drew the attention of Town Treasurer Cheryl Lindberg who told a co-worker that she was worried that the transactions were a form of embezzlement. Town employees would later attempt to find Jefford via Google search, but his name did not turn up.

Mascoma Bank emailed Lindberg August 28 saying there were placing a hold on two of the ACH transactions until they could confirm their legitimacy. At a meeting of the Selectboard that evening, the ACH payments were discussed. It was the first time most board members, including Herb Durfee, had heard of the issue.

When Flies was told in a morning meeting that the payment requests were a scam, she was "shocked, surprised and devastated." Criminal investigations were begun that day. Flies was placed on administrative leave.

phishing, email scam
Phishing scams took over $30 million from people in 2017. Getty

The report noted that Flies had violated the town's purchasing policy, general financial policies and procedures, the financial policy of the Selectboard and the accounts payable procedure.

However, Flies believed she was following the instructions of her boss. All involved with the case seem to have acted appropriately with the measure of information they had.

"In hindsight," the report says, "had any one of several different people been more inquisitive at the time the learned about the first ACH payment to Jefford, or mentioned the issue of the ACH payment to the town manager between August 14 and August 23, the second two ACH payments would have never occurred."

Earlier this month, Comerica Bank returned $79,765 of the funds to the town of Norwich.

Email scams are big business for bad guys. The Federal Bureau of Investigation's Internet Crime Complaint Center reported the people were bilked out of approximately $30 million in 2017.

Bogus emails may like they are from someone you know or a company you are familiar with. They will ask you to provide personal information, such as credit card or Social Security numbers. The emails also use pressuring language, indicating that action be taken urgently or providing a deadline for a time-sensitive response.