More than $237,000 has been recovered after Boulder County accidentally sent a check to a fraudulent account, said Jason Oehlkers, a commander with the Boulder County Sheriff's Office.
In the fraud case, which was first reported by the county in September 2022, hackers took information from a vendor the county works with, he said.
“They had created a fraudulent email address that was similar to a legitimate email address,” Oehlkers explained.
After the county mistakenly sent the check, the Boulder County Sheriff’s Office and the county’s digital forensics lab launched an investigation and began tracking the funds.
“They started with some search warrants and some requests for banks to freeze the accounts,” Oehlkers said. “Typically with something like this, we work with the Secret Service very closely, just because they probably have better contacts with the bank on a much larger scale.”
Investigators were able to trace the funds to a bank account in the United States, he said. The $237,241.18 check amount was still showing as an available balance, and investigators were able to freeze the funds until they were returned in December.
Many scam artists target employees in government offices, businesses and organizations, and workers have to be vigilant, Oehlkers said.
“Look at the email address, and make sure it’s legit,” he explained. “Double-check your resources, talk to people — don’t give up that personal information that these people want.”
The fraud case prompted several improvements in Boulder County operations, the sheriff’s office said in a news release.
“County accounting teams have received additional training to identify vendor impersonation fraud and how to request help with verification of suspicious requests,” the release read. “An independent verification step has been added to our vendor payment instruction change process.”
The county has also configured its email security tools to warn employees about email domains that are newly registered, according to the release. Workers also receive notifications about domains that look nearly identical to those of partner organizations — with only a one or two character difference.
“It’s so frustrating that this happened, and we will learn from the experience and continuously work to review and enhance our controls,” Boulder County Administrator Jana Petersen said in a statement released after the check fraud was first announced.
