County hoodwinkined out of $2.7M
The nearly $3 million stolen from Madison County in a cyber scam came from state bond monies designated for the Reunion Parkway project.
The money was repaid to the bond account on Monday from the county’s general fund.
The Board of Supervisors announced the scam Monday morning after an executive session lasting nearly 90 minutes.
“The Madison County Board of Supervisors was informed of a fraudulent financial cyber event Tuesday, March 19, 2024,” Board President Gerald Steen said reading from a prepared statement.
“The event resulted in $2,741,243.69 in funds being sent to a fraudulent vendor who represented themself as a current vendor.”
Steen said the first thing the county did was contact law enforcement officials and the case is currently being investigated by local, state, and federal authorities.
“We’re confident that we can recover some, if not all the funds,” Sheriff Randy Tucker said. “We have confidence that moving forward we won’t have to face this again. It does stretch across the country and possibly internationally.”
According to the Sheriff’s Department incident report which was made public, Comptroller Na’Son White sent electronic ACH payments to someone claiming to be Jay Hemphill, the CEO of Hemphill Construction Co., the contractor currently working on the Reunion Parkway project.
White sent three payments beginning on Feb. 20, 2024, for $128,989.97. A second payment of $1,073,870.66 was made on March 5, and a final payment of $1,538,383.06 was made on March 12.
According to the incident report, the county purchasing clerk received an initial email which was later forwarded to County Administrator Greg Higginbotham before being forwarded to White.
The email requested a change in the bank account for payment.
The payments were initially cent to a Citizens Bank N.A. account.
On March 11, one of the payments was returned, and White called the fraudster and was given a Bank of America bank account.
“All invoices that the county received from Hemphill Construction Company were true, legitimate invoices sent from the actual company building the parkway phases,” the incident report says. “The only difference she could find in the emails that the invoices came from was a ‘.com’ email address was used, whereas a ‘.us’ was used for the ACH payment form.”
According to the incident report, the case had not been turned over to the U.S. Secret Service, but they were assisting at the time.
Madison County’s cybersecurity policy has a $100,000 coverage maximum, with a $25,000 deductible, meaning the most the county may be able to recover if law enforcement is unsuccessful is $75,000.