Cyber Scam Report: Finance Director Made Payments Knowing They Violated Policy

Source: CSO Australia

The Burgess Investigation Report, relating to the the business email compromise (BEC) scam that saw $250,000 stolen from the Town, says that Finance Director Donna Flies knew she was violating Town policy but believed she was acting on orders from her boss, Town Manager Herb Durfee.
The report prepared by Burgess Loss Prevention Associate in Lebanon, NH was made public today, after the Selectboard unanimously voted at its regular meeting last night to release the complete report.

In August, Finance Director Donna Flies made four electronic payments to the account of Donald Jefford, Jr. at two different banks. "She made the transfers in response to a request from 4 emails sent from a non-town email account that had the town manager's name as the alleged sender of the emails," stated the report. The email address used was ca@city1mail.com.

The report does not explicitly state whether Donald Jefford, Jr. is an existing vendor of the Town, although it indicates that neither Selectboard Vice Chair Claudette Brochu nor Treasurer Cheryl Lindberg recognized the name as they become suspicious.

Ms Flies, two months into the job, knew Selectboard approval was required before making the payments. However, "Flies believed that the emails were actually from her boss" and believed that she "was just following her boss's orders."  On August 15,  Treasurer Lindberg recalled Ms. Flies saying: "Well, when my boss tells me to do something, I have to do it ....," quotes the Burgess report.
Town Manager Durfee was away on vacation for the first transfer. "However when Flies made the last three payments to Jefford, she never discussed, nor mentioned anything to Durfee about the payments, the lack of invoices, the lack of purchase orders, or lack of Board approval." The report notes that the Town Manager and Finance Director both work in Tracy Hall and interact daily.

To quote baseball Hall of Fame pitcher and Red Sox broadcaster Dennis Eckersley: "Yuck."

Dates and amounts of transfers. Source: Burgess Report.

The report does not address whether the Town had adequate safeguards in place.  During the tenure of Ms. Flies over 20 electronic transfers were made without Selectboard approval, most for legitimate bills. The Town did not require two "signatures" on such transfers as a control. Mascoma Bank apparently offers such a product and periodically reminds existing customers of the service.
==================