Galveston County commissioners voted Monday to file claims against three county departments over the loss of more than $500,000 to a computer scammer earlier this year.
The county also released a report by a private forensic group that determined, to the disappointment of County Judge Mark Henry, that the blame for the loss of didn’t rest on a “single department or a single individual associated with Galveston County.”
Henry had hoped the company would be more specific about which people within the county were to blame for the loss of funds, he said.
“They sold us a bill of goods and didn’t deliver on it,” Henry said. “I think they intentionally avoided assigning blame. That is not what they told us they’d do.”
A scammer posing as a county contractor in May tricked an employee in the county’s purchasing department into changing how and where a $525,282 payment for road work would be made. The scammer has not been caught and the money has not been recovered.
On Monday, after meeting in private with the county’s legal department, commissioners unanimously voted to pursue claims against the surety bonds held by the county auditor, county treasurer and county purchasing agent over the lost funds.
It’s not clear whether the claim will be successful, but Precinct 1 Commissioner Darrell Apffel said the county had a “duty and obligation” to try to recover the money in whatever ways are possible.
“Don’t take this personal or as a fault,” Apffel said to County Auditor Randall Rice during the meeting. “We’ve got to do what we’ve got do to get this money.”
Public officials in Texas are required to procure bonds before taking office. The premium of the bonds are paid for by the county. If the claims are accepted by the bonding company, it’s possible that future premiums will increase, Henry said.
The vote authorized the legal department to research the issues around making the bond claims, Henry said.
“None of us are 100 percent familiar with the mechanics of it,” Henry said.
Less than an hour after voting to move forward on the claims, the county released the report from the Dawson Forensic Group it commissioned in July.
The report confirmed the description of the scam county officials related just after the event.
The scammer used a form obtained through the county’s website to request a change on the bank account information for the road contractor — requesting that instead of paying with a paper check, the county send funds to an account through an electronic transfer.
The scammer created fake email addresses to pose as both a county employee and the contractor, essentially becoming a middleman for communications between the two sides.
The scammer used email addresses that were “close to, but not identical to” the real email addresses used by the county and the contractor, according to the report.
When the scammer submitted the form to the county purchasing department, no one checked that the new bank account was valid, according to the report.
“Believing that the treasurer’s office employee had validated the vendor information provided in the request,” the purchasing department changed the payment information in its system, the report stated.
Previously, county officials said the attack happened over the course of months, and that the scammers presented forged signatures to help them convince the county that the change in accounts was authentic.
County employees failed to recognize the attack as it was happening, the report stated. The county also lacked validation processes and county departments didn’t have a clear understanding about who was responsible for validating the accounts, according to the report.
The report does not place blame on a single office for the mishap.
“A department or individual cannot be held accountable for noncompliance with processes that may not have been properly designed or that did not exist,” the report stated.
The report also lauded the changes that the auditor, purchasing department and treasurer had made since the scam was revealed. That work was done so thoroughly that the forensic group said its costs were lower than the $14,900 it had originally quoted the county.
The company has not yet submitted a final invoice for its investigation, a county spokesman said.