Livingston school board duped in $2 million email scam

The Livingston Parish Public School System was duped into transfers totaling more than $2 million to a cyber scammer last year. The school board was able to recover most of the money except for about $344,000 it lost to a still unidentified hacker.

The Louisiana Legislative Auditor disclosed a report Monday that contained some details of the incident that occurred in January 2022. School board employees were twice tricked into changing electronic funds transfer (EFT) details of legitimate vendors and then sending payments to a scammer posing as the vendors. 

The scam worked because no one from the school board office contacted the vendors to verify the changes before transferring a total of $2,251,861 to new bank account numbers included in the bogus emails. 

“The requested EFT payment details changes were made without following the procedure in place to call the vendors to verify the changes,” the audit report stated.

The school board made several EFT payments to the fraudulent accounts over a three-week period between Jan. 12 and Feb. 8, 2022. Employees did not become aware of the crime until one of the legitimate vendors contacted them to follow up on a payment. 

That vendor’s act of reaching out saved the school board from losing a lot more money, according to the audit report. After one of the fund transfers had just been issued, the board was able to cancel a payment of roughly $1.9 million.

In all, the scammer got away with $343,967, and more than a year of investigating hasn’t led law enforcement to identify the culprit behind the fake emails. The school board filed an insurance claim for the stolen money, the audit said. 

In response to the audit, Livingston Parish Schools Superintendent Alan Murphy said his office plans to implement stronger internal controls to ensure vendor changes are verified according to adopted policies and procedures.