A "treasure hunt" touted by state officials ended up drawing in online thieves, according to a report by legislative auditors.
The report, released Friday to lawmakers, found that state Auditor Andrea Lea's office paid more than $40,000 to at least one person who used stolen identities to make fraudulent claims through an online search tool for unclaimed properties. The program was formerly known as the Great Arkansas Treasure Hunt.
The auditor's office discovered the phony claims on June 26, after a total of 24 fraudulent payments. An additional 17 claims were later identified by the auditor's office as fraudulent, and the office was able to avoid spending $20,301 on those scams, according to the report. The report was completed by Legislative Audit, an agency that works separately from the office of the state auditor, who is one of seven constitutional officers and mainly serves as a payroll officer.
According to the report, Lea's office referred the matter to the Arkansas State Police for a criminal investigation earlier this year.
However, legislative auditors found that Lea's staff had not notified their office of the theft until more than two weeks after it was discovered. State law, the report noted, requires notification of theft to legislative auditors within five business days.
"We're getting people made whole and right," said Lea, who faced lawmakers Friday and answered their questions about the report.
Legislative auditors also found "numerous" errors in records for unclaimed stock securities in the auditor's office's possession, resulting in "claimants being either overpaid or underpaid when collecting their property."
Addressing lawmakers, Lea admitted the office's accounting practices had "inadequate oversight" and errors, but she contended that the problems had already been addressed. In a written statement, she said legislative auditors had "mischaracterized or inaccurately depicted" the problem.
The state auditor's office comes into possession of abandoned funds, stocks, securities, bonds and other properties -- even safe deposit boxes -- after their holders, often banks, give them up, said Lea. Cash and safe deposit boxes are turned over after three years; stocks and securities, seven years.
It's the duty of the auditor's office to attempt to find the owners of unclaimed properties. If an owner cannot be located after a certain time period -- one year for safe deposit boxes and three years for everything else -- the auditor can liquidate the property and distribute the proceeds if the owner comes forward later.
Lea said Friday that the perpetrators of the fraud scheme had not hacked into her office's data, but rather that they had used stolen identities to pose as people who had unclaimed property held by the auditor's office, and then claimed the property for themselves. Lea said the property paid out by her office was cash.
"Our system worked exactly as it was supposed to," Lea said. "When we investigated [the claims] we became suspect."
The auditor's office maintains a webpage -- auditor.ar.gov -- where people can find out if the state holds unclaimed property in their name. The website also allows users to begin the process of claiming that property.
Skot Covert, a spokesman for the auditor's office, said that whoever submitted the fraudulent claims had access to the type of documents, such as a passport or driver's license, that the office required as proof of identity for people filling out online claims.
"This person was an expert criminal," Covert said.
To bolster its verification process, Covert said, the office now requires claimants to answer specific questions about their identity that are drawn from "big data." Covert declined to give an example of such a question -- saying he did not want to tip off possible fraudsters -- but said that the questions are about "things only you should know."
Lea said in her written response to Legislative Audit that law-enforcement officials investigating the case are working in conjunction with the U.K. Metropolitan Police Service -- known colloquially as Scotland Yard -- and that investigators had identified a "prime suspect."
"I was concerned they would not find this person, so I'm thrilled that they've identified someone," Lea later told a reporter, adding that the investigation had expanded to include similar claims made through unclaimed-property programs in six other states.
A spokesman for the state police, Bill Sadler, confirmed Friday that the agency is working with "international law enforcement" to investigate a claim for more than $36,000 made with a stolen identity.
Asked if police had identified a suspect, as stated in Lea's response, Sadler said "there may well be multiple suspects," and declined to elaborate, citing the ongoing investigation.
Metro on 12/15/2018