Two Arkansas colleges lost thousands of dollars last year after fraudsters targeted their direct-deposit payroll systems, according to audits released on Thursday.
An email impersonating East Arkansas Community College's president in October 2018 fooled a payroll staffer into changing where her paycheck was deposited, Arkansas Legislative Audit found. The error -- which ultimately cost the school $17,766 -- was repeated a second time after the employee forgot to fix the mistake once it was discovered.
At Southern Arkansas University, hackers cracked the school's email system to send direct deposit change requests from the email accounts of three school employees, resulting in $16,084 in erroneous payments, state auditors reported.
Richard Stipe, East Arkansas Community College's vice president for finance and administration, told a legislative subcommittee on Thursday that unusual circumstances caused the college's president, Cathie Cline, to miss two paychecks.
"A long-tenured employee had the best of intentions to respond to the new boss in the way that she did," he said.
The two reports were among about a dozen school audits presented to the Legislative Joint Auditing Committee's Subcommittee on Educational Institutions on Thursday.
Both incidents have also been reported to federal investigators, school officials said. Auditors noted that the fraudulent email was reported to the FBI.
East Arkansas Community College's payroll staff received an email in 2018 impersonating Cline and requesting an account change for her paycheck deposits.
The fake email fooled the employee into changing Cline's account, resulting in an $8,581 paycheck being deposited into the wrong account.
Stipe said Cline noticed that she had not been paid, and the issue was discovered several days after that pay period ended. But the employee that handled payroll deposits forgot to fix the error before the next paycheck -- worth $9,185 -- was sent. That employee has since retired, Stipe said, in response to questions from lawmakers.
Cline last year earned a salary of $153,000.
By the time school officials caught the error, the accounts had already been drained. The school also contacted its insurance company about the issue, but adjusters said the losses were not insured.
In Magnolia, unauthorized individuals gained access to Southern Arkansas University's email system through compromised account passwords.
The individuals made changes to employees' direct deposits from legitimate university email accounts, and the $16,084 has not been recovered, auditors said.
The University has since implemented required password changes periodically.
Shawana Reed, Southern Arkansas University's vice president for finance, told lawmakers on Thursday that the school's IT team determined that the fraudulent emails were sent "from several states away." She said the incident had been reported to the FBI, but that no arrests have been made.
Metro on 10/11/2019