The Boulder Valley School District, Colo., has added safeguards after a scammer stole about $850,000 of bond construction money using knowledge of public contracts and a forged signature.
The theft, which happened about a year ago, came to the district's attention when contractor Adolfson and Peterson Construction asked for a payment on a past due account, even though the district had been sending payments.
The work was part of the district's $576 million bond issue, approved by voters in 2014.
The scam started when the district's accounts payable department received a call from someone claiming to be with Adolfson and Peterson asking to change the way the company was paid, according to the police report.
The district instructed the person to fill out a form, which was returned with the signature of the company's chief financial officer. That was later found to be a forgery. The form specified the bank account for the district to send payments as direct deposits.
The email address where the form was sent appeared to be a legitimate one from Adolfson and Peterson, according to the police report.
"It was a fairly sophisticated attack," said Bill Sutter, Boulder Valley's chief financial officer.
Four payments were made to the fraudulent bank account before the theft was discovered, according to the police report.
Boulder County Detective Jason Shatek said they tracked the wire transfers to a bank account in New Jersey and were able to recover almost $500,000.
He said an arrest warrant was issued for the 36-year-old suspect, Sherifdeen Mogaji, of New York, who appears to have fled to Nigeria. The suspect didn't have any connections to either the school district or Adolfson and Peterson, he said.
District officials said they took steps to better protect against similar scams -- and those changes foiled a second, similar scamming attempt.
Those measures include not relying on the phone number on the form for a new routing number, but instead using the contact number the company originally provided to verify the change.
The district also moved away from direct deposits to pay for bond work and other short-term vendors, instead using paper checks.
"We put controls in place and slowed the process down," Sutter said. "We had a nearly identical attempt after we changed these procedures and stopped it in its track."
He noted the financial transparency required for school districts can increase their vulnerability.
All the district's contracts are public, while financial information also is published online. Until a recent change in the financial transparency, the district also was required to publicly post its check registers.
"We have a lot of information that has the potential to make us an easier target than a private company," he said.
Along with the money recovered by police, the district is receiving about $200,000 from its insurance company, limiting the total loss to about $172,000. The district is continuing to work to recover the remaining money.
"Any loss isn't something we would want, but we're glad that the vast majority of the money is back where it's supposed to be," said Boulder Valley spokesman Randy Barber.
In the neighboring St. Vrain Valley School District, where work is ongoing for a $260 million bond issue approved by voters in 2016, Chief Financial Officer Greg Feith said electronic payments aren't used for short-term vendors.
He also signs any checks for more than $5,000 and verifies that the address on the check matches the original address of the contractor.
While Feith hadn't seen any scamming attempts similar to the one in Boulder Valley, he said, the district gets plenty of "spear-phishing" emails -- generally emails impersonating the superintendent or other district officials saying they need him to cut them a check.
"We have a lot of stuff in place to protect us," he said.
Boulder County Sheriff's Office spokeswoman Carrie Haverfield said financial crimes generally are on the rise in Boulder County, from paving scams to computer software upgrade scams.
"Scammers are getting more savvy in figuring out ways to trick people," she said. "We all need to be more aware and do our own due diligence."
