The top business manager for the East Baton Rouge Parish school system fell for an unsophisticated con, wiring $46,500 to someone who claimed via email to be Superintendent Warren Drake, even though the man himself was working in an office next door.
The school system on Thursday disclosed the fraud known as “phishing,” which occurred twice in May. The details are outlined in a special audit, received late Thursday from the auditing firm Postlethwaite & Netterville, that examines what happened and suggests ways to prevent it from happening again. The audit cost about $10,000.
Freddy Smith, an auditor with Postlethwaite & Netterville, told the School Board on Thursday that the firm was unable to find evidence that any current school system employees either initiated or received money through the fraud; his staff also found no evidence of fraud from employees who’d left the school system during the year preceding the incident. But Smith acknowledged that its inquiry went only so far.
The school system was able to recoup much of its money. The bank where the money was wired returned $22,261. Insurance covered another $14,238. That left $10,000 out of pocket, an amount too small to “materially affect the school system’s financial position,” Smith said.
The East Baton Rouge Parish school system is preparing for a likely seventh straight year of…
Board member Vereta Lee said the $10,000 loss will still have an impact.
“Ten thousand dollars can buy books, paper, pencils, computers. It is a loss,” she said. “Or pay for our employees who are crying at our doorsteps and asking for a little more money. “
The East Baton Rouge Parish Sheriff’s Office was notified of the fraud the day it was discovered, and quickly enlisted the help of the New York Police Department; the criminal act appears to have occurred there and authorities think that’s most likely where whoever did it lives. No one has as yet been charged in the fraud.
Drake said he needs to re-read the new audit before deciding whether any disciplinary action is warranted.
“It’s a serious event no doubt, and I need to take a look at the details of it before I make a decision,” he said.
Catherine Fletcher, chief business operations officer, approved both of the fraudulent wire transfers on May 5 and 6.
Reached Sunday, Fletcher declined to comment.
“I’ll trust the superintendent to handle it appropriately,” Fletcher said.
School system policy calls for two people to sign “non-purchase order payments” like wire transfers and for documentation to be obtained prior to payment. Chief Financial Officer James Crochet, who normally cosigns such payments with Fletcher, was out of town attending a conference, so Fletcher signed both by herself. Nor did she request any backup documentation, according to the audit.
When Crochet returned to the office May 9, he flagged a third phishing attempt and alerted Drake. That afternoon, Fletcher called the Sheriff’s Office to report the wire fraud, revealing that she’d been the “victim of a scam.”
The school system on Friday released copies of the email exchanges between May 5 and May 9. They include a number of suspicious details.
The first email from the fake Warren Drake arrived the morning of May 5: “Are you in the office? I’ll be busy. Email Me. Regards.” Fletcher quickly replied, “Yes, I am in the office.” At no point in the emails does Fletcher betray any doubt about what’s happening, nor does she request additional information about the requests.
She also made no attempt to call or talk in person with Drake, whose office is adjacent to hers at the School Board Office on South Foster Drive. The fake Warren Drake says at different points that he’s busy or in a meeting, which appears to have dissuaded her from trying to talk to him directly.
The “From” line of these emails says “Warren Drake” but the actual email address was email@example.com, not an address used by the superintendent. The official email address is not immediately visible in many emails. The subject line for the first two wire transfer requests are “Catherine Fletcher” while the third is “Urgent, Catherine Fletcher.”
The fake Warren Drake requested the first wire transfer of $22,500 go to the account of “Rosa a oboadey” in the Bronx, and that the second of $24,000 go to “Johnson Chepkwony” of Brooklyn. The third wire request, which was halted, was for $25,000 for “Sylvester Namutedi,” also from Brooklyn.
The fake Warren Drake is terse, but his punctuation is often incorrect or missing and his English is stilted.
The real Drake told The Advocate he’s still surprised it was not caught earlier, noting that the fake Warren Drake sounded nothing like him.
“No one called me and no one walked over to my office and that is disturbing to me,” Drake said.
After learning of the fraud, Drake said he quickly authorized the audit.
“I just thought this was such a bizarre event that I had to get to the bottom of it,” he said.
In its six-page report, Postlethwaite & Netterville explains it compared the employee bank accounts where paychecks are sent with the accounts where the $46,500 was transferred, reviewed electronic logs and activity history, but also interviewed several school employees.
The auditing firm also recommends several new procedures to help prevent future phishing.
Smith noted the school system has had only a few wire transfers in recent years.
“Wire transfers are very infrequent,” he told the board. “That’s one of the reasons there weren’t tight controls over that process.”