Amid ongoing concerns of fraud, Ohio auditor warns about cyber fraud

Ohio Auditor Keith Faber recently said the state is now facing a major and costly problem: cyber fraud.

The revelation comes amid ongoing concerns and an apparent Buckeye State investigation into daycares in the state and potential fraud that appears to be centered on members of the Somali community.

“I’ll be blunt. I think we lose more money to cyber fraud in Ohio than we do to employee theft and dishonesty, which is a big statement,” Faber said in an interview with Statehouse News Bureau.

“Every week, we find out more and more local governments, more and more entities are being hit by ransomware, by vendor redirects,” he added. “And the numbers that come across my desk aren’t small. They’re in the tens of thousands to hundreds of thousands of dollars.”

The news source reported that over the last three years, Faber’s office has recorded more than 150 instances of cybercriminals targeting Ohio counties, municipalities, townships, school districts, villages, and local governments. In some cases, Faber’s office identified fraud before any money was lost. However, in other cases, the losses ranged from a few thousand dollars to $1.9 million.

According to Faber’s office, one of the most common fraud tactics is a type of spear-phishing, a cyberattack that was designed to target specific people or organizations — in this case, the local Ohio government.
Faber said scammers don’t have much information about a vendor who’s owed for a project, so they contact the vendor via email or phone, claiming an account or location has changed, and ask the vendor to provide the information they need.

“The simple answer is never, ever, ever, ever, never, ever, ever accept redirect requests over the phone or over electronic means. Require people to come in person,” Faber said. “Is it more onerous? Absolutely. Will it stop most, if not all, of that fraud? Absolutely.”

According to the Ohio Auditor’s website, governments are legally required to report cybersecurity fraud to the Ohio Department of Homeland Security within a week and to the auditor’s office within a month.

Last year, Ohio lawmakers passed a bill requiring jurisdictions in Ohio to implement new cybersecurity standards to safeguard data.

Among them were identifying the potential impacts of a cybersecurity breach, establishing policies to establish communication channels, analyzing incidents, containing cybersecurity events, repairing infrastructure, and maintaining security following an incident.

“Under the new law, local governments must adopt a cybersecurity program that safeguards their data, information technology, and information technology resources to ensure availability, confidentiality, and integrity,” CyberOhio said last year.

The recent news about cyber fraud came after Minnesota and Ohio discovered massive fraud allegedly committed by Somali immigrants.