Insurance won’t pay county’s claim on $566,088 lost to fraud

Six months after Sedgwick County discovered it had lost a little more than $566,000 to an e-mail phishing scam, most of the money has not been recovered.

The organization has recovered about $72,000, up from the roughly $22,000 it had received by late January.

“I think that at this point, we need to face reality and accept the fact that we’ve recovered all that we’ve been able to recover,” Sedgwick County Commission Chairman Dave Unruh said this week.

Sedgwick County made a claim to its insurance company, citing sections of its policy related to computer fraud, funds transfer fraud and forgery. But the claim was rejected.

“Coverage does not appear to apply to your loss,” according to a letter from Fidelity & Deposit Company of Maryland. “There is no coverage for your claimed loss under the policy.”

The Jan. 6 letter, between the county’s insurance company and County Risk Manager Mick McBride, was obtained recently by The Eagle through a Kansas Open Records Act request. There hasn’t been additional communication between the two about the loss since then.

Fraud timeline

Sedgwick County released a timeline of the loss in January after a Georgia man was arrested in connection with the fraud.

On Sept. 23, the county received a blank check attached to an e-mail that was purportedly from contractor Cornejo & Sons. They asked that banking information be changed to match what was on the check.

The fraudster sent an invoice on Sept. 30 for $566,088.90, the amount Cornejo & Sons was to be paid for a preventive maintenance project on 53rd Street North between Andale and Maize. The wire transfer was processed on Oct. 6.

“No one with the insured (Sedgwick County) had any knowledge of the fraudulent e-mail correspondence or wire instructions,” according to the insurance company.

The county discovered the loss on Oct. 25 when Cornejo & Sons called, saying the payment hadn’t been received.

Since then, the county has hired a new external auditor, appointed a new chief financial officer and formed a working group of county staff members to look at vulnerabilities to fraud. The organization’s longtime CFO resigned in December, receiving almost $69,000 in a settlement with the county.

‘Employee’s mistake’

The county’s claim was considered under sections of its insurance policy concerning computer fraud, funds transfer fraud and forgery or alteration.

Fidelity told the county that all three clauses don’t apply to the county’s loss.

For instance, the use of the computer must be the “direct” cause of the loss for the computer fraud clause to apply.

“The cause of the loss was the employee’s mistake,” according to the letter. “The use of a computer did not directly fraudulently cause the transfer of any property or specifically, the lost funds.

“The employee’s legitimate use of the computer to send the wire transfer is not computer fraud.”

Under the insurance policy, the clause on funds transfer fraud applies only if someone pretends to be a county employee and sends fraudulent payment instructions without the county’s knowledge.

But, in the fraud case, the county’s employee instructed the wire transfer be completed. No one else did, the insurance company said.

And a forgery or alteration clause doesn’t apply because the loss was directly caused by the wire transfer, not the fraudulent e-mail.

“The e-mail with the attached blank check merely request(s) that the vendor’s bank account be changed for … transactions – as opposed to an order, direction or promise to make the payment,” according to Fidelity.

“There is no coverage for loss directly resulting from the alleged forgery or alteration.”

‘Pursue all avenues’

When the suspect was arrested in January, the county announced that $22,471.41 of the money had been recovered “to date.”

That was about 4 percent of the total lost in the fraudulent transfer.

“Sedgwick County continues to pursue all avenues of potential recovery,” a news release said.

The county has now recovered $72,173.83, which is about 13 percent of the loss.

It is unclear what avenues the county used to recover funds or whether they have been exhausted. County staff members would not answer those questions this week, saying Sedgwick County cannot comment on matters related to the U.S. Attorney’s Office’s case.

Jim Cross, a public information officer for that office, told The Eagle he was unable to answer questions “at this early stage of the federal prosecution.”

Commissioner Jim Howell said he thought the county’s options for recovering funds have “run that course.”

“I don’t think it’s something that the county had a lot of confidence it was going to go in our favor,” he said of the insurance claim. “But it’s reasonable for the county to try.”

Unruh said he was disappointed the scam affected Sedgwick County, but he was glad the county is looking out for vulnerabilities to fraud.

“It’s happened and we’ve taken steps to try to ensure that it will never happen again.”

This story was originally published April 27, 2017 at 7:12 PM with the headline "Insurance won’t pay county’s claim on $566,088 lost to fraud."