Red Lodge Fraud Not As Mayor Described
As reported in the Carbon County News on March 6, 2023, in an article entitled Red Lodge Leaves $69K Pool Fraud In Its Wake (CCN article), Red Lodge Mayor Kristen Cogswell mentioned at a February 28 meeting that the City of Red Lodge had been the victim of fraud. In an interview, she described the crime as the City’s electronic payment being intercepted and then “transferred out of the system, most likely to another country”. She referred often during the interview to sophisticated cybercriminals. Documentation recently obtained tells a different story.
PlaySpace Designs (vendor of pool equipment) confirmed that they had their email hacked, giving the criminals access to invoice information. According to insurance documents, an “unknown perpetrator impersonated Playspace Designs employee and provided fraudulent payment information. As a result, $69,799.15 was transferred to the fraudulent account.”
A partial timeline of events follows, including tips to help you avoid becoming a victim of fraud.
December 21, 2021: City receives an emailed invoice #12922 from morgan@goplayspace.com for pool and splash pad equipment in the amount of $141,183.75. His message reads:
“ please find attached the deposit invoice for the equipment. Receipt of the funds will complete the order and get the equipment into fabrication. Please let me know if you have any questions.
Morgan Selph, RLA CPSI”
Unknown date: Payment of $71,384.60 was made by City with a paper check to PlaySpace Designs that was applied to invoice
April 26, 2022 at 7:03 a.m.: City receives email sent from rebecca@goplayspace.com requesting the balance of $69,799.15 from the City with a due date of May 26, 2022. Her message reads:
“Attached please find the final invoice #12922 for the Red Lodge Splash Pad. Holler if you have any questions or concerns. Thanks for your business!!!”
April 26, 2022 at 9:11 a.m.: City receives email from morgan@goplyaspace.com with the following message:
“You can only send us ACH payment, please send ACH payment to our bank details in the attachment,
Kindly confirm if you are sending us payment today?
Await your response,
Morgan Selph”
TIP: When an unusual request, especially pertaining to finances, arrives in your email always check the email address of the sender. If it is misspelled, it is likely a fraudulent request.
TIP: If the language of an unusual request sounds different than the previous correspondence, this is also a red flag.
TIP: Fraudsters often ask for payment in ways that are untraceable or easily cashed out such as gift cards and electronic cash transfers. Checks and credit cards often have added protections in such situations.
April 26, 2022 at 9:32 a.m.: City replies: “Also, we paid the first deposit with a check. We usually don’t pay through ACH’s.”
April 29, 2022: At this point email subject lines from the fake Morgan start having “(URGENT)” added to the end of them.
TIP: When a sense of urgency is applied to a situation, especially regarding payment of a large invoice that is not due for another month, this should inspire further scrutiny.
May 6, 2022: Email from morgan@plyaspace.com:
“We have tried all our best to look on how we could fix the issue of receiving check payment all through this week but its seems our bank still need more time to get this issues resolved. we can receive any check payment at the moment. we can only receive ACH payment at the moment, please send ACH payment to our bank account sent to you. Kindly remove all extra charges for sending ACH from the amount you are sending us.
we are sorry for the inconveniences this might cause you.
Await your response.
Morgan Selph”
TIP: If language is deteriorating as the exchange continues, this should inspire caution.
May 11, 2022: City emails the fake Morgan that they have submitted the ACH, but it won’t process until the 13th.
May 16, 2022: According to insurance documents, the City didn’t realize anything was amiss until May 16 when a call to PlaySpace revealed they had not received their payment. At some point it was discovered that PlaySpace’s email had been hacked. The bank was contacted right away “to reverse the ACH, but it was returned on May 18th due to insufficient funds.”
May 17, 2022: Check dated 5/11/2022 in the amount of $69,799.15 written to the City of Red Lodge by the Red Lodge Area Community Foundation is deposited into City Operating Account.
May 18, 2022: Insurance claim is filed by City.
June 22, 2022: The insurance paid the full amount of the fraud less the City’s $25,000 deductible.
March 24, 2023: In response to the audit finding “The city’s claims processing policies and procedures were not followed”, the City states “When this payment was processed, we followed the procedures in place that we use for payroll and utility billing.” A review of the documents and the procedures in place at the time show that there were processes required at the time that are undocumented and unreferenced in the materials received from the City in response to my written request for all documentation relating to the fraud.