An email scheme has cost Southern Oregon University $1.9 million in lost funds that should've gone to the contractor on the McNeal Pavilion and Student Recreation Center construction project, the university announced Wednesday afternoon.
Someone posed in an email as a contractor on the student athletic gym project, prompting officials to send its April payment to a bank account the contractor did not control. “It happened in late April and we discovered it in three business days,” SOU Public Information Officer Joe Mosley said Wednesday.
The university says there is a process in place for vendors to change their bank account numbers. “It’s not an uncommon thing to happen,” said Mosley. “The person went through the processes that are outlined. We thought that was sufficient but we’re taking another look at the processes now.”
The transfer of money did not go to Andersen Construction, which is working on the gym. “They had nothing to do with it," Mosley said. "It was someone else posing as Andersen.”
Local, state and federal authorities were notified immediately after the fraud was discovered, SOU officials said. An FBI investigation was launched and efforts by the university are currently underway on multiple fronts to recover any and all losses, the announcement said.
Student leaders received a call to meet on short notice at Stevenson Union Wednesday morning, where they were told of the scam.
Students say they feel unsettled by it all. “They only gave 20 minutes notice. Between 10 and 20 people showed up," said Hannah Jones, editor of the student newspaper The Siskiyou. “We’re confused by what’s going on and what it might mean to the university.”
Mosley said he wanted students to know this has nothing to do with a 12 percent tuition increase approved in May. “We want to make very clear this has absolutely no relationship with the tuition increase which was in process long before," he said. "This doesn’t aggravate that. This is totally separate.”
“We received a briefing by FBI that there have been 78 different attacks at institutions and some of those were universities,” said Mosley. “We’re not alone.” SOU says this has never happened to the institution before.
“There are lessons here for anyone operating in today's electronic business environment,” SOU General Counsel Jason Catz said in a message to campus students, faculty and staff. “We are also carefully reviewing our own policies and procedures to determine how we can prevent any similar incidents in the future.”
On May 5 the FBI sent out a warning: “Many universities are frequently engaged in large construction projects which require regular electronic payments of at least several hundred thousand dollars. It is relatively easy for a criminal to identify the construction companies involved in these projects and use social engineering and e-mail spoofing to commit this type of fraud. As a result of the nature and large size of these payments to a construction company, losses are significant.”
In the warning, it referred to a particular incident, without identifying the victim, saying: “Financial loss to higher education institutions has approached $1 million from a recent single occurrence.”
SOU is working to reclaim some money still left in the bogus account, which they were able to lock up shortly after the scam. The university is also determining the extent of its insurance coverage, and how it may help to remedy losses from any unrecovered funds, the announcement said.
The incident will not affect any university programs or operations, and will not alter the athletic pavilion construction project, which is scheduled for completion in January, officials said.
“We’re the victim here. Could we have done anything better? We’re looking into that and its very frustrating for all of us,” Mosley said. “What’s happening now is a thorough investigation through the FBI.”
—Email Ashland freelance writer Julie Akins at email@example.com and follow her on Twitter at twitter.com/@julieakins. Hannah Jones contributed reporting to this story.