Scammer posing as vendor takes city of Swisher for $33K

Swisher paid $33,000 last month to what the city clerk thought was a city contractor but actually was a scammer — joining the list of cities being defrauded out of public money by cybercriminals.

Swisher City Clerk Shelley Annis told the City Council in a July 16 special meeting that she received an email July 3 from an email address that appeared to belong to HR Green, a Cedar Rapids-based engineering and consulting company that has been working with. The email had a copy of a real invoice the city had received about a week earlier from HR Green for $33,000. But this time the email asked the clerk to pay the invoice by an electronic funds transfer, rather than paying with a check.

In a story first reported by KCRG-TV, Annis told the council she didn’t notice anything wrong with the email at first and processed the transfer July 9. A few days later, she said she woke up with a “gut feeling” that she needed to double check the legitimacy of the email. When she looked at it again, she noticed the email address was slightly different from the one she normally corresponded with, she told the council.

She called HR Green and the company confirmed that it hadn’t sent the email asking for the electronic funds transfer.

The case was referred to the Johnson County Sheriff’s Office for investigation, but it is unlikely that any of the money will be able to be recovered from the scammer, Annis told the council. The lost funds likely will be covered by the city’s insurance, but the insurance plan includes a $10,000 deductible for cyber crimes that the city must pay.

It is not clear how the scammer got a copy of a real HR Green invoice, but Annis said she has changed the passwords to the city’s online accounts. HR Green did not immediately return a call Tuesday for comment.

City Council members stated in the meeting they are looking into the possibility of hiring an information technology company to help prevent scams in the future and to help with other city IT work.

“I am totally sick about it. I apologize to the council,” Annis said at the meeting. “... This won’t happen again on my watch, ever.”

Swisher is one of the Eastern Iowa municipalities to face similar scams this year.

In February, Iowa County lost more than $500,000 to a scammer that impersonated the city of Dyersville in asking for a grant under the federal American Rescue Plan Act. In March, West Union lost at least $60,000 to a scammer pretending to be a legitimate vendor.

Comments: (319) 398-8328; emily.andersen@thegazette.com