Ohio state auditor issued guidance on email scams in April; employees might be liable if they fall for a scam

Corinne Colbert reports:

The Ohio Auditor of State’s office issued a bulletin this past spring with guidance on detecting and avoiding payment redirect scams — and warned that public employees who failed to follow that guidance could be held accountable.

That could have ramifications for whoever in Athens city government is determined to be responsible for the loss of nearly $722,000 in an email scam last month.

Auditor of State Bulletin 2024–003 went to all public offices, community schools and independent public accounts in the state on April 12. The auditor’s office had also issued an advisory on increased cybercrime in March 2023.

Advisories function as a kind of heads-up about “emerging issues or concerns,” a spokesperson for the state auditor’s office told the Independent by email. Bulletins, on the other hand, “are formal communications that provide detailed instructions or guidance on specific topics,” the spokesperson wrote.

The April 12 bulletin states, “Failure to follow the guidance in this Bulletin may result in an AOS finding when a loss occurs, and the employee is considered liable as a result of negligence or performing duties without reasonable care.”