Someone falsely identifying himself as an employee of NeighborWorks Columbus hijacked the agency’s phone system over the weekend and stole at least $100,000 from its main SunTrust bank account.
The person also may have received personal and financial information from clients who contacted the organization by phone for home-buyer and foreclosure counseling. As the story unfolded Monday, it was unclear how much damage was done.
Cathy Williams, the organization’s president and CEO, said the NeighborWorks phone system was hijacked around 5:09 p.m. Thursday, just before the office closed for the weekend. A stranger called the organization’s service provider, identified himself as a staff member, asked for the calls to be forwarded to a number with a 678 area code — which is metro Atlanta — and the service provider complied.
Williams said the phone number was used to authorize checks from the agency’s operating account. Someone would write a check and go to the bank. When the clerk called the phone number on the check for authorization, someone would answer “NeighborWorks Columbus,” then give the bank permission to cash the check.
She said the name used was David Fox, the name of an employee, but she believes it was an outside job done by someone who got Fox’s name from the Internet.
“When you Google our phone number, David Fox’s name comes up,” she said. “So, this is out-and-out fraud and it’s what’s called a hijacked account. They hijacked our account and at the same time they hijacked our phone so they could authorize the checks.”
Williams said the agency found out about the fraud when it got a call from a Wells Fargo bank in Norcross, Ga., around 4 p.m. Monday, reporting that someone had tried to cash a check for $400 to $600. She said the person got a copy of a check and used it to reproduce checks and forge signatures.
Since learning of the fraud Monday afternoon, all of the organization’s bank accounts have been flagged.
“We honestly are just putting this together,” she said. “So, we don’t know how bad it is. I have copies of about six checks that are about 100 grand right now. Of course, we have no idea how many other checks are out there. So we’ve had to close the account.”
Williams said the agency is also concerned about clients who called the office over the weekend, thinking they were talking to a NeighborWorks counselor. Many of those clients may have given out numbers for credit cards, debit cards and checking accounts, as well as social security numbers. Williams said anyone who called the office while the phones were hijacked should call the office immediately at 706-324-4663.
“If anybody called NeighborWorks from Thursday evening to Monday morning, they need to contact us again,” Williams said. “We need to find out what information they gave out so they can get some protections on their personal data as well as their identity. We also need to know what they heard and what they were told. That might help us narrow down what happened. Because we don’t know motives yet. We don’t even know where the person or persons are located.”
Williams said all the organization’s phones are back under control, and the service provider put in place security measures Monday to protect future calls. Meanwhile, she hopes that the hijacker will be found soon.
“It wasn’t necessarily a high-tech hijacking, but it was sophisticated and aggressive,” she said. “Somebody had a staff member’s name, knew who our service provider was, knew that we were going to end business at 5:30 p.m. on Thursday and was absolutely intentionally taking our phone number.”
Williams said she and her staff noticed the problem Monday after the office opened at 7:30 a.m. She said Mondays are usually busy because the office is closed on Fridays. But on Monday, no calls were coming in. So she called the organization’s service provider to find out what was wrong.
The service provider, which Williams would not identify, agreed to dispatch a technician, Williams said. While she waited for the technician to arrive, Williams used her cell phone to call one of the NeighborWorks numbers. Someone answered the phone and said, “NeighborWorks.” But none of the extensions on the office phone system lit up.
Williams then asked the person on the line, “What number did this roll over to?’ And the man said, “Excuse me?”
She asked, “Is this NeighborWorks Columbus?” And the person, said, “Yeah.”
But when she asked, “Who is this?” the person hung up.
“For me, that’s when I realized something was wrong, very wrong,” Williams said.
At about the same time, the service provider’s technician showed up, but when Williams met him in the reception room, he was getting ready to leave.
Williams asked why he was leaving and he said the service call had been cancelled. Someone had called and told the service provider that the issue had already been resolved and the organization no longer needed a technician. The technician called the service provider and found out about the Thursday request to forward the calls.
Williams said NeighborWorks filed a police report Monday and is continuing with its own investigation.
“We hope that by the close of business today our service provider will be able to give us a list of all the numbers that tried to call us,” Williams said. “And we’re going to be calling (clients), if we have to work until midnight, trying to find out what they might have said and what they might have heard to perhaps help the fraud department at our service provider, as well as police department, narrow down who this might have been.”
Williams said clients must be careful in the future not to give sensitive information over the phone.
“NeighborWorks Columbus would never take personal information over the phone or Internet,” she said. “Don’t ever give that information over the phone because you clearly don’t know who you’re talking to.”