Liberty updates employee payment policies
LIBERTY — Cybersecurity for local governments may have tightened across Ohio, but that hasn’t spared one community from a near-miss that led to officials updating one of their policies.
Trustees at Monday’s meeting approved passing a policy for their employees’ direct deposits, which includes several changes.
Employees are required to make direct deposit changes in person by filling out and signing an authorization agreement for the service and providing a copy of a cancelled check or bank statement with a routing number and account number, according to the resolution.
Employees are to match a payment to an existing contract or purchase order and verify the business’s name, tax info, address and bank information for payments to vendors, according to the resolution, to address potential fraud from fictitious vendors or duplicate bills.
The resolution also provides a series of steps for changing contact or banking information for a vendor or employer, prioritizing in-person verification and validation.
Fiscal Officer Matthew Connelly said the township had an incident last week, where an employee — through their email — asked one of their secretaries to email a change of payroll form because he was changing banks and relocating to a specific one in Florida.
Connelly said the information was returned and all the information, including the employee’s signature, seemed right.
“The hacker, fraudster, went into our employee’s email and disguised himself as that person,” Connelly said. “Payroll went through, and no one knew anything until he didn’t get paid on Friday of last week, so he called and let us know.”
Connelly said the township has all of the safeguards in place through its banking, like Positive Pay, an automatic fraud detection tool.
“These fraudsters know how to work the system to get a person to actually do it, and we have access to the online system and all to do these changes for them,” Connelly said. “I was able to call the bank, and they reversed it immediately and put that money back in our account for that one person.”
Connelly said they found out the bank in Florida was able to locate the criminal’s bank account and close it out, adding that the money was still there to be returned to the township.
“If that account was closed out that same day or the next day, we could have been out that $1,500, but we weren’t,” Connelly said. “This prevents that in the future, where we’re going back to basically old school and saying, ‘You need to see us in person and sign the form in front of us, and confirm that you’re changing your bank information,’ so we’re sure of it.”
Connelly said such cases really do happen across Ohio, and it has happened to the township, which is why the resolution was recommended by the Ohio auditor’s office.

