CHESTERLAND, Ohio — A cybercrime wave targeting government agencies has resulted in Northeast Ohio cities, counties, schools and more paying fraudsters more than $4 million since 2023.
The scheme, known as payment redirect fraud, involves thieves tricking government employees into sending payments to criminally controlled bank accounts rather than to the rightful recipients.
“It’s the world we live in today,” said Karen Pavlat, treasurer and chief financial officer of the West Geauga Board of Education. “Our businesses are run on the internet, and we have access to that, just like the fraudsters do as well.”
According to records from the Ohio Auditor of State’s Office, the West Geauga School District is among 15 governmental agencies in Northeast Ohio that have been hit by payment redirect fraud since 2023.
Pavlat said the district sent two payments totaling $27,500 to the criminals in late 2024.
She said the district was tricked into changing account information after a vendor’s email was hacked.
Cory Scott, the executive director of the Center for Cyber Security and Privacy Protection at Cleveland State University, a former security executive at Google and LinkedIn, said criminals posing as companies doing business with the government, or “vendor impersonation,” is now the most common form of payment redirect fraud in Ohio.
“As a famous criminal once said, I robbed banks because that’s where the money is,” said Scott. “The idea is you go for these larger attempts of scores against major vendor contracts that are typically larger expenses.”
State records reveal just how large those contracts and expenses can be.
Among the fraudulent payments reported to the auditor’s office, Parma Heights paid nearly $974,000, Mansfield reported a $748,000 payment, Orange City School District paid nearly $620,000, Greater Cleveland RTA reported almost $465,000, Village of Greenwich in Huron county paid more than $269,000 and in September, Lake County reported to the state fraud totaling more than $466,000.
“Literally electronic cyber fraud, we have almost every week, if not every day,” said Ohio Auditor of State Keith Faber. “It is growing.”
Faber said that included a double-digit increase last year.
It’s why his office issued alerts to governments statewide, warning them to verify any request to change payment information before sending money.
“The problem is, without taking that inconvenience, you’re subjecting the city or the county or the township or the government entity to a huge potential loss,” said Faber.
In Geauga County, Pavlat said the school district had policies in place to protect against this kind of theft.
“In that case, it was human error that didn’t make that call,” said Pavlat.
She said the district recovered the stolen money through its cyber-security insurance policy, as did a number of other agencies contacted for this story.
But Scott warns that it comes with a price, too.
“For most carriers and underwriters of cyber insurance policies, they rate municipalities as one of the riskiest entities to insure…because of these types of losses,” said Scott. “So when you have that level of risk identified by the underwriters, premiums for that insurance coverage continue to go up. When those premiums go up, that comes directly out of the taxpayer’s pocket.”
It's why Faber believes it’s important that people realize this isn’t a victimless crime.
“The fact is, we’re all government,” said Faber. “When you steal or people are taking advantage of government, they're taking advantage of taxpayers.”
Because of that, Faber said his office plans to hold fiscal officers personally responsible for the losses if they don’t take proper precautions to avoid payment redirect fraud.
“You’re gambling with your own money,” said Faber. “You’re not gambling with government money anymore. We will issue a finding for recovery against you for that loss when it occurs.”
