KILGORE — A police investigation has been launched after a phishing email nearly hit an area governmental agency for a $2,500 loss.
David Cleveland, executive director of the East Texas Council of Governments, said a member of his staff received an email Aug. 23 that appeared to come from Cleveland’s email account. The email instructed the employee to immediately go to Walmart in Kilgore and purchase $2,500 in voucher cards.
“He was asked to buy them on my behalf and that I was in a meeting and needed them quickly,” Cleveland said.
The email wasn’t from Cleveland but instead an off-site server with the address ceo@ceoemail.com.
“It said David Cleveland on it,” the director said. “They were phishing for, in this case, Google Play cards.”
Phishing is a cybercrime defined as the fraudulent practice of sending emails that purport to be from reputable companies in order to induce people usually to reveal sensitive data. According to the information security team at Texas State University, the data or personally identifiable information is then used to access important accounts and can result in identity theft and financial loss.
“They’re getting more and more common and sophisticated,” Cleveland said. “This one wasn’t that sophisticated, but there are others.”
The Google Play cards were purchased, but as soon as Cleveland exited his meeting, the employee brought the cards to the executive director.
“We have the cards in our possession and the thief was not successful,” Cleveland said, adding that the employee “had to explain what a Google Play card was to me for starters.”
Google Play is an online app store in which music subscription services, books and videos may also be purchased.
ETCOG has contacted the Kilgore Police Department and Walmart, who are working with the agency to find the phishing expedition’s source, Cleveland said. ETCOG Executive Board Chairman and Gregg County Judge Bill Stoudt said that he was also made aware of the potential compromise.
Meanwhile, Cleveland and other ETCOG directors have counseled employees to be suspicious of any email that purports to be from agency leadership and asks for immediate action, specifically purchases or other financial matters.
“We’re asking staff to send those emails to our director of operations and IT (information technology) director … We will take that information and verify the authenticity of that email,” Cleveland said. “That way, we can protect ourselves from these kinds of shenanigans.”
Based in Kilgore, ETCOG is a voluntary association of cities, counties and special districts in East Texas.
Cleveland added that ETCOG’s IT system was not hacked and that “our email system was not compromised at all.”