AGFC suffers a loss exceeding $400K due to a phishing scam

Little Rock, Arkansas – Phishing scams have increased in frequency over time, impacting our neighbors, acquaintances, and family.

But what if a whole government institution was duped by a scam?

The Arkansas Game and Fish Commission (AGFC) lost more than $400,000 as a result of what occurred in Arkansas around this time last year.

AGFC Director Austin Booth spoke to Legislative Joint Auditing Committee state lawmakers on Thursday.

Booth warned lawmakers about scams, saying, “They’re only getting more common and more effective.”

According to AGFC Deputy Director Ben Batten, the scam occurred when the AGFC tried to make a regular payment.

According to Batten, “the Arkansas Game and Fish Commission and a new vendor we were collaborating with fell victim to what is known as a man-in-the-middle scheme, in which a malevolent third party interjects themselves into an email chain that looks authentic but isn’t.”

According to an AGFC spokesperson, the money was meant to be given to the TOLM Group, a company based in Morrilton, in return for renovating the Joe Hogan State Fish Hatchery in Lonoke.

The mistake was found when TOLM Group realized they hadn’t been paid, according to State Representative Robin Lundstrum (R-Springdale), who is on the committee that questioned Booth on Thursday.

“They realized something was wrong right away and called law enforcement when the vendor called and asked, ‘Where’s the money?'” Lundstrum said. “They took every precaution they knew how to take.”

Thus, $421,206 went to scammers rather than the business.

“This was a very sophisticated attack that looked legitimate,” Batten stated. “We reported everything we needed to as soon as we became aware of it, and we followed normal protocols.”
After the fact, Lundstrum concurred that AGFC handled things correctly.

However, she added there is a smart way to avoid frauds like this one as they get more sophisticated and widespread.

In particular, for large invoices like this, Lundstrum said, “start picking up the phone and calling. Call, confirm, maybe have two identifiers, but never assume that just because it’s the way we’ve always done it, we can always do it this way.” The adversaries have advanced in sophistication.
According to Batten, the AGFC has already received roughly half of the funds back through cybersecurity insurance and is attempting to collect the remaining amount in collaboration with police enforcement.

“To try to investigate and recover the money, our attorneys and our fiscal staff have been working closely with the Little Rock Police Department and the FBI’s Little Rock branch, which specializes in cyber security,” Batten stated.

“We’re really sure that we can recover almost everything that was taken from the agency if we work with them,” Booth stated on Thursday.

According to Lundstrum, the AGFC and law enforcement will handle this process; the Legislative Joint Auditing Committee won’t be heavily involved.

Like everyone else, we want to know how the tale ends, so we’ll follow up,” Lundstrum stated. But I have faith that they have a solution because they are collaborating closely with law enforcement.