[{"data":1,"prerenderedAt":138},["ShallowReactive",2],{"blog_post:warren-county-wire-fraud-flagged-twice-overridden":3},{"id":4,"uid":5,"url":6,"type":7,"href":8,"tags":9,"first_publication_date":10,"last_publication_date":10,"slugs":11,"linked_documents":13,"lang":14,"alternate_languages":15,"data":16},"avXxNRIAACcAKgFN","warren-county-wire-fraud-flagged-twice-overridden","\u002Fnews\u002Fwarren-county-wire-fraud-flagged-twice-overridden","blog_post","https:\u002F\u002Fairlift.cdn.prismic.io\u002Fapi\u002Fv2\u002Fdocuments\u002Fsearch?ref=avdH6hIAAC4AsctN&q=%5B%5B%3Ad+%3D+at%28document.id%2C+%22avXxNRIAACcAKgFN%22%29+%5D%5D",[],"2026-11-13T17:24:55+0000",[12],"warren-county-lost-3.3-million-to-fraud.-the-system-flagged-it-twice-and-got-overridden-anyway.",[],"en-us",[],{"post_title":17,"author":23,"category":28,"date":29,"summary":30,"hero_image":34,"body":46},[18],{"type":19,"text":20,"spans":21,"direction":22},"heading1","Warren County Lost $3.3 Million to Fraud. The System Flagged It Twice and Got Overridden Anyway.",[],"ltr",[24],{"type":25,"text":26,"spans":27,"direction":22},"paragraph","cloudPWR Team",[],"insights","2026-11-12",[31],{"type":25,"text":32,"spans":33,"direction":22},"A sheriff's investigation into a $3.3 million government wire fraud found the county's own fraud threshold caught both fraudulent payments. Nobody stopped them anyway.",[],{"dimensions":35,"alt":38,"copyright":39,"url":40,"id":41,"edit":42},{"width":36,"height":37},4480,6720,"Yellow notebook with the word Scam surrounded by crumpled paper and banknotes, representing financial fraud","Source: Pexels - free commercial use","https:\u002F\u002Fimages.prismic.io\u002Fairlift\u002FctS9N8aR34vzpmXB_hero-image.jpg?auto=format,compress","ctS9N8aR34vzpmXB",{"x":43,"y":43,"zoom":44,"background":45},0,1,"#ffffff",[47,83,94,122],{"variation":48,"version":49,"items":50,"primary":51,"id":80,"slice_type":81,"slice_label":82},"default","initial",[],{"body_text":52},[53,57,60,63,74,77],{"type":54,"text":55,"spans":56,"direction":22},"heading3","Two Flags, One Approval Each",[],{"type":25,"text":58,"spans":59,"direction":22},"Warren County, New York lost $3.3 million in December 2025 when a scammer convinced the county treasurer's office to reroute two payments meant for a public works contractor. The sheriff's office spent nearly a year investigating what happened. The findings don't describe a sophisticated hack. They describe a phone call, a missing policy, and two fraud alerts that got approved anyway.",[],{"type":54,"text":61,"spans":62,"direction":22},"A Caller With the Right Questions",[],{"type":25,"text":64,"spans":65,"direction":22},"Between November 10 and December 8, 2025, someone called multiple Warren County departments asking about the county's account with Peckham Industries, a paving and construction contractor, according to a sheriff's office investigation covered by Government Technology. On November 12, a call to the treasurer's office produced what investigators called \"pertinent financial and business information.\" That single call supplied enough detail for the scammer to impersonate a Peckham employee named Rafael Diaz, a name nobody at the county had reason to doubt.",[66],{"start":67,"end":68,"type":69,"data":70},202,267,"hyperlink",{"link_type":71,"url":72,"target":73},"Web","https:\u002F\u002Fwww.govtech.com\u002Fsecurity\u002Freport-lack-of-proper-safeguards-to-blame-in-3-3m-swindle","_blank",{"type":25,"text":75,"spans":76,"direction":22},"On December 12, the treasurer's office sent an ACH payment for $2,132,480 to the new account the caller had designated. Eleven days later, a second payment went out for $1,225,954. Both transactions exceeded the county's own $1 million threshold for flagging potential fraud. Both got approved anyway, by a deputy treasurer who later wrote that she \"should have questioned if anyone validated that ACH form.\" She didn't, and neither did anyone else.",[],{"type":25,"text":78,"spans":79,"direction":22},"Peckham Industries had actually warned its customers five months earlier, in July 2025, about fraudsters impersonating the company to redirect payments. County staff received that warning. It never reached the treasurer's office. By the time Peckham called to ask where its money was, on December 23, both payments were gone, and more than $1 million of it is unlikely to ever come back.",[],"body_text$549551d9-696d-4c78-98f9-992aeca5721a","body_text",null,{"variation":48,"version":49,"items":84,"primary":85,"id":92,"slice_type":93,"slice_label":82},[],{"quote_copy":86,"quote_source":90,"quote_image":91},[87],{"type":25,"text":88,"spans":89,"direction":22},"No member of the treasurer's office ever contacted Peckham Industries, or the Warren County Department of Public Works, to verify the request to modify payment methods or the banking information submitted on the ACH authorization form before establishing the new account.",[],[],{},"quote$54806671-742b-4e42-bfbb-3403275b0268","quote",{"variation":48,"version":49,"items":95,"primary":96,"id":121,"slice_type":81,"slice_label":82},[],{"body_text":97},[98,101,104,107,110,118],{"type":54,"text":99,"spans":100,"direction":22},"A Policy That Existed on Paper",[],{"type":25,"text":102,"spans":103,"direction":22},"The county did have a wire transfer policy, adopted by the Board of Supervisors on December 19, 2025, a week after the first fraudulent payment went out. It required a verification code delivered by phone from the bank before any new ACH account could be approved. Investigators found no evidence anyone in the treasurer's office called Peckham, called the bank, or called the county's own public works department before changing where $3.3 million would go.",[],{"type":25,"text":105,"spans":106,"direction":22},"The treasurer told a local paper the county has had ACH policies in place for 20 years. Employees described a different reality in depositions: a rushed shift from paper checks to ACH payments, pushed forward without finished training or written procedures. One accountant said in a deposition that the treasurer kept moving ahead on ACH payments even without a policy in writing. The county administrator had a blunter way of putting it: building the plane while flying it.",[],{"type":54,"text":108,"spans":109,"direction":22},"What a Governed Pipeline Actually Catches",[],{"type":25,"text":111,"spans":112,"direction":22},"This is a Capture-stage problem, not a cybersecurity problem. Nobody breached a firewall or cracked a password. A vendor's banking details changed, and nothing in the process required proof before money moved. AIRLIFT Connect treats that kind of change as a governed event: inbound requests get authenticated against a known source, and any change to a payment or delivery destination produces a record in an audit timeline showing who approved it, when, and against what verification step.",[113],{"start":114,"end":115,"type":69,"data":116},210,225,{"link_type":71,"url":117,"target":73},"https:\u002F\u002Fwww.airlift.app\u002Fconnect\u002F",{"type":25,"text":119,"spans":120,"direction":22},"That's the gap between a policy that exists and a system that enforces one. A document on a shared drive doesn't stop a deputy treasurer from approving a flagged transaction under deadline pressure. A workflow that requires a verified callback before a destination can change does. Warren County's fraud threshold worked exactly as designed. It flagged both payments. The failure was that flagging a transaction and stopping a transaction were never actually the same step.",[],"body_text$21f95333-762c-4ade-b66c-304c122d5291",{"variation":48,"version":49,"items":123,"primary":124,"id":137,"slice_type":81,"slice_label":82},[],{"body_text":125},[126,129],{"type":54,"text":127,"spans":128,"direction":22},"The Fix Isn't Budget, It's Enforcement",[],{"type":25,"text":130,"spans":131,"direction":22},"Most agencies don't need a bigger budget to fix this. They need the verification step to be mandatory, logged, and impossible to skip under deadline pressure, which is exactly what AIRLIFT Connect's Capture and Observe stages are built to do for government payment and document pipelines. If your agency changed a vendor's payment method or banking details last quarter, it's worth checking whether anyone actually verified it with a phone call, or just processed it because the form looked right. Talk to cloudPWR to find out.",[132],{"start":133,"end":134,"type":69,"data":135},498,514,{"link_type":71,"url":136,"target":73},"https:\u002F\u002Fwww.cloudpwr.com\u002Fcontact\u002F","body_text$9ce1307a-a896-401a-a12b-f57eca0fc361",1794590729749]