Ongoing police investigation as fraudsters attempt to obtain council cash
![North Wales news and information](https://north.wales/wp-content/uploads/2020/02/Anglesey-County-Office-6.jpg)
Anglesey Council and some of its suppliers were almost left paying the price thanks to I.T scams in circulation during the lockdown.
A report presented to the council’s Audit Committee confirmed that two similar frauds had tried to obtain council funds since March, with one involving the hacking of a supplier’s email system.
Meeting on Tuesday, members were told that while Anglesey’s own I.T systems had not been compromised, one attempt to gain financial benefit was almost successful after the unnamed company’s system was hacked by scammers, leading to the authority receiving what seemed to be a genuine request to change the firm’s banking details for future payments.
It was only after an invoice was paid into what turned out to be the scammers’ account was the issue flagged up, after the recipient bank’s fraud team alerted the authority’s own bank.
When asked for further information, a council spokesman confirmed that while the attempt was thwarted in time by the recipient’s bank – who froze the account and notified the authority’s own provider – they could not divulge the amounts involved or any more details due to the ongoing police investigation.
But as a result of the attempt, known as “malicious redirection,” counter fraud training sessions were arranged for council staff to raise awareness of what to look out for, particularly during the lockdown.
This training had proved particularly useful after a payroll officer successfully flagged up a further unrelated attempt before any transfers were made.
The second attempt, known as “email spoofing,” is when emails are designed to appear like it originated from the legitimate company.
But while the authority’s own computer systems were not thwarted on either occasion, further audits are planned to further judge the safety of the authority’s security measures.
Responding to the findings, Cllr Dylan Rees pointed out a recent announcement that Redcar and Cleveland council had to spend £10.4m following a massive cyber attack on their own IT systems.
Seeking clarification on the stability of the resilience of Anglesey’s security measures, he was reassured by officers that a recent audit offered reasonable assurance and that proper safeguards are in place.
But with the vast majority of staff working from home, it was also acknowledged there had been a “huge transition” to digital from traditional office working.
As a result the Chief Executive, Annwen Morgan, spoke of a need to be vigilant in terms of potential cyber attacks in future.
She added, “The IT department is looking at staffing levels and its expertise in even better management of any cyber attacks, this structure is under consideration which should improve things going forward.”
Moving forward, a spokesperson for the authority confirmed that Salford City Council’s IT Service is being commissioned to assist the internal audit department with future work in the field.
They added, “Due to the size of the (Anglesey Council) Internal Audit team it does not employ its own dedicated IT auditors and so Salford City Council is providing this service, which it does to many other local authorities who do not have their own IT audit capability.”
Members had been told that Salford City Council had been selected due to its expertise in the field of IT resilience for public bodies, acknowledging the “economy of scale” for such expertise within smaller authorities such as Anglesey.
By Gareth Williams – Local Democracy Reporter
Spotted something? Got a story? Send a Facebook Message | A direct message on Twitter | Email news@north.wales