Business Email Compromise and Employee Liability: What Ohio's Auditor Actually Said
In April 2024, Ohio’s Auditor of State issued Bulletin 2024-003, guidance on payment redirect and business email compromise (BEC) schemes. One sentence in it gets most of the attention: “Failure to follow the guidance in this Bulletin may result in an AOS finding when a loss occurs, and the employee is considered liable as a result of negligence or performing duties without reasonable care.”
Seven months later, the City of Athens sent $721,976.26 to a criminal’s bank account.
According to local reporting, Athens city code sets a $200,000 bond for its treasurer and $150,000 for its auditor. An audit finding could require the responsible party to forfeit theirs.
For a CISO or compliance lead at a public agency, that raises a fair question: Could one convincing payment redirect request leave someone on your team personally on the hook?
The answer turns on a detail in the Bulletin’s wording that’s easy to skim, but that detail also points to what you can do about it.
What Bulletin 2024-003 requires
Bulletin 2024-003 is short and specific. It sets out how to verify any request that changes where money goes, in order of preference:
- Never change vendor, financial institution, or employee contact or banking information without independent verification.
- Avoid taking payment redirect requests electronically and never use email or phone numbers in the request to verify it.
- Verify in person whenever possible. Payroll redirects always require in-person verification. If you don’t personally know the vendor, a second person from the department that deals with them should confirm the change.
- If circumstances prevent in-person verification, call a phone number from a validated source, such as a prior invoice, a regularly updated contact list, or the vendor’s known website. Ask a question about a past conversation only the real contact would know and offer to call back.
- Require an internal second approval for payment requests and for changes to payment instructions or contact details. Different people should initiate and approve.
- Consider a very small test payment and use bank protections like positive pay.
The Bulletin also recommends ongoing security awareness training and cyber insurance coverage, through either a vendor or an association.
The Auditor first published this guidance as an advisory in March 2023. The 2024 Bulletin added the warning about audit findings.
How Athens lost $721,976.26
Reporting from WOUB lays out the sequence of events. In Oct. 2024, attackers began watching emails between the city and Pepper Construction, a contractor on its fire station project. They intercepted a message and registered two lookalike domains: pepperconstrcution.com, with the “c” and “u” swapped, and pepperconstructlon.com, with a lowercase “I” standing in for the “i.”
Posing as the contractor’s accountant, the attacker asked the city to switch from paper checks to electronic payment because the company had “fully moved to a new payment method to streamline all our receivables.”
On Nov. 15, the city processed an ACH payment of $721,976.26 to an account controlled by the attacker.
On Nov. 21, a city employee flagged the lookalike address.
On Nov. 25, the real accountant confirmed within two hours of being asked that the emails weren’t his. Checking directly with the real accountant is what the Bulletin’s safeguards are built around. Athens reached that confirmation after the payment went out.
BEC personal liability: What the Bulletin actually says
Some news coverage framed the Bulletin as employees being liable if they fall for a scam. The Bulletin’s own wording is narrower: It says failing to follow its guidance may result in an audit finding, with an employee considered liable for negligence or “performing duties without reasonable care.”
When the Auditor issues a “finding for recovery,” it names a person to repay public money. Local reporting tied that exposure to the Athens treasurer’s $200,000 and auditor’s $150,000 bonds, which city code sets.
The Auditor’s Bulletin 2022-010 describes a 2022 change in Ohio law. For certain fiscal officers, the Auditor says liability now turns on whether they used reasonable care, where before it did not.
The Bulletin’s wording centers on whether its guidance was followed, not on whether an employee was fooled. It doesn’t promise that following every step prevents a finding, and each audit turns on its own facts.
The Athens outcome shows how that plays out. In the city’s 2024 audit, the Auditor of State found that the city “made the payment to the third-party without taking the necessary steps to verify this change per sound cybersecurity controls outlined in Auditor of State Bulletin 2024-003.”
In that audit, the office did not hold anyone personally responsible. The Auditor said it will consider the outcome of a federal court case in Iowa during the city’s next audit. The city says the FBI’s Iowa office found evidence that may link the theft to cases there.
According to ENR, Athens has since recovered $405,000 ($200,000 through cyber insurance and $205,000 from the frozen bank account). The Auditor told the Athens County Independent that its accounts payable administrator now calls vendors.
Athens isn’t the only Ohio office to go through this. Since May 2025, the Auditor of State has announced findings for recovery in several payment-redirect cases, some repaid under audit. In some of them, the amounts repaid were small compared with the loss.
For a security leader, the Bulletin’s approach is workable. It names the expected behavior before anything goes wrong, which gives the organization a concrete target to build toward.
Spotting the typo can’t be the entire plan
Public organizations shouldn’t expect an accounts payable team to catch a swapped “c” and “u” in a sender’s domain at the end of a busy week. WOUB’s reporting indicates the attacker spent weeks reading real correspondence and knew exactly which project and which contact to impersonate.
An Ohio University cybersecurity professor told the Athens County Independent, “the attacker really studies their target.” That patience is what makes social engineering work on smart, careful people.
The Bulletin’s recommendations hold up because they don’t depend on anyone noticing the forgery. Confirming a change in person, or through a phone number from a validated source, doesn’t depend on how convincing an email looks.
The Bulletin also warns that attackers can use AI to match voices and appearances. A question only the real contact could answer adds a checkpoint that doesn’t depend on how the voice sounds.
Make the safe step the automatic one
A public organization’s real defense is making sure no employee is ever in a position to skip the safeguard. That’s a security awareness training and process problem, and both halves are solvable.
On the process side, build the bulletin’s steps into the payment workflow, so they’re harder to bypass quietly. These practices draw on the Auditor’s published guidance, so adapt them to your agency’s policies:
- Verify in person where you can. Otherwise, keep vendor phone numbers in a source the email cannot touch, like the original contract or vendor master file, and call that number.
- Treat any request to change where money goes as a verification event, regardless of who sent it or how routine it looks.
- Enforce the second approval in the system, so one person can’t release a changed payment alone.
- Log every verification. The record gives an auditor something concrete to review and shows who did the work.
On the awareness training side, the goal is reflex. People should recognize a familiar sender asking to send money somewhere new as the signal to stop and verify. They should practice that response with realistic scenarios until verification stops feeling like an extra step.
NINJIO builds each episode on a real attack, including BEC schemes, so employees see how a lookalike request unfolds and where independent verification stops it.
Ohio is one state that wrote its standard down, but the same question comes up after many losses in many sectors: Was the documented control followed?
A useful place to start is a recent vendor banking change. Trace who verified it and where that verification is recorded. Whatever gap turns up is the one to train against first.
NINJIO last updated this article on Oct. 7, 2026. It offers general information, not legal advice. Check your own obligations with your state auditor and your counsel.
Frequently Asked Questions
Issued April 12, 2024, Bulletin 2024-003 asks Ohio public entities to independently verify any change to vendor, financial institution, or employee payment and contact information. It also calls for in-person verification of payroll redirects, phone confirmations that use a question only the real contact could answer, and a second internal approval for payment requests and changes.
States set their own standards, so check your state auditor’s guidance. In Ohio, the Auditor of State has said it’s possible. Bulletin 2024-003 says failing to follow its guidance may result in an audit finding when a loss occurs, with an employee considered liable for negligence or for performing duties without reasonable care. The Bulletin’s wording centers on whether its guidance was followed, not on whether someone was fooled.
Verify changes to payment details in person where you can. If you can’t, call a phone number from a source you already trust, such as the contract, a prior invoice, or the vendor file, never one from the request itself, and ask a question only the real contact could answer.
Require a second person to approve changes, enforce that approval in your payment system if you can, and log each check. Train employees with realistic BEC scenarios, so verification becomes routine.
