Pulaski County, Ark., is tightening its financial controls after a sophisticated email scam diverted roughly $1.9 million to a fraudster posing as the county jail’s medical‑care contractor, Turn Key Health Clinics.
How the scam unfolded
In June, the sheriff’s office received an email requesting a change in the contractor’s bank account information. The county’s accounts‑payable office processed the request, and the treasurer’s office subsequently wired payments to the new account. The deception went undetected until October 23, when a legitimate Turn Key representative contacted the county about months of missed payments.
County response
Michael Hutchens, the appointed county comptroller, said the breakdown began when a finance employee in the sheriff’s office failed to verify the change directly with Turn Key. Hutchens noted, “Normally, an individual that gets that information—a responsible department head, like a finance director—would verify that information.”
When asked about future safeguards, Hutchens promised a more rigorous approach: “I don’t trust what anybody tells us now,” he said, adding that the office will verify “everything.”
Kristin Knox, the sheriff’s office spokeswoman, confirmed that the incident is under review and that the department has contacted the FBI. She declined to comment on potential disciplinary actions, stating, “Not at this time.”
New verification procedures
Angie Martin, director of operations for the treasurer’s office, explained that the office’s role is limited to setting up bank and routing information; vendor details are not normally provided. Going forward, officials will require a name and contact information for any vendor before establishing new payment instructions. “We can’t make them do it, but we can say we’re not setting up the bank if we don’t get the information,” Martin said.
Although the treasurer’s office was not the source of the error, Martin called it “very inappropriate” not to seek improvements in response to the incident.
Financial impact and recovery
County officials were able to recover the most recent payment of about $126,000. The FBI’s Little Rock field office declined to confirm or deny an active investigation, but noted that business‑email compromise scams are a growing threat nationwide.
Turn Key Health Clinics, a longtime county vendor, said they have been in contact with officials to provide the correct payment information and will cooperate fully with any investigation. The company’s spokesperson, Kenna Griffin, emphasized that the vendor has no reason to doubt future compensation for services rendered.
Broader fiscal context
The scam arrived on the heels of a multi‑million‑dollar deficit in the county’s general fund. In April, the Pulaski County Quorum Court transferred roughly $42 million from emergency reserves to cover a $9 million shortfall. The most recent treasurer’s report shows a general‑fund balance of $33 million and emergency reserves near $10 million.
The 2026 county budget allocates about $7.8 million for Turn Key services over the year. When payments stopped, Turn Key employees followed up monthly, then weekly, before suspecting fraud in October.
Statewide relevance
Business‑email compromise scams have affected other Arkansas entities. Last December, a Pine Bluff School District employee wired roughly $3.2 million to a fraudulent construction vendor, later recovering about $1.1 million. The FBI’s 2025 Internet Crime Report logged 24,768 complaints of this type, up from 21,442 in 2024, with losses rising from $2.8 billion to $3 billion.
Pulaski County’s new verification steps aim to protect taxpayer dollars and restore confidence in county financial operations.
Original reporting: Texarkana Gazette — read the source article.
