Grayson County Public Schools catches W-2 phishing scam email

By  | 

GRAYSON CO., Va. (WDBJ7) A popular scam that happens around tax time has returned, but this time it's targeting schools, but one local division caught it immediately.

The district's Human Resources Director Janice Linker received an email Tuesday from, what appeared to be, Superintendent Kelly Wilmore.

It asked her to send a list of all employee W-2s in PDF form. But the division was already on high alert for this scam.

Wilmore explained, "Just as a precaution we met, our administrative team met, and then we even gave the same information to our principals at our principals meeting just to let their bookkeepers know. We were just being proactive about it."

This followed another Virginia school being targeted, and the Department of Education warning all schools. Grayson County all but forgot about it until the email came in Tuesday.

"The top line says, 'From Kelly Wilmore,' but then if you go down and scroll and look, then of course it's not my email," the superintendent explained.

Wilmore immediately turned the email over to the Grayson County Sheriff's Office.

It was given to Lieutenant Todd Perkins, who is the Office's Criminal Investigations Unit Supervisor.

He described the investigation saying, "Right now we are attempting to extract the information out to see where it comes back to. There are ways to find where it did originate from, or at least the country that it originated from."

Lt. Perkins is confident it came from overseas, which would make it almost impossible to solve.

"It's extremely difficult to investigate any type of scam case that's outside of your jurisdiction, to begin with," he explained. "When it comes to being overseas then, obviously, you're relying more on the federal agencies. They have a difficult time, depending on the country, even investigating it themselves."

Both Lt. Perkins and Wilmore said they were shocked to see this intricate scam in Grayson County.

"If they'll go after us, they'll go after anybody. We're small, we're rural, we're not a big area, we're not a big school division," Wilmore said. "If they're going to try to hit on us, there will be other people that will be targeted in the state."

So far, divisions in Davidson County, North Carolina and Odessa, Missouri have fallen for the scam, just to name a couple.

Wilmore said he's very thankful they caught it early.

"Oh Lord! If it would have it would have been bad," he said. "We would be like one school division I saw in North Carolina that had to get Life Lock, I believe, for the whole year for all their employees and I know that costs a fortune."

He added the division's tech person was setting up a filter where he'd be notified of any emails that feature "W-2" in them. That way they can't be targeted again.

Lt. Perkins said if anyone receives a suspicious or odd email they should call that person to verify the email, like Linker did in Grayson County.