Scammers Continue Attempts to Defraud Nonprofits

Scams, particularly one involving the stolen identity of a British architect, continue to target nonprofits across the country with "donations" via fraudulent checks and requests for portions to be returned before nonprofits realize the checks are fake. We previously reported on the scam affecting nonprofits in Richmond, Va., and Seattle. Now, reports are surfacing in North Carolina and Georgia.

A donor emailed Rick Hairston, founder and president of Canines for Service in Wilmington, N.C., requesting to gift $30,000 to the nonprofit in his late mother's honor, according to StarNews. After some back-and-forth with the prospective donor via email, Hairston received a check for $44,850 last week. Suspicious of the larger-than-expected donation, he took the check to his bank to confirm its authenticity.

“The very first thing [the bank manager] said when he picked it up: 'This is not a bank check. This is not a cashier’s check,' and he gleaned about 10 different things that were wrong with the check itself,” Hairston told WECT, Wilmington, N.C.'s NBC affiliate.

Further south, Georgia Eye Bank's David A. Thompson, its chief financial and administrative officer, received this email Tuesday morning:

Greetings,

I would like to donate to your organization. Will you please direct me to who to discuss about effectively contributing to your mission & projects.

I'll hope to read back from you guys soon.

Warm regards,

Ken C. McFarlane

"McFarlane," as we reported earlier this month, is a stolen identity of a British architect. When Thompson, who was then unfamiliar with the scam, received this email, he immediately began vetting the donor. Not only does he not get many donation offers directly to his email, but the nonprofit was scammed last year when he received an email that appeared to be from the nonprofit's CEO Eric Meinecke, who was out of the office sick that day.

"And, in that email, it basically asked for the bank routing information, and I made an assumption at that point in time that he must’ve gotten a call from a donor, and they wanted to do an immediate bank transfer, so I gave that information in email format in a response email to Eric—not thinking anything about it," he told NonProfit PRO.

Two hours later, Meinecke's impostor replied, requesting that Thompson issue a check to someone in North Dakota.

"And immediately the flags went up and I said, 'Well, my boss would never ask for a hard check to be written for $35,000 to go to somebody in another state because our nonprofit is strictly here in the state of Georgia,'" Thompson said.

While Georgia Eye Bank already had protocols in place, that experience made Thompson and the rest of his staff even more aware about the potential of being scammed, so he promptly showed his information technology employee the suspicious email from "McFarlane" Tuesday. A security check found nothing suspicious, and the email signature included his correct title, company and company address. However, they noticed the email differed. The scammer's email ended with ".com" while the real McFarlane's email ends with ".co.uk." When his IT employee stepped away to deal with another issue, Thompson learned why the emails didn't match.

"It’s just pure luck that my IT [employee] happened to walk out and went to do something else, and I typed that guy’s name [into Google] and [NonProfit PRO's] article came up 10 articles down," he said. "And that’s when I said, 'Oh, this is a phishing expedition from somebody. It’s a scam.'”

Thompson hypothetically guessed what could have happened if he didn't learn it was a scam—maybe he would have responded and directed "McFarlane" to the organization's website to donate, maybe he would have been too suspect to respond or maybe he would have shown it to his CEO. Regardless, suspicions would be high and he and his staff would wonder why a man from England would donate such a large amount of money to a Georgia nonprofit.

"Even if I had [responded], we would have a mechanism to stop [the process] after that," he said. "… We have enough internal accounting controls to stop [fraud]. It takes two people to sign a check in our procedures, etc., etc."