In truth, the Historical Society had no use for French perfume or fancy tennis shirts emblazoned with the company’s signature crocodile logo. The charges, which appeared in a dataset of the state’s purchasing card transactions, were made not by a state employee, but a fraudster who had somehow hacked one the agency’s cards.
The cardholder noticed the bogus transaction and told administrators at the Historical Society. The money was refunded, the card was cancelled and a new one was issued, said Kim Jondahl, the director of Audience Engagement and Museum Division. Instances of external fraud are not exactly devastating for North Dakota’s public entities, but they are common.
A Forum News Service analysis of the transactions reveals just how often the state agencies, public universities and school districts are the victims of payment card hacking. Since 2016, public entities enrolled in the state’s purchase card program have been refunded nearly $260,000 by card provider JP Morgan for transactions deemed to be fraudulent.
The state is “no different than anyone else” when it comes to being a target for card hackers and defrauders, said Jeff Larshus, the Office of Management and Budget’s director of state financial services.
Purchasing cards, or p-cards as they’re commonly called, act almost as company credit cards for government entities. They allow public employees to pay for everything from plane tickets to office supplies without checks or reimbursements. In 2018, the 180 enrolled public entities spent a combined total of more than $123 million using p-cards. Previous Forum News Service articles introduced the state’s p-card program, explored how they are used for travel expenses and detailed the rare conditions under which alcohol can be purchased.
Limousines and designer handbags
The fraudsters hacking the state’s p-cards certainly have expensive taste. The dataset includes unwelcome charges exceeding $1,000 from fashionable designer brands, posh department stores and pricey nightclubs.
The most expensive fraudulent charge came against North Dakota State University in July 2019. The university was refunded $13,600 for a purchase made at a travel agency, but JP Morgan likely sniffed out the illegal activity using complex computer algorithms before anyone on campus noticed the charge. A spokeswoman from JP Morgan declined to comment on this story.
A snowy scene on the North Dakota State University campus in Fargo. NDSU / Special to The Forum
In April 2018, Dickinson State University had to deal with a fraudulent charge of nearly $11,300 made at an art supply store in Kathmandu, Nepal. Marie Moe, the university’s vice president of University Relations & Student Recruitment, caught the charge while reviewing her monthly statement and had the card cancelled.
During one particularly active six-day period for Bismarck Public Schools in 2017, card hackers made away with more than $14,600 in purchases from luxury department stores Neiman Marcus and Barneys New York, a limousine and taxicab company and computer software stores. It’s unclear if a single defrauder was behind all of the charges, which were refunded to the district.
Fraudsters didn’t just go after the big fish — they victimized some of the state’s smallest public entities, too. Public school administrators in Kulm, a city of about 330 residents, were surprised by a nearly $2,500 charge on a district card from SIP Lounge, which appears to be a Washington, D.C., nightclub. Superintendent Tami Kramlich said JP Morgan caught the charge and replaced the card.
‘Barely a concern’
These days, fraudulent activity is little more than an annoyance, said Ryan Lagasse, the business manager for Mandan Public Schools. After a nearly $6,000 fraudulent charge in 2017, JP Morgan handled the whole process from detection to refunding the money and sending out a new card, he said.
“JP Morgan has been great to deal with in situations where fraud has occurred,” Lagasse said in an email. “It is a bit of a pain for us to deal with cancelling cards, but the rebate we receive at the end of the year makes it worth the hassle.”
The company offers a rebate to entities based on the amount they spend, which has likely increased usage of the cards over other forms of payment. Last year, the district received a check from JP Morgan worth more than $87,500, Lagasse said.
For NDSU, the state’s biggest p-card spender, fraudulent charges have never caused any kind of crisis and is “barely a concern” during day-to-day operations, said Stacey Winter, the university’s director of purchasing. The university has been refunded more than $28,000 since 2016 for fraudulent purchases, according to Forum News Service’s analysis.
Larshus, the director of state financial services, said JP Morgan likely dedicates a significant amount of money to prevent and detect fraud since the refunds come out of their pockets. An industry estimate puts fraud-related losses for banks at $16 billion for 2014, according to a JP Morgan report.
Note: The 2019 dataset does not include a complete listing of expenditures from North Dakota’s institutions of higher education.