What happened
Turn Key Health Clinics provides medical care at the jail run by the Pulaski County Sheriff's Office in Arkansas. On 19 June 2026 the county received an email from someone posing as an accounts-receivable representative of Turn Key. The email asked the county to switch Turn Key's payments to ACH electronic transfer and gave new bank details. Nobody checked the change directly with Turn Key.
For several months the county's payments to its contractor went to the new account. On 23 October 2026 a real Turn Key representative asked about months of missed payments. That question exposed the fraud. The county notified the FBI. The loss was first put at $2 million, then at about $1.9 million.
The email
The message did three things. It claimed to come from the person who handles the contractor's incoming payments. It asked for a change in the method of payment, from the county's usual process to electronic transfer. And it supplied the account to use. Reporting does not give the sender's address or the full text.
The request fit the sender it claimed. Accounts-receivable staff do send this kind of message when a company changes banks. That is why the request worked, and why it needs a check outside email.
Why it worked
The fraud depended on a gap between offices. The Arkansas Democrat-Gazette, which reported on the county's handling of the request, found that the change went through without a direct call to Turn Key. The treasurer's office told the paper it could not force other offices to verify a change. It could refuse to set up new bank details without the supporting information.
A recurring payment also hides a diversion well. The first transfer to the wrong account looks like every other monthly payment. Each later one does too. The fraud ends only when the real vendor notices the money is missing, and a vendor may wait months before asking.
What it cost
About $1.9 million was diverted. The two main reports disagree on recovery, and the difference is a matter of dates. On 29 October 2026 the Democrat-Gazette reported that about $126,000 had been recovered. On 31 October KATV reported that the sheriff's office said it had recovered all of the diverted funds. The later report is the more recent statement.
What would have helped
A written rule, applied by every office that pays vendors: no change to bank details takes effect until someone calls the vendor on a number already on file. The call takes minutes. The county's own account shows that the rule existed in one office and was not enforced across all of them.
Vendors can help too. A note on every invoice saying the company will never change its bank details by email gives the paying clerk a reason to stop.
What a warning inside the message would have shown. Antilure marks wording that asks to change payment details and explains the sender in a Details panel: the domain the message came from, and whether this is the first message from that address. Its banner on such a message carries the line: don't reply or pay, check with the sender another way.
Sources
- Arkansas Democrat-Gazette report on the county's handling of the request, Arkansas Democrat-Gazette, 29 October 2026.
- KATV report on the recovery, KATV, 31 October 2026.