Key Takeaways
- • A bad actor using the still-active work email of former Quincy Retirement Board Executive Director Lisa McBirney fraudulently transferred $3.5 million from an Aberdeen-managed account to an overseas account in February 2021, according to a PERAC report.
- • The Public Employee Retirement Administration Commission (PERAC) found that Quincy, investment manager Aberdeen, consultant Meketa Investment Group and custodian People's United Bank all missed warning signs or precautionary steps that could have prevented or detected the fraud sooner.
- • The fraud went undetected for roughly eight months; Meketa did not review the Aberdeen trade confirmation until April 5, and interim director Brigid Gaughan did not open it until October 25, three days after the fraud was discovered.
- • Quincy's retirement board, which reported $918.6 million in assets for 2021, left McBirney's email active and did not update its authorized signers list for months, a lapse that PERAC said should have been addressed.
- • PERAC's notice to the other 103 retirement boards helped one board thwart a similar attempt in January, underscoring cybersecurity risks across the public pension sector.
Summary
A state investigation has concluded that multiple parties failed to take basic precautions before a $3.5 million cyber-enabled theft from the Quincy Retirement Board, the pension system for thousands of Quincy city employees. According to a 48-page report published by the Public Employee Retirement Administration Commission (PERAC), which oversees 104 contributory retirement systems in Massachusetts, the transfer was requested on February 18, 2021, months after Executive Director Lisa McBirney announced in late 2020 that she would leave her post at the end of that year. Someone posing as McBirney used her still-active work email to ask Aberdeen, an investment manager with which Quincy had contracted in 2020 to invest $6 million, to "pull some funds" and send them to a third-party beneficiary. After several follow-up emails, Aberdeen agreed to process a $3.5 million transfer to an overseas account, including one at a Hong Kong financial institution.
PERAC said Aberdeen missed numerous red flags in an attached letter on Quincy letterhead, including an erroneous phone number, a wrong year in the requested wire date, mismatched fonts and misaligned text, and conflicting account numbers. Aberdeen responded that investigators were relying on hindsight, noting that phone numbers often changed during the pandemic and that formatting errors are common. PERAC also faulted Quincy for keeping McBirney's email active, contrary to industry practice and state guidance, and for not updating its list of authorized signers for several months; that update occurred on the same day as the fraudulent transfer, and PERAC found no evidence investment managers received it. PERAC further found that McBirney's pre-departure notice and reporting requests, sent to People's United Bank, Meketa Investment Group and her interim successor Brigid Gaughan, were not circulated to investment managers.
The fraud went undetected for about eight months because a trade confirmation sent by Aberdeen was not reviewed in time. Meketa did not view it until April 5, and Gaughan did not open it until October 25, three days after the fraud was discovered, according to PERAC. PERAC characterized all four parties as statutory fiduciaries who shared some degree of blame. PERAC notified the other 103 boards under its oversight, and Assistant Deputy Director Bill Keefe said another board thwarted a similar attempt in January. Gov. Charlie Baker said he discussed cybersecurity with legislative leaders, while the administration declined to detail the scope of threats, citing their sensitivity.
PERAC said Aberdeen missed numerous red flags in an attached letter on Quincy letterhead, including an erroneous phone number, a wrong year in the requested wire date, mismatched fonts and misaligned text, and conflicting account numbers. Aberdeen responded that investigators were relying on hindsight, noting that phone numbers often changed during the pandemic and that formatting errors are common. PERAC also faulted Quincy for keeping McBirney's email active, contrary to industry practice and state guidance, and for not updating its list of authorized signers for several months; that update occurred on the same day as the fraudulent transfer, and PERAC found no evidence investment managers received it. PERAC further found that McBirney's pre-departure notice and reporting requests, sent to People's United Bank, Meketa Investment Group and her interim successor Brigid Gaughan, were not circulated to investment managers.
The fraud went undetected for about eight months because a trade confirmation sent by Aberdeen was not reviewed in time. Meketa did not view it until April 5, and Gaughan did not open it until October 25, three days after the fraud was discovered, according to PERAC. PERAC characterized all four parties as statutory fiduciaries who shared some degree of blame. PERAC notified the other 103 boards under its oversight, and Assistant Deputy Director Bill Keefe said another board thwarted a similar attempt in January. Gov. Charlie Baker said he discussed cybersecurity with legislative leaders, while the administration declined to detail the scope of threats, citing their sensitivity.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.