An email appears to come from a Connecticut official. It uses a real employee’s name, mentions a real state contract, and asks for a payment or document review. At a glance, it may look legitimate.
Connecticut’s Department of Administrative Services (DAS) issued a warning on September 25, 2026, about fraudulent emails impersonating DAS officials and procurement employees. Some messages referenced real contracts. Others impersonated the DAS commissioner and asked school districts to review a supposed business proposal.
In one reported example, the sender used an address ending in @das-ct.us and requested a “refundable” payment to remain on a contract. DAS says that domain is not an official state address. Official DAS email addresses end in @ct.gov, and DAS does not demand payment to keep a vendor on an existing contract.
The warning is especially relevant to Connecticut vendors, contractors, school districts, municipalities, and organizations that regularly communicate with government agencies. It also illustrates a broader lesson for every small business: a familiar name and realistic details do not prove that an email is genuine.
Why an impersonation email can look convincing
Scammers do not need access to a government email account to create a believable message. Names, job titles, contracts, meeting information, and vendor relationships may appear on public websites or in public records. A criminal can combine those details with a look-alike domain and a copied email signature.
Your inbox may emphasize the sender’s display name while making the full address less obvious. On a phone, that address can be hidden until you tap the sender details. A domain such as das-ct.us may look plausible when someone is busy, even though the official Connecticut government domain ends in ct.gov.
The message may then create a reason to act outside the normal process: a refundable fee, an urgent signature request, a revised bank account, or a document that supposedly must be opened immediately. The realistic background lowers suspicion; the unusual request is where the risk appears.
Five checks before replying, clicking, or paying
1. Expand the full sender address
Do not rely on the display name. Look at every character after the @ symbol. For DAS communications, the state says official addresses end in @ct.gov.
Be careful with domains that add words, substitute punctuation, or use a different ending. An address can contain “Connecticut,” “DAS,” or an employee’s real name and still belong to someone else.
2. Compare the request with the normal process
DAS says procurement opportunities are posted through official state procurement systems rather than distributed randomly by email. The agency also says it does not send unsolicited business proposals for review or signature and does not charge a fee during or after a contract award to maintain vendor status.
If a request changes the normal payment, bidding, signature, or contract process, treat that mismatch as a warning sign.
3. Verify through a separate channel
Do not use a phone number, link, or reply address supplied in the suspicious message. Contact the person through a number already in your records or locate the contract administrator through the official CTsource Contract Board.
This is sometimes called out-of-band verification: you confirm the request through a separate, trusted path. It is one of the most effective ways to stop invoice fraud and business-email impersonation.
4. Inspect links and attachments without opening them
On a computer, hovering over a link may reveal its destination. On a phone, press and hold carefully to preview the address without opening it. If the destination does not belong to an expected official service, stop.
Unexpected signature requests, shared documents, compressed files, and invoices deserve the same caution. A legitimate-looking document can lead to a fake Microsoft sign-in page designed to steal an email password.
5. Slow down payment and account changes
Require a second person to approve unusual payments, changes to vendor banking information, or urgent requests involving contracts. Confirm financial changes using a known telephone number—not the contact information in the email requesting the change.
A brief delay is far less costly than sending money to the wrong account.
What to do if someone already interacted with the message
If an employee clicked a link but did not enter information, close the page and notify the person responsible for technology or security. Preserve the email so it can be reviewed; do not forward it broadly with active links.
If a password was entered on a suspicious page, change it immediately from a trusted device, sign out other sessions, and enable multifactor authentication. If that password was reused anywhere else, change those accounts too. Review email forwarding rules and recovery information, since attackers sometimes add a hidden rule to monitor future messages.
If money or banking information was sent, contact the financial institution immediately and ask about stopping or recalling the transaction. Notify the real organization through verified contact information. Depending on the incident, reporting may also be appropriate through the FTC’s ReportFraud.gov or the FBI’s Internet Crime Complaint Center at IC3.gov.
A safer process for Connecticut organizations
Technology filters help, but business procedure is just as important. Connecticut organizations can reduce risk by:
- Requiring multifactor authentication for business email and financial accounts.
- Limiting who can approve payments or change vendor records.
- Using two-person approval for new payment destinations.
- Training employees to expand sender addresses on both computers and phones.
- Maintaining a trusted contact list for important vendors and government partners.
- Reviewing domain-protection settings such as SPF, DKIM, and DMARC with an IT provider.
- Creating a simple internal method for reporting suspicious messages without embarrassment or delay.
The goal is not to make employees afraid of every message. It is to make verification routine whenever an email asks for money, credentials, signatures, or a change to an established process.
Lyme PC Repair helps Connecticut Shoreline businesses strengthen email security, multifactor authentication, account access, employee procedures, and recovery planning. If your organization received a suspicious message—or wants to reduce the chance that one succeeds—we can help review the technology and the process around it.
Sources
- Connecticut Department of Administrative Services, “Scam Emails Impersonating DAS Officials and Employees,” published September 25, 2026: Read source
- Connecticut Department of Administrative Services, “Supplier Security and Fraud Awareness”: Read source
- Connecticut Department of Administrative Services, Procurement Programs and Services: Read source
- Federal Trade Commission, ReportFraud.gov: Read source
- FBI Internet Crime Complaint Center: Read source