After some research our contacts at the Forest Service were able to determine that it is an legit company hired by the USDA to verify if we (the "vendors") owe the government money. I have sent them what they requested and they have called to speak to my boss.
Rec'd another call from these people. Have declined to answer before (but they call twice a day for a week now) as we screen calls for all the "out of area" and non-recognized area code junk calls we get. They wanted our e-mail, said they were hired by the USDA to review accounts receivable. I asked her "because you cold call us I should believe you have anything to do with the USDA". She replies "oh, we have this e-mail to prove it". Gonna have to do better than that honey! Asked her what she was looking for. She indicated unapplied "cash". Told her the government doesn't pay in cash...everything by direct deposit and that was all the info she was getting from me. Again, she wanted my e-mail. Told her didn't know what country she lived in but in the good old US you'd have to be an idiot to give out info or e-mail contact to ANYONE that cold calls your business! Still insisted she needed info -- told her to mail me something.. UUGGGHHH!!!
I contacted my "contact" at USDA here locally that have worked with for years. Told her the story of this and she told me the government would never ask for something via a phone call or e-mail like this, they are not hired by the USDA, and she was glad we provided them with no information. Leaves the unanswered question though of "why are they doing this and what do they hope to learn?".
Information to help others in reporting what appears to be a social engineering approach to data exfiltration.
The domain USDAvendors.us is held by Gryphon Financial Group. See the whois lookup at:
http://www.whois.net/whois/usdavendors.us
The Administrative POC for the domain is listed as Denise Olson, and public records indicate her to be a *former* project manager with the company.
The website for Gryphon Financial Group is located at: http://www.gryphonfg.com/
As you will note, the website is "under reconstruction" as of 08/15/2014.
The phone number search also uncovers a reference to a sample letter on the Office of Information and Regulatory Affairs at the Office of Management and Budget.
The URL to sample document is:
http://www.reginfo.gov/public/do/DownloadDocument?documentID=405970&version=2
The address listed in the letter is 6221 S. Claiborne Avenue #637, New Orleans, LA 70125. This is a box in a UPS Store.
Performing a business entity search at the Louisiana Secretary of State website fails to locate a record for Gryphon Financial Group. It is not registered to do business within the State of Louisiana, and is thus not operating in compliance with the State laws.
FYI - Every Federal government contract I've entered into has included a requirement to comply with all federal, state and local laws. Failure to abide by such terms, if included, is grounds for civil action under the Civil False Claims Act (31 U.S.C. §§ 3729 - 3733) and criminal action for False Statements, Concealment (18 U.S.C. § 1001).
The DUNS number for Gryphon Financial Group, Inc. is 199535464. A search at USASpending.gov reveals a $0 contract with the USDA, number AG3142C130005 for services under 7030: ADP Software. The contract was issued by the USDA Office of the Chief Financial Officer for contract auditing services.
The problem with the caller is representing the entity to be the USDA when in fact it is a contractor company. This is a violation of Federal regulations and may be construed as fraud under State laws.
The follow up e-mail from the caller requests "a copy of an aged trial balance or a current statement of our account." Even in the e-mail, there is an assertion that the Vendor Compliance Office and the caller are with the USDA.
Until such time as this company can demonstrate a lawful requirement to divulge any requested information it is unwise to do so.