Headlines & History since 1879 Goldendale, Washington
WEDNESDAY, JULY 1, 2026
Vol. 147 No. 26
$1.00
Fake ‘government agency’ email scam hits county
Klickitat County Emergency Management
Lou Marzeles Editor A scam both highly sophisticated and impossibly stupid is targeting Klickitat County property owners. It falsely identifies the executive director of the Columbia River Gorge Commission as head of Klickitat County’s Planning Department and attempts to steer recipients toward paying permit fees by wire transfer. The fraudulent email, which recently surfaced in the county, claims that a land-use application in the Gorge has been reviewed and is ready for approval. Before the approval can be finalized, however, the recipient is told to request wire-transfer instructions to pay a specific fee. “To proceed with final review administration and to streamline the approval process,” the lengthy email reads in part, “you are hereby requested to settle the attached invoice, which covers the Application Review and Approval Fee associated with your application. Payment of this fee is required before the County can conclude final processing steps, confirm administrative clearance, and move the matter toward formal approval completion. “Please note that this fee is an essential component of the application management process and supports several stages of
review, coordination, and decision-making associated with your file,” the email continues. It then goes on to identify seven different stages of the application process in great detail. The problem is that virtually every part of the document’s “official” identity falls apart under the slightest scrutiny. The email purports to come from Klickitat County Planning and Development, but it is “signed” with the name of Columbia River Gorge Commission Executive Director Krystyna Wolniakowski. The Commission is an interstate agency that helps administer the Columbia River Gorge National Scenic Area. It is not part of Klickitat County government and does not collect county permit fees. Ironically, Wolniakowski herself identified the fraudulent email after learning that her name had been appropriated by the scammers. Despite its seeming sophistication, the email includes an amazingly moronic mistake. While it lists Wolniakowski as the head of “Klickitat County Planning and Development”—a position she does not hold—it provides an address for her in Lawrenceville, Georgia, even as it claims to represent a Washington county agency. Those contradictions alone are enough to expose the fraud. Yet what makes the scam notable is how convincing much of it appears at first glance.
The email is written in surprisingly credible, polished bureaucratic language and includes lengthy descriptions of planning procedures, technical reviews, GIS systems, public hearings, site inspections, and administrative processing. It references rebuilding a home and barn, Scenic Area compliance, and other details that closely resemble legitimate land-use correspondence. Whether produced by an experienced scammer, artificial intelligence, or both, the result is a document that looks remarkably official—until its factual errors begin to accumulate. Among the most significant warning signs is the payment method. Rather than directing applicants to a county office or official payment portal, recipients are instructed to reply by email to obtain wire-transfer instructions and then email back proof of payment. Government agencies rarely, if ever, collect permit fees in that manner. The email also instructs recipients to conduct all communication exclusively by email, another common tactic used in business-email compromise schemes to discourage victims from contacting legitimate government offices. Residents who receive unexpected correspondence regarding permit fees should independently verify the request
See Scam page B1
Was this mysterious Amazon email for real? Lou Marzeles Editor What first appeared to be an ordinary phishing email may instead represent something more unusual: the apparent abuse of a legitimate Amazon email system. The email arrived Monday in The Goldendale Sentinel’s inbox and immediately raised suspicions. It purported to be an Amazon Family invitation but opened with a bizarre greeting: “Hello Account Critical Alert Call Now: (808) 278-6167.” It also referred to a password reset code and an unfamiliar email address, language that closely resembles the style commonly used in phishing scams. The rest of the message was: “We have sent Password Reset Code - XcMeWaZu (arisolid@ sparkcortex.net) an invitation to join Amazon Family. You are on your way to sharing Amazon benefits! Password Reset Code - XcMeWaZu will have 14 days to accept your invitation. Once Password Reset Code XcMeWaZu accepts, you will be able to share digital content and Amazon Photos storage and can also manage child profiles together. To manage your Family sharing settings and resend or cancel your invitation, please visit Manage Your Amazon Family.” The last four words also were a hotlink to a website. We did not click on it. Initially, the message seemed destined for the trash. But a closer examination of the message’s technical headers told a different story.
We reviewed the raw email source, including the internet routing and authentication information that accompanies every email. Those records indicate the message successfully passed Amazon’s normal security checks, including SPF, DKIM, and DMARC authentication—the three principal technologies used to verify that an email actually originated from the company it claims to represent. In other words, the message appears to have been genuinely sent by Amazon’s own email infrastructure. That finding raises a different question. If the message itself is authentic, why does it contain language urging recipients to call a telephone number that does not belong to Amazon? The technical records reveal another surprise. The email was not originally addressed to The Sentinel at all. Instead, Amazon sent it to a Gmail account with the address: a01033631334@ gmail.com. From there, according to the email headers, it was forwarded through what appears to be a Proton Mail group before passing through a Microsoft 365 tenant and ultimately arriving at the Sentinel’s email address. Why it followed that route remains unknown. Another possibility emerged after examining the message itself. The suspicious wording appears in the greeting rather than in the body of the email. One possible explanation is that whoever initiated the Amazon
Family invitation may have entered malicious text into a field intended for the recipient’s name. If Amazon’s system automatically inserts that field into the greeting without validating its contents, the company could unknowingly generate an email that is technically authentic but contains deceptive, user-supplied language. There is currently no evidence that this is what occurred. It is one possible explanation consistent with the available evidence. If that hypothesis proves correct, the issue would not involve a forged Amazon email but rather the misuse of a legitimate Amazon service. Cybersecurity experts have increasingly warned that criminals are shifting away from easily detected fake emails and instead are attempting to exploit trusted platforms to lend credibility to fraudulent messages. Whether that is what happened here remains an open question. The Sentinel has contacted Amazon for an explanation of how this email was generated, whether the company is aware of similar incidents, and whether safeguards exist to prevent deceptive information from being inserted into legitimate customer communications. As of press time, no response has been received. Consumers should remember that even an email from a trusted company should be read carefully. Authenticity of the sender does not guarantee that every piece of information contained within the message deserves to be trusted.
AT ITS PEAK: This map showed evacuation levels for the Lyle Fire on Sunday.
Lyle Fire investigators seek photos, video from before blaze Lou Marzeles Editor What began as a rapidly growing wildfire that sent residents fleeing their homes has taken several unexpected turns as investigators continue trying to determine what sparked the Lyle Hill Fire above Lyle. The fire, first reported shortly after 2:30 p.m. Sunday, prompted Level 3 “Go Now” evacuation orders as flames raced through dry vegetation on the hills overlooking the Columbia River. Early reports estimated the fire at approximately 450 acres, with some aerial estimates placing it as high as 1,500 acres. But after firefighters were able to map the burn perimeter more accurately, officials revised the fire’s size downward to 233 acres. Fire officials said the earlier estimates were made from aircraft flying through heavy smoke, making it difficult to distinguish the actual burn area from smoke columns. While it is common for acreage estimates to increase as mapping improves, it is relatively unusual for a wildfire’s reported size to shrink so dramatically. Despite concerns that ap-
proximately 75 structures were threatened, firefighters prevented the blaze from reaching homes. As of Monday evening, no structural losses had been reported. The improving outlook allowed Klickitat County Emergency Management to downgrade all remaining Level 3 evacuation orders to Level 2, while portions of the western evacuation area were further reduced to Level 1. Temporary evacuation centers in Goldendale and Lyle, along with the shelter at Columbia High School in White Salmon, have since closed, although Centerville Road remains closed while firefighting crews continue mop-up operations. The fire also affected portions of the Lyle Cherry Orchard Preserve, which has been closed indefinitely while officials assess damage. Meanwhile, the investigation into the fire’s origin has taken an intriguing turn. The Washington Department of Natural Resources and Lyle Fire & Rescue are asking anyone who took photographs or video in the area between 1:40 p.m. and 1:55 p.m. Sunday to contact investigators. Officials are also
See Fire page B1
Frantz: jail is no place for mentally ill Rodger Nichols For The Sentinel
It was a mixed bag of messages coming out of the June 23 Klickitat County Commissioners meeting. In the morning workshop session, commissioners heard that work had been completed on the Forest Road bridge, the first of six the county was required to update this summer. Jail Administrator Bill Frantz had some positive things to say about his staff and called the new meals excellent. As a bonus, the outside contractors free up time for the staff and reduce the county’s liability. But, he said, jails have become the dumping grounds for people with mental health problems. He cited one recent resident who suffered from dementia and was not capable of basic self care. “In fact,” he said, “you could smell the infections they had on their skin from outside the tier. Jail—our jail, specifically—is not the place for that person to reside. It is becoming more and more common for us to have those people with severe mental and medical illnesses that our jail doesn’t have the resources to maintain.” Budget tightening at the state level is hitting even deeper into funding for public health depart-
ment programs, as Public Health Director Erinn Quinn reported the state had determined the county needed to return $147,000 from specific programs. “After the $147,000 they dictated we give back,” she said, “they asked me to choose another $233,000 and report where those came from.” She said a conference of state public health officials was told that, conservatively, the state expected an additional $8 billion shortfall next year that would impact local funding next year. “So I’m absolutely anticipating going through this same exercise in a year.” Programs impacted by the cuts include immunization, emergency preparedness, and wildfire work. On a positive note, Goldendale Mayor Dave Jones reported on a big upcoming celebration. “I just wanted to take the opportunity to invite you, July 10 and 11th, to the 100th annual Goldendale Community Days,” he told commissioners, “in this, the 250th year of our country.” He noted the event started with a world record burnout attempt at the intersection of Columbus and Railroad. “We’ve become a little famous for some of our hillbilly antics,” he added.
See County page B1