CHARLESTON, W.Va. -- West Virginia should not have to repay two companies that lost nearly $2 million in a corporate identity-theft scheme, state Auditor Glen Gainer said Monday.

Federal and state authorities are investigating the scam, where someone diverted payments intended for two firms that contract with the state's Insurance Commission and Department of Health and Human Resources to an unauthorized bank account.

At a news conference Monday, Gainer said the state has not lost any money because it acted in good faith when it paid the companies.

"My position is, the vendors are the ones who are out," he said. "We're not paying the vendors again."

The state made the payments in March and April, after the perpetrator sent letters allegedly from the two companies requesting that payments be sent to new bank accounts. The letters included all documentation required for payment, including tax identification numbers.

Neither of the companies whose information was stolen is accused of any wrongdoing.

"Theft occurred. Collusion occurred. Forgery occurred," Gainer said.

On April 22, one of the vendor's banks contacted Gainer's office to say there was a possible problem, he said. On April 29, the other vendor's bank contacted the office saying fraud might have occurred.

Two payments intended for one of the companies were diverted overseas, Gainer said -- and the money could end up in terrorists' hands.

"The thing about identity theft in general is, many times these funds are diverted to terrorist organizations," he said. "We do know that when you get into the realm of identity theft, a lot of times that's the way terrorist organizations fund themselves."

Gainer repeatedly emphasized that his staff had followed all national standards when they processed the payments.

"My staff, in all aspects, has acted professionally," he said. "They have done nothing wrong."

It is not unusual for vendors to ask for their account information to be changed, Gainer said. They must submit proper documentation, but national standards do not dictate that the state must call firms to verify those changes.

"For us to go back and make thousands and thousands [of phone calls], I don't have the staff to do that," he said.

One of the companies has been a victim of a similar scheme in four other states, Gainer said.

"There are many other states that have been the victims of this kind of fraud," he said, mentioning Florida, North Carolina, Massachusetts and Maine.

Gainer has declined to name the companies or banks involved.

On Monday, a spokesman for New York-based Deloitte Services, a consulting firm that contracts with DHHR, confirmed it is one of the companies.

"We are aware of the situation and are working with federal and state authorities," spokesman Daniel Mucisko wrote in an e-mail to the Gazette.

The state last paid Deloitte on April 27, in the sum of $919,916, according to state records.

Last week, Sedgwick CMS, a Memphis-based company that serves as a third-party administrator for the state Insurance Commission, also confirmed it was involved.

On Friday, Gainer told the Gazette that "in excess of $1 million" had been stolen. Further internal investigation showed that three payments totaling almost $1,999,000 had been diverted, he said Monday.

Last week, someone also tried to steal payments intended for a third vendor, but was unsuccessful.

The office is examining all payments where account changes were requested going back to Sept. 1, 2008. It is also going over internal procedures.

"We are going to review our standards and make them tougher than the national standards," he said.

The office is working with federal and state authorities to seek restitution for the companies, Gainer said.

"They still have an opportunity there to catch this person," he said.

Reach Alison Knezevich at alis...@wvgazette.com or 304-348-1240.