Article
After a $14.7M City Scam, Alabama Businesses Are Being Hit the Same Way
A fraudster posed as a construction vendor for months, then redirected a single $14.7 million wire transfer meant for Mobile, Alabama's Regions Arena project. Weeks later, the Better Business Bureau confirmed the same scheme had nearly cost a private Alabama business more than $750,000. The pattern is now documented, not theoretical: business email compromise (BEC) scams that start with a trusted vendor relationship and end with a changed bank account are moving from one large public incident into a string of attempts on ordinary companies.
What happened in the Mobile, Alabama scam?
According to 1819 News, a fraudster first contacted City of Mobile officials in May, posing as a representative of the contractor building the $300 million Regions Arena. Over several months the scammer built a convincing rapport with city finance staff before asking that a payment be redirected to a new account. The city sent the money, and it did not reach the real contractor, B.L. Harbert.
ENR reported that Mobile had to pull roughly $15 million from the arena project's owner contingency fund to pay B.L. Harbert a second time, money that otherwise would have gone toward paying down arena debt or other project costs. The fallout inside city government was real: one finance department employee was fired and two others were placed on leave, according to NBC 15's timeline of the fraud.
What makes this case instructive for any AP team, not just a municipality, is how ordinary the mechanics were. There was no hack of the city's bank or accounting system. The scam worked because a human being who sounded, wrote, and acted like the real vendor asked for a change in where money should go, and someone approved it.
Why is the same scam now spreading to private businesses?
Once a scheme works against one target, it gets reused, and the Mobile case is a visible proof of concept that fraud crews are now applying against businesses in the same region. The BBB of Central Alabama issued its warning after documenting at least one additional near-miss, and a separate report found three Mobile-area businesses tied to construction work were targeted with the identical approach: an email arriving mid-relationship that says, in effect, "we're changing our payment account this time."
This fits a broader trend. Business email compromise was the second-costliest category of cybercrime reported to the FBI's Internet Crime Complaint Center in 2025, behind only investment fraud. Construction and services firms are attractive targets precisely because they pay large invoices to subcontractors and vendors on a recurring basis, and because those relationships often involve exactly the kind of mid-project changes (new project manager, new accounts receivable contact, new bank) that make a fraudulent change request plausible.
Is "call the vendor to verify" enough to stop this?
No. Calling a known number to confirm a bank-detail change is necessary, but on its own it is not sufficient, because the hard part of this scam is knowing which number is actually "known." In the Fox10 report on a separate Mobile company that narrowly avoided a similar loss, the business employee who caught the fraud described how closely the fake matched the real vendor: the name was right, the email looked right, and only chance, not process, is what stopped the payment.
A verification call is only as reliable as the number dialed. If that number comes from the same email thread that is making the change request, or from a signature block the fraudster controls, the call confirms nothing. A real control needs a second, independent source of truth for vendor contact details: a number pulled from the original signed contract, an existing accounting record, or a prior invoice that predates the suspicious request, not from the email asking for the change.
What separates an altered invoice from a legitimate one on paper?
Often, nothing is visibly "wrong" with the document itself. The invoice amount can match the agreed scope, the vendor name and logo can be correct, and the formatting can be identical to twenty previous invoices from the same vendor. What changes is one line most reviewers do not cross-check against anything: the bank account or routing number.
This is why document review alone misses these scams. A convincing fake invoice does not need forged letterhead. It needs the AP team to not notice that payment instructions differ from what is on file, or to accept a "payment account update" email as reason enough to change the record before the next invoice is paid. Quittance's writeup on the Barbara Corcoran invoice scam covers a similar case where the paperwork looked ordinary and the bank account was the only thing that moved.
Where should a bank-detail change get caught before a payment goes out?
The change needs to be caught before it reaches the point of payment, which means building a checkpoint specifically for payment-instruction changes, separate from normal invoice approval. Most AP breakdowns on this type of fraud happen at one of three points:
- Intake. The change request arrives by email and gets filed straight into the vendor record with no second check, because it looks like routine vendor housekeeping.
- Approval. The invoice that follows gets routed for approval based on amount and coding, and nobody on the approval chain is specifically responsible for checking whether payment instructions changed since the last invoice.
- Payment. The payment run executes against whatever account is currently on file, with no flag raised that the account differs from the account used on the last several payments to the same vendor.
A surprisingly small number of firms treat bank-detail changes with the scrutiny the Mobile case suggests they deserve. A related gap shows up across the industry: in a survey covered in Quittance's analysis of vendor bank-detail revalidation, most finance teams do not have a standing process to periodically re-confirm vendor payment details independent of whatever a vendor emails them.
What should a payment verification checklist cover?
| Control point | Call-back alone | Call-back + segregation of duties | Agreement-aware verification |
|---|---|---|---|
| Confirms the number dialed is legitimate | No - relies on number in the request | Yes, if sourced from an independent record | Yes, sourced from the signed agreement on file |
| Catches a bank change mid-project | Sometimes | Usually | Checks the change against the vendor record every time, not just once |
| Requires a second approver before the account updates | No | Yes | Yes, built into the workflow |
| Flags an invoice citing terms not in the contract or SOW | No | No | Yes |
| Works when the fraudster's email and signature look exact | Unreliable | Better, but depends on staff discipline | Better, because it does not rely on recognizing a "look" |
A workable checklist for any invoice carrying new payment instructions:
- Treat any change to bank account, routing number, or payment method as a standalone event requiring verification, separate from approving the invoice amount.
- Verify using contact information pulled from the signed contract or a prior, undisputed invoice, never from the email making the request.
- Require a second person, not the original requester or approver, to confirm the change before it is entered into the accounting system.
- Hold the next payment to that vendor until the change is confirmed, rather than processing it on the old timeline.
- Keep a record of who approved the change and how it was verified, in case the vendor later disputes receiving the payment.
Does company size change the risk?
No. The City of Mobile lost money at municipal scale, but the mechanism that worked against it, a vendor relationship built over time followed by a plausible request to redirect payment, works identically against a ten-person agency or a two-hundred-person services firm. If anything, smaller finance teams are more exposed, because fewer people touch each payment and there is often no one whose job is specifically to question a vendor's "updated" bank details.
None of this requires replacing the person who handles AP today. The goal is to absorb this specific check into the existing process before the next hire, not to remove the human who approves the payment. A verification step that catches a changed bank account before the wire goes out is worth building regardless of whether a company has five invoices a month or five hundred.
FAQ
What is business email compromise (BEC) fraud? Business email compromise is a scam in which a criminal impersonates or compromises a trusted email contact, often a vendor or executive, to convince a business employee to send a payment or change payment details. The FBI tracks it as one of the costliest categories of reported cybercrime.
How did the City of Mobile lose $14.7 million? A fraudster posed as a representative of the contractor building Mobile's Regions Arena, built a relationship with city finance staff starting in May, and then requested that a scheduled $14.7 million payment be sent to a different account.
Is calling a vendor to confirm a bank change enough to prevent this scam? Not on its own. A call-back only works if the number dialed comes from an independent, trusted source, such as the signed contract, rather than from the same email thread requesting the change. If the fraudster supplies the "verification" number, the call confirms nothing.
Are small businesses really targeted by the same scam that hit a city? Yes. After the Mobile case became public, the Better Business Bureau documented a private Alabama business that nearly lost more than $750,000 to the identical scheme, and reporting identified multiple Mobile-area businesses targeted the same way.
What should a business do if a vendor emails to say their bank account changed? Do not update payment details based on the email alone. Confirm the change using contact information already on file, such as a number from the signed contract, require a second person to verify it, and hold any pending payment to that vendor until the change is confirmed.