Article
An Iowa City Nearly Lost $655,000 Because the Amount Matched
A city clerk in Iowa received an email invoice that matched, almost to the dollar, what the city expected to pay a contractor on a public works project. The city nearly paid it. It only caught the fraud because the real contractor called asking why their invoice hadn't been paid, at which point the city realized it had already sent money to someone else entirely. Iowa State Auditor Rob Sand issued an advisory on October 28, 2026 warning local governments that this case put $655,000 at risk, and that a dollar amount matching your expectations is not proof an invoice is real.
What happened in the Iowa invoice scam, in plain terms
According to the Auditor's office, a city clerk reported receiving a fraudulent email requesting electronic payment for an invoice. The invoice appeared legitimate and matched the amount the city expected to pay for a public works project. The city paid it, or was far enough into paying it, that the loss exposure reached $655,000. The scam surfaced when the authorized contractor contacted the city asking to be paid.
A separate payment of $211,000, sent to the same fraudulent account, was recovered by the city's financial institution. The city filed an insurance claim, notified law enforcement, and is putting additional safeguards in place. Sand's office didn't name the city, but noted it's the second fake-email scam targeting an Iowa local government reported to his office in less than a month.
This is not a story about a careless clerk. It's a story about a control that most AP teams, public and private, still run: if the number on the invoice looks right, the invoice must be right.
Why does a matching dollar amount feel like proof an invoice is legitimate?
Because it's the easiest thing to check, and it's usually correct. Most invoice errors show up as a wrong amount - a transposed digit, a double-billed line, a rate that doesn't match the contract. So AP teams learn, reasonably, that if the total ties out to what was budgeted or quoted, the invoice has probably cleared its biggest risk.
But that logic only works against accidental errors. It does nothing against an invoice built on purpose to match. A scammer who knows (or estimates closely) what a city, or any organization, is paying for a specific project doesn't need to guess a number - they need to copy one, or get close enough that nobody stops to look twice. Public works budgets, awarded bid amounts, and contract values are frequently public information for government entities, which is exactly the kind of number a fraudulent invoice can be built around. For a private company, the same gap opens whenever a scammer can see or infer an existing bill - a prior invoice, a contract total, a running project budget.
An amount match answers "is this the number we expected?" It never answers "is this invoice from the vendor we actually hired, for the work we actually agreed to?" Those are different questions, and only the second one stops this kind of fraud.
What does the Iowa case teach about amount-only invoice checks?
Most AP processes run one of a few checks before a payment goes out, and each one confirms less than people assume. Here's where amount matching sits on that ladder, and why the Iowa invoice sailed through every check except the one that was never run.
| Check | What it confirms | What it misses |
|---|---|---|
| Amount matching | The total matches a budget or expectation | Whether the invoice came from the real vendor at all |
| PO matching (2-way) | The invoice ties to an open purchase order | Whether the PO itself was built on legitimate terms, or whether the vendor identity and payment details are genuine |
| 3-way matching | Invoice, PO, and receipt of goods/services all agree | Rate-card violations, scope creep, and fraud signals like a changed bank account - 3-way matching checks quantities and totals, not the underlying agreement |
| Agreement-level matching | The invoice ties to the specific contract, SOW, or rate card that was signed, with the vendor identity and payment details verified against it | Nothing structural - this is the check built to catch exactly what the others don't |
The Iowa city didn't have a purchase order on file to compare against, and most services firms paying subcontractors on a statement of work or rate card are in the same position: there's rarely a formal PO for everything they buy. Without one, amount matching becomes the de facto control, which is precisely the control this scam was built to beat.
Amount-only checks don't just miss fraud, they miss ordinary errors too. Even at top-performing organizations, duplicate or erroneous payments still account for about 0.8% of annual disbursements, rising to roughly 2% at bottom-quartile performers, according to APQC's Open Standards Benchmarking research on accounts payable. A control built only to confirm a number looks right was never going to catch what it isn't designed to look for.
What's the one verification step most AP teams skip?
Confirming payment details out of band. Sand's advisory recommends that when an email requests a change to bank or routing information, employees call the vendor or individual using a phone number already on file, not a number in the email, to verify the request before paying it. Replying to the suspicious email just puts you back in contact with the scammer. He also recommends notifying vendors when a payment is sent, and asking them to confirm they received it - which is exactly how this case surfaced.
This step gets skipped for a simple reason: it's friction, and most invoices are legitimate, so the habit of calling to verify never forms. It's also inconsistently applied - teams that are vigilant about a first-time vendor often wave through a "regular" one, even when the payment details just changed. A recent survey found only 18% of finance teams continuously revalidate vendor bank details rather than checking once at onboarding and never again, which is the exact gap a bank-account swap exploits.
What does it mean to check an invoice against the agreement, not just the number?
It means the invoice has to trace back to something real before its amount matters at all: a specific contract, statement of work, or rate card that your organization actually signed, with a vendor identity and payment account that match what's on file for that agreement. If an invoice can't point to a real, existing agreement, the amount on it is irrelevant - it doesn't matter whether it's $655,000 or $65. No signed agreement, no payment.
This is a different question from "does the PO exist," because plenty of legitimate spend, especially at services firms paying subcontractors on T&M and rate-card terms, never gets a PO at all. The agreement itself - the MSA, the SOW, the rate card - is the thing to check against. That's a broader, slower check than comparing two numbers, but it's the one that actually answers whether the invoice belongs to a real transaction.
What does the State Auditor's advice cover, and what does it leave out?
Sand's advisory is specific and useful as far as it goes: verify bank-detail changes by phone using a known number, notify vendors of payments and ask for confirmation, watch for odd wording or email addresses, and report suspected theft immediately under Iowa law, which requires governmental entities to notify the Auditor's office of significant financial irregularities. All of that is sound, and it would have caught this scam at the moment the payment account looked unfamiliar.
What it doesn't cover is the step before that: confirming the invoice ties back to a real, existing agreement in the first place. "Call to verify" is a response to a specific red flag - a changed account, an urgent request. It depends on someone noticing the flag. Checking every invoice against the signed agreement behind it catches cases where there's no obvious red flag at all - where the amount matches, the vendor name looks right, and nothing about the email itself seems off, because the fraud is in what the invoice claims to be for, not in how it's worded.
This isn't a criticism of the advisory. It's a reminder that phone verification is one layer, not the whole system. Business email compromise, the broader category this scam belongs to, cost US organizations $3.05 billion across 24,768 reported complaints in 2025, according to the FBI's Internet Crime Complaint Center, and most of that is still invoice and payment-redirect fraud, not technical hacking. A single verification habit rarely closes a gap that size; it takes a layered check that doesn't rely on someone remembering to make a call.
A short checklist for any invoice that asks you to change where money goes
- Never use contact information from the email itself to verify a change. Call a number you already had on file before the email arrived.
- Confirm the invoice ties to a specific, existing contract, SOW, or PO - not just an amount that looks about right.
- Check whether the payment account matches what's on file for that vendor, and flag any change for a second person to confirm.
- Notify the vendor separately, through an established channel, when you do send payment, and ask them to confirm receipt.
- Treat "the amount matches what we budgeted" as a reason to look closer, not a reason to stop looking. Fraud built to match is still fraud.
- Report anything suspicious to your bank immediately - the Iowa city's financial institution recovered $211,000 because it was flagged fast.
None of this requires replacing the person who reviews invoices. It requires giving them a way to check the agreement behind an invoice, not just its total, before it ever reaches the point of a phone call. That's the layer most AP processes, public or private, still don't have - and it's the one that would have stopped this invoice before the amount ever got compared to anything.