Business Email Scam That Cost Mobile $14.7 Million Now Targeting Alabama Companies, BBB Warns

The BBB of Central and South Alabama says the same business email scam that cost Mobile $14.7 million nearly took $785,000 from a Mobile construction firm, and it is urging businesses to verify every payment change by phone.

By James Bullard

October 30, 2026 · 7:22 am 8 min read

Alabama businesses are being warned about email scams that impersonate trusted vendors to redirect payments.

MOBILE, Ala. — The same business email scam that cost the City of Mobile $14.7 million is now turning up in the inboxes of Alabama companies, and one Mobile construction firm came within a single decision of losing $785,000 to it. The Better Business Bureau of Central and South Alabama issued a warning Thursday, Oct. 29, urging businesses and local governments across the state to rethink how they pay their bills and how they get paid.

“Our goal is simple: we don’t want another Alabama business to be next,” said Evey Owen, vice president at the BBB of Central and South Alabama. “Before you pay any invoice that comes with payment changes, you should stop, pick up the phone and call the vendor at a number you already know. That one phone call can stop this scam in its tracks.”

The warning comes as the FBI and the U.S. Secret Service investigate the Mobile loss, and as investigators and former agents describe a sharp rise in schemes in which criminals impersonate trusted vendors to redirect payments into accounts they control.

A near miss on a Montgomery job site

According to the BBB, a contractor building a commercial property in Montgomery recently received an email that appeared to come from a Mobile-based construction company working on the same project. The message asked that the Mobile company’s $785,000 payment be sent electronically.

Nothing about the email looked suspicious. Owen said it was not a near copy of the real thing; it matched the name of an actual employee and the company’s email domain exactly. The Mobile business has asked not to be identified.

What saved the money was timing. The lead contractor turned down the request because it had just mailed the Mobile company a physical check.

Owen said the attempt is “eerily similar” to the fraud that cost the city, which sent its payment to what it believed was the bank account of the contractor building Regions Arena.

“It’s not as large as what the city lost, of course, but it does seem like scammers are targeting these large construction projects,” she said.

She said the old advice about spotting a fake email no longer goes far enough.

“That used to be the way that we could protect ourselves,” Owen said. “You check the link. You check the email. There’s usually an extra period or a misspelling. Unfortunately, the scammers have so much technology at their fingertips now that they can spoof it exactly. They can do the same thing with phone numbers, too.”

The Mobile firm is not the only near miss. A Huntsville company was also recently targeted by a similar vendor scam, but it checked before paying more than $350,000 and discovered that the business requesting the money was not under contract with it. Two other local businesses have suffered financial losses from identical schemes, according to reports on the recent attempts, and similar vendor-impersonation and payment-redirect schemes have targeted other Alabama businesses and utilities.

How the Mobile loss happened

The city’s case shows how patient these schemes can be. According to the BBB, the fraudster contacted city officials in May, built trust over months while posing as a vendor connected to the Regions Arena construction, and by October those communications ended in the fraudulent transfer of $14.7 million.

City officials have said the impostor posed as a representative of the arena’s general contractor and persuaded the city’s finance department to change the company’s banking information, so that a routine construction payment went to an account the criminals controlled. One finance department employee has been fired and two others placed on leave while investigations continue. The mayor has said the city’s computer systems were not hacked and that the scheme relied on emails, documents and phone calls rather than malicious software.

Mayor Spiro Cheriogotis said this week that the city has tightened its verification process since the loss. He described one idea he picked up from the FBI: giving vendors a list of code words in advance.

“One of my favorite suggestions yesterday by the FBI is it’s almost like you have a code sheet that you send to any of your vendors, and you say, ‘OK, well, just to verify that this is true, tell me the word that you have listed on number 47 out of 50,’” the mayor said.

What business email compromise is

The BBB describes business email compromise, often shortened to BEC, as a scam in which criminals pose as someone a business already trusts, such as a vendor or a company leader, to get a payment sent to an account they control.

“It doesn’t need a virus, a bad link or ransomware – just research, patience, enough details to convince one person and a payment change that never gets verified,” the bureau said.

The losses are enormous. According to the FBI’s Internet Crime Complaint Center, business email compromise was the second-costliest type of scam reported in 2025, with 24,768 complaints and more than $3 billion in losses. The FBI says vendor scams have risen sharply over the past five years and continue to involve millions of dollars in fraud.

Large construction projects appear to be a favorite target. Some criminals do extensive research on businesses that have recently won big bids on projects such as a new arena, hospital or school. Those job sites typically involve dozens of subcontractors, many of whom hire their own subcontractors, creating a long chain of invoices and payments that can be hard to keep track of.

In some cases, the fake vendors ask for a change in the payment schedule. In others, they ask to switch from a paper check to a wire transfer, or to send money to a different bank account. Because paying large invoices electronically is routine for many companies, an employee who does not fully vet the sender can approve the change without realizing anything is wrong.

Schemes like these are both state and federal crimes and are often prosecuted in federal court.

Training has to keep up

Darren Mott, a Huntsville-based consultant and former FBI agent, said organizations have to keep pace with fraud tactics that change quickly. He said cities like Mobile need to update and deliver employee training on a constant basis.

“It has to be regular,” Mott said. “And you have to pay attention to the actions happening in your industry. So in this case, there should be someone reading intelligence reports about what bad actors are doing to municipalities.”

Owen said the core lesson is that an email by itself cannot be trusted. When a customer or vendor sends an email asking for a change in procedure, she said, someone needs to pick up the phone, using a preapproved number rather than one listed in the email.

“One of the best protections for your business is just having a culture of verification – over-verification,” she said.

Retired agent Tony Fusco recommended three safeguards for companies that pay vendors:

Assign one person to oversee each vendor, which reduces the chance of miscommunication.
Insist on communicating with only one representative at the vendor.
Accept changes to payment methods only through hard-copy written notification.

BBB: How to protect your business

The BBB is urging every business and municipality to review how it sends and receives money. Its recommendations include:

Verify every payment change by phone. Call the vendor at a number you already have on file, never one provided in the email.
Build a culture of verification. Train employees regularly on your approval process and on trending scams.
Require more than one approval. Use a multi-person approval process for large payments.
Lock down email. Turn on multi-factor authentication for email accounts.
Tell your customers. Let customers know they should never change your payment details based on an email and should always call you directly to confirm.

Multi-factor authentication requires a second step, such as a code sent to a phone or generated by an app, before someone can sign in to an account. It makes it far harder for a criminal who has stolen or guessed a password to take over a real employee’s mailbox and send messages from it.

The advice about telling customers addresses the other side of the scam. In the Montgomery case, the criminals did not impersonate the company that was paying; they impersonated the company that was getting paid. A business can do everything right with its own bills and still see its customers’ payments stolen if those customers act on a fake email in its name.

What to do if it happens

Speed matters. Mobile’s own experience shows why: in August, a separate fraudulent payment of just under $1 million was caught within days, and the city was able to recover the money. The $14.7 million payment, by contrast, was not discovered for two weeks. If a payment has gone to a scammer, the BBB recommends:

Call your bank immediately and ask it to recall the funds. Time is of the essence.
File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov, regardless of the amount lost, and include full transaction details.
Report it to local police. Especially if you have lost money, a police report can support your bank’s efforts.
Let the BBB know by filing a report with BBB Scam Tracker so the bureau can warn others.

Owen also urged businesses that have been victimized to report the crime to their banks, local police and the Internet Crime Complaint Center.

What comes next

The FBI and the Secret Service are continuing to investigate the Mobile loss. The Mobile City Council has scheduled Finance Committee meetings for Nov. 3 and Nov. 17 to keep seeking answers about how the city’s payment was diverted and what safeguards are being put in place.

For businesses, the BBB’s message is simpler. Any request to change where money goes, no matter how legitimate the email looks, should be treated as a reason to stop and make a phone call to a number you already trust.