‘Charming’ Caller: Finance Director Details How Impostor Won Trust Before $14.7 Million Mobile Fraud
Finance Director Logan Gewin says the impostor behind the Mobile $14.7 million fraud spoke in a “charming” way, used a genuine invoice and kept staff talking for months before the October payment.
MOBILE, Ala. — The person who talked Mobile’s finance department out of $14.7 million did not sound like a stranger for long.
In an interview Friday afternoon, Oct. 30, Executive Director of Finance Logan Gewin offered his most detailed account yet of how an impostor posing as a contractor on Regions Arena built credibility with city staff. He described a native English speaker with a “charming” way of talking, and he said it was not “a deep Southern accent.” City officials said they could not share more about the person’s background or fully describe how he spoke.
What Gewin did lay out is a slow, patient approach that started with a routine-looking request in May and ended with a $14.7 million payment in October. The loss may be the largest publicly documented scheme of its kind against a U.S. city, and it is still being investigated by the FBI and the U.S. Secret Service.
A vendor inbox and a low-level reply
According to Gewin, the contact began sometime in May, when a man claiming to work for B.L. Harbert International, the company building the arena, reached out to the city’s finance department and asked to update Harbert’s contact and banking details.
The message arrived through an email address the city had set up specifically for vendor requests. An employee in the lower levels of the department responded, and the conversation continued from there by phone and email.
The impostor then offered a story that opened an important door: Harbert, he claimed, had lost some records tied to earlier arena payments. Gewin said a city employee responded by providing a legitimate Harbert invoice for reference. The fraudster used that real document to create other, fabricated paperwork that helped him appear even more convincing.
The length of the exchange turned into an asset of its own. When more senior staff eventually became involved, Gewin said, they could see what looked like a long and ordinary working relationship.
“The fact this conversation continued for a while, false as it was, the length of the conversation helped establish credibility because when people further up [in the finance department] jumped in, they could see a two-month conversation,” he said.
Why it took from May until October
Nearly five months passed between the first contact and the payment. Gewin said the delay happened because the impostor made several requests over time to change Harbert’s account information in the city’s system.
“The fraudster was trying to get the right account info,” he said.
Vendors regularly ask the city to update banking and other details, Gewin said, so the requests did not look especially strange as a group, although he acknowledged they should have stood out for this particular account.
The sequence he described looks like this:
- May: A man posing as a Harbert representative contacts the department through the vendor email address.
- Following months: Phone calls and emails continue, a genuine invoice is shared, and repeated requests are made to change Harbert’s account details.
- August: The city forwards the changed information to its banking partners, but the change comes too late to apply to the September payment to Harbert.
- September: The city sends the account change request again.
- October: The payment goes through. The city’s bank sends the money to an account the fraudster set up at another American bank.
It remains unclear whether that receiving account was opened in Harbert’s name or under another name. City officials said they cannot yet identify the banks involved. Officials said at the Oct. 27 council sessions that the payment request was submitted Oct. 2, and that the mayor and Gewin did not learn of the problem until Oct. 16, as detailed in the timeline they presented that day.
‘Errors in social judgment’
Gewin did not describe the loss as a technology failure. Mayor Spiro Cheriogotis has previously said the city’s IT systems were not compromised and that nobody clicked a bad link. Gewin framed it instead as a series of human misreads.
“Part of this problem is social cues in writing and phone calls were missed. There were errors in social judgment, no doubt,” he said. “Training is supposed to fix that, but, I mean, these people (the fraudsters) got very lucky.”
He also said the rules in place at the time should have been enough. If those policies had been followed strictly, Gewin said, the criminals would have been stopped.
An August warning that came too late for this case
The arena fraud was not the only attempt against the city this year. Cheriogotis disclosed at the Oct. 27 council meeting that the city nearly lost close to $1 million in another scam in August, weeks before the October transfer.
Gewin said that August incident had nothing to do with the arena and was a cyberattack with little in common with the Harbert scheme. It did prompt new account-verification policies, but those policies were not applied to the arena conversation that was already underway.
He said the August rules likely would have caught the scam if they had been in effect when it began in May. Gewin, who was hired in April after what the city described as an intensive national search, said he and his staff were already working on stricter procedures when the scam played out.
Before taking the job, Gewin said, he worked with municipalities on pensions and bonds and had long been interested in government.
A wider pattern nationally
Schemes like this one are commonly known as business email compromise, the label the mayor has used for the Mobile case. Criminals impersonate a trusted company or employee and try to redirect a legitimate payment.
The FBI’s Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion, up from about $2.77 billion the year before. The center advises organizations to verify requests involving payment changes and to report any incident quickly, because a fast report can reduce or eliminate a loss. The Better Business Bureau serving the Mobile area has warned that similar messages are now targeting Alabama companies.
That matters for any office that pays vendors. A common safeguard is to confirm banking changes by calling a known number already on file, rather than one supplied in the request itself.
Where things stand
An independent review is underway, alongside the federal criminal investigation. The city has fired one finance employee and placed two others on paid leave in connection with the case. Officials have not publicly named them.
Gewin said the department has made few payments in recent days because of the scam, but that operations are starting to return to normal.
“I’m very confident we’re getting to the right place,” he said. “We’re all hands on deck and we’re getting there right now.”
The loss itself is expected to come from a contingency in the arena budget, the mayor has said, though he has also said he cannot rule out effects on future capital projects. The city’s cyber insurance will not make it whole, according to Cheriogotis, and recovering the money remains the central question.
What happens next
The City Council’s Finance Committee is scheduled to take up the transfer Tuesday, Nov. 3, at 1 p.m., with a follow-up meeting Nov. 17. Both sessions are set for the council’s ninth-floor conference room in the South Tower at 205 Government Plaza. The council has described them as working meetings, and no public questions or comments will be taken.
Among the questions still open are who approved the banking changes, who released the payment, whether the money can be recovered, and how the receiving account was set up. Residents who want to follow the issue can read earlier coverage below.
