MOBILE, Ala. — The impostor first reached out in late May. By the time anyone at the top of Mobile city government knew something was wrong, it was mid-October and $14.7 million in taxpayer money meant for the builder of Regions Arena was gone. At a long day of City Council sessions Tuesday, Oct. 27, Mayor Spiro Cheriogotis and Finance Director Logan Gewin Jr. walked council members through how the Mobile $14.7 million fraud unfolded, while residents lined up at the podium to demand answers and accountability.
The loss may be the largest publicly documented fraudulent vendor-payment scheme ever to hit a U.S. city.
“There’s no way to whitewash this and say it’s not bad. It’s bad,” Cheriogotis told the council. “This is terrible. It’s a terrible reality that many Americans and American companies and other American cities are facing. We, through bad luck, happen to be facing it on a huge dollar amount.”
The FBI and the U.S. Secret Service are investigating, and the mayor said he and other city leaders are meeting with federal partners every day. The administration announced Monday, Oct. 26, that one finance department employee had been fired and two others placed on paid administrative leave. Tuesday’s sessions were the first time officials publicly laid out a step-by-step account of what happened.
A relationship built over months
According to Gewin, who presented the timeline during the council’s morning work session, someone posing as a representative of B.L. Harbert International contacted the city’s finance department at the end of May. The Birmingham-based firm is the general contractor on the roughly $300 million downtown arena.
Over the following weeks, Gewin said, city employees and the impostor kept talking through emails, phone calls and document exchanges. Some of the material traded was legitimate vendor information. Some consisted of false documents with altered payment instructions. Gewin said the back-and-forth gave employees a false sense of trust.
“This was a communication which began in May. An inquiry that was put into the department from a false vendor, false documents exchange,” Gewin told the council. “There were some efforts in that communication to make it look legitimate, copying people who had actual names, and through a series of conversations, phone conversations, email, document exchanges over the next couple months, a level of trust was established to get some vendor information altered.”
Those conversations eventually led to changes in Harbert’s vendor record in the city’s system.
A genuine Harbert invoice also ended up in the fake vendor’s hands. “That is what helped establish legitimacy as this eventually worked its way up the chain,” Gewin said.
He described the exchange of the real invoice as one of the key problems. “Also, the mere fact that there had been a two-month-long communication helped to legitimate that in the eyes of some of the other people as it went up the chain,” he said.
Cheriogotis said after the meeting that the core failure was the change to the vendor’s file, which went well beyond a single bank account number.
“To me, the crux of the situation is the change in information – not just the bank account information but the address and other things,” he said. He added that phone calls between the employee and the supposed vendor did take place “for the purposes of verification. Obviously, it was not done properly.”
The mayor confirmed that the scheme is what is known as a business email compromise, in which criminals impersonate a trusted business partner, often by hijacking or imitating email accounts, to redirect payments.
Oct. 2 to Oct. 16: The key dates
Here is the sequence officials described Tuesday:
- Late May: The fake vendor first contacts the city. Talks continue for months, and Harbert’s vendor information is eventually changed in the city’s system.
- Friday, Oct. 2: The city asks its banking partner to send the $14.7 million payment, which goes to the account the fraudster supplied.
- Oct. 7: The real contractor asks where its money is. City staff start asking questions internally, and there are signs that something is wrong.
- Oct. 8: Hurricane Isaias makes landfall.
- Oct. 13: The vendor follows up with the city again.
- Friday, Oct. 16: Cheriogotis and Gewin learn about the problem.
Gewin said that beyond any human error, a lot of “circumstantial luck” worked in the criminals’ favor. He pointed to the hurricane and a bank holiday as distractions for employees during the days that mattered most.
“Threading the needle 100 times, but one of those pieces with it was I do not believe the hurricane helped,” Gewin said. “The hurricane distracted vendor, other financial parties, city for what appears to be four or five days. There’s also a bank holiday the Monday following.”
Asked why it took more than a week to tell the mayor, Cheriogotis said, “That’s a great question. It’s one … I suspect will never happen again.”
The timing was critical. The mayor explained that fraudulent transfers can often be reversed if they are caught quickly.
“If you catch these incidents within one to up to three days, it’s correctable. You can stop payment,” he said. “You can claw back the money.”
Why the payment looked routine
Part of what made the scheme work, Gewin said, was that nothing about the payment stood out. The city had been paying Harbert every month under a contract the council approved last year.
“This is a regular monthly payment with an established process, an established cadence,” he said. “This has been working like clockwork for 18 months. There’s nothing different about this payment except that the payment info had gotten changed behind it.”
He would not say who signed off on the transfer. “Ultimately someone internally said this is fit to be sent,” he said. “Ultimately, a bank released those funds. There’s a lot of details in there we can’t go into.” He added that all three employees who were fired or put on leave worked in the finance department, but declined to discuss the reasons. Their names have not been released.
Scott Collins, who led the finance office from 2024 to 2026, said that during his tenure he and the city comptroller would have been responsible for approving transactions like this one.
Cheriogotis summed up the central breakdown this way: “In the end, there was a failure in that account information was able to be updated without proper verification. That was a failure, and there were others that we can’t detail at this time.”
The council’s attorney told members that neither the invoice nor a vendor’s request to change payment instructions would ever have come before the council for approval. Gewin likewise said the mechanics of the payment sit well below the mayor’s level.
An earlier attempt the council never heard about
One of the day’s biggest surprises was that Mobile had been targeted before. Cheriogotis said that in August, a payment of just under $1 million to a different vendor, unrelated to the arena, was sent to a fraudulent account. The city caught it within about two days and got the money back.
“It was caught in that 72-hour window that allows the banks to internally place holds on funds,” he said. “We recognized the issue and clawed it back. To my knowledge, it was an unrelated and slightly different scenario.”
After that incident, he said, the finance department adopted new rules for paying contractors that would have stopped the arena fraud. But because the arena scheme had started in May, the impostor’s changes were already in place before the new safeguards took effect.
Council members said nobody had told them about the August attempt. District 1 Councilman Cory Penn asked why, and Cheriogotis said he had believed the council was informed.
“I was under the impression you had been informed,” he said. “I can’t speak to why you weren’t.”
Speaking with reporters afterward, the mayor was blunt about the miscommunication. “I frankly, apparently, have an imagined memory of sitting in the council chamber and informing them of that transaction,” he said. “The good news is it was caught within that 72-hour window, which really allows the Secret Service and the FBI to do what they do.” He said the city will release more information about the August attempt later.
Penn and District 2 Councilwoman Samantha Ingram said the council must be told about incidents like that from now on, and the mayor promised it would be.
Turnover in the finance department
The fraud comes after years of upheaval in the city’s finance office. Gewin told the council the department has had six different directors since 2021. That run began a few months after longtime Finance Director and former Chief of Staff Paul Wesch died in a single-vehicle crash in late 2020. Gewin said the department has seen “100 percent turnover” in the past three years.
The City Council approved Cheriogotis’ appointment of Gewin as executive director of finance in April. Before him, the department was led by Donna Bryars (interim), Scott Collins, Richard “Rick” Moore, Robert Holt and Celia Sapp (interim), according to city officials.
“We’ve had about 100% turnover since 2023 in these accounting, AP (accounts payable) functions. There were definitely actions and inactions that happened here,” Gewin said. “There’s also organizational lessons behind all this that we want, I want to come out helping make the city better for it.”
“Honestly, when I came in the finance department with the level of turnover they had experienced, it was a grave concern to me,” said Cheriogotis, who took office last year. “Frankly, part of this is at times we suffered through limited manpower.”
He would not say whether turnover was a main reason the scheme worked. “I could rattle off 12 problems here,” he said. “There were a lot of problems here. It’s not one particular thing. But we need to answer those problems and close the gaps, whether internal or external.”
‘Direct their anger to the right place’
Throughout the day, Cheriogotis defended city workers while accepting that mistakes were made.
“I really can’t talk about the exact details of what led to at least one termination and two other employees being placed on leave, but what I want to ask the public to do is to direct their anger to the right place,” he said, pointing to the criminals rather than “good, decent people who make mistakes.”
“This was not an inside job,” he said. “There is no one in the City of Mobile who benefitted from this money.”
Residents demand accountability
Several residents who spoke during the regular council meeting were not satisfied.
“Much, if not all, of that money may never be recovered,” said Matthew Miller, a lifelong Mobile resident. “This represents a catastrophic breakdown in the safeguards intended to protect taxpayer dollars.” He put the loss in everyday terms: at a starting price of $63,700, he said, the money could have bought 230 new Chevy Tahoes, “an entire parking lot.”
Miller also reminded council members that state law gives them subpoena power over city departments. “You don’t have to wait for the mayor’s administration to tell you what happened,” he said.
Nina Dortch said residents deserve to know whether the fraud was a one-time event or a sign of deeper weaknesses. She also criticized the mayor’s new rule on hand-delivered checks.
“A hand-delivered check is not a financial safeguard,” Dortch said. “Acknowledgment is not the same as accountability, either. Acknowledging that something happened is only beginning.”
She urged the city to “move forward with stronger financial controls,” adding, “We are behind the 8-ball.”
Estella Trotter said firing one employee and suspending two was not enough. “Many city officials need to resign and need to be fired,” she said.
Some speakers asked the council to run its own independent investigation, as it did in 2024 when then-Police Chief Paul Prine raised allegations during a dispute with then-Mayor Sandy Stimpson’s administration.
How the council is responding
Council members took several steps Tuesday:
- A resolution was introduced to create an ad hoc committee on financial transaction security. Its members would be private-sector professionals appointed by the council to review how the city handles financial transactions. A vote is expected Tuesday, Nov. 3.
- Councilman Josh Woods, who chairs the finance committee, scheduled committee meetings for Nov. 3 and a second session later in November focused largely on the fraud. Reports have given the date of the second meeting as Nov. 10 and as Nov. 17; residents should check the city’s meeting calendar for the confirmed date.
- Woods said he will ask the council next week to seat a citizen committee of bankers and certified public accountants to review the finance department’s policies. “Iron sharpens iron,” Woods said. Council members have said the advisory panel would be made up of seven residents with relevant professional experience.
- Penn said he will send the administration about 40 questions. They cover written policies, financial reports, insurance claims, the scope of independent investigations, how the loss could affect city reserves and capital projects, and a corrective plan with responsible departments and deadlines. “A lot of those questions come from residents in the community,” he said.
Woods also said the Secret Service and FBI are “no one better equipped” to investigate.
Penn said he is open to the council doing more. “I think, and I believe right now, we have to do everything in our powers to figure out exactly what happened and how to make sure that this doesn’t happen again,” he said.
New safeguards at City Hall
Cheriogotis said that for now, any payment over $1 million will be made with a physical check handed to a person.
“I don’t expect that you’re going to see one above a million dollars again transferred electronically under my administration or without some updates,” he said.
Under the new procedures, Gewin as finance director will give final approval on large transactions, and the mayor said payments over $1 million will also come to his office for oversight. The city will check with vendors so that it confirms within days that they actually received their money. Cheriogotis said contractors who want to change banking information should expect a cumbersome process.
“I’ve talked about hard checks for anything, any amount with two commas in it, to limit our exposure to these cyber criminals,” the mayor said. He declined to describe other new controls “so as not to make us a target and give bad guys a playbook.”
What it means for the budget
The mayor said the loss is not expected to affect arena construction or this fiscal year’s projects, which run through Sept. 30, 2027. The city paid Harbert out of a $15 million contingency fund built into the arena budget to cover unexpected costs. If that money had not been needed, Cheriogotis said, it could have helped pay down arena debt faster, gone to other capital projects or been added to the city’s unassigned fund balance.
Council members are worried about their district budgets. Each receives about $4 million a year for local projects, and Penn called the loss a “game changer.” Councilwoman Gina Gregory said, “The last thing we want to see is for it to be decreased in any shape or form due to this happening.” Cheriogotis said he was unsure how the loss would affect future budgets.
Gregory, the council’s vice president, noted that because the $15 million owner’s contingency is now covering Harbert’s bill, the leftover money the council had hoped to put toward 2028 projects is gone.
The city’s legal liability fund and insurance carrier are paying for outside legal counsel, and a forensics firm has been hired through insurance, with the city paying a deductible. Cheriogotis said he does not yet know how much insurance will cover, but it will not come close to the full amount.
Can the money be recovered?
The mayor said he has not given up. He said the FBI told him about a case in which investigators traced the theft of a schoolteacher’s life savings to a larger fraud ring, leading to an arrest in the United Kingdom months later.
“So, I won’t say it’s a remote chance,” he said. “I would say we are hoping that it happens, and we are gonna assist in every way we can and make it happen.”
The timing of the discovery may have been decisive. Critical days passed between the Oct. 2 transfer and the Oct. 16 discovery. In August, by contrast, the city caught the earlier fraudulent payment quickly enough for the receiving account to be frozen before the money could be moved, saving taxpayers nearly $1 million.
Former FBI agent: Arrests possible, but don’t budget for recovery
Darren Mott, a retired FBI supervisory special agent who lives in Huntsville and runs two cybersecurity consulting firms, said arrests in the Mobile case are possible.
“It’s a little better now than when I was in, simply because there’s better relationships with foreign countries who recognize that their people are being victimized, as well, so they’re taking it more seriously,” he said. “But it depends on the country.”
Mott said the Mobile fraud bears the hallmarks of organized cybercriminal groups based in Eastern Europe and Russia, places beyond the reach of U.S. authorities where governments sometimes support such criminal enterprises.
“Is it possible? Sure. Anything’s possible,” he said. “Is it likely? I wouldn’t, you know, plan your budget next year around getting this money back.”
Mobile is far from alone. The FBI has for years ranked business email compromise as the costliest form of cybercrime in the country, and Cheriogotis told the council that national losses from this type of fraud grew from about $4 billion a year in 2020 to $20.8 billion last year.
BBB: Mobile $14.7 million fraud scheme is targeting Alabama businesses, too
The Better Business Bureau of Central and South Alabama is warning businesses across the region to take extra precautions. Besides the city’s $14.7 million loss, the BBB said another local business recently came close to losing more than $750,000 to the same kind of scheme, and a BBB vice president said the cases are not isolated.
Scammers can impersonate trusted vendors by breaking into email accounts and persuading businesses to send payments to fraudulent accounts, the BBB said. Unlike many scams, business email compromise does not necessarily involve a suspicious link or malicious software. Criminals may instead rely on research and convincing emails that appear to come from someone a business already knows, sometimes asking it to switch payment methods, such as from a paper check to a wire transfer. A single unverified payment change can put hundreds of thousands of dollars at risk.
The BBB recommends that businesses:
- Verify any change in payment information by calling the vendor at a phone number already on file, not one provided in the email.
- Train employees to recognize the warning signs of scams.
- Require multiple approvals for large payments.
- Take a few extra minutes to confirm payment details before money goes out.
- If a payment has been sent to a scammer, contact the bank immediately and report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov.
An update on Regions Arena is expected at next week’s council meeting. Mayor Cheriogotis put the overall situation plainly: “There’s no way to spin this as a good thing.”