Mobile Fires One Employee, Puts Two on Paid Leave Over $14.7 Million Arena Fraud; Mayor Says Scheme Was Not an ‘Inside Job’

MOBILE, Ala. — One City of Mobile employee has been fired and two others have been placed on paid administrative leave as the city investigates how $14.7 million in taxpayer money was sent to criminals posing as a contractor on the Regions Arena project, Mayor Spiro Cheriogotis announced Monday, Oct. 26.

In a written statement released Monday afternoon, the mayor offered the most detailed description yet of how the theft happened. He said the city’s computer systems were not hacked and no employee clicked on a malicious link. Instead, he said, a fraudster impersonated a legitimate vendor and gradually earned the trust of key city employees through a series of emails, documents and phone calls.

“To be clear, nothing we have learned suggests this was an ‘inside job,'” Cheriogotis said.

The personnel actions came six days after the city first disclosed the loss, and one day before the Mobile City Council’s regular Tuesday meeting, where council members have said they intend to press the administration for answers. The mayor said that, at councilors’ request, his administration would share additional details during that session.

What the mayor said

Cheriogotis did not identify the employee who was fired or the two employees placed on leave, and he did not disclose their job titles. He said the city is withholding their names, positions and personal information to protect their safety.

His full statement read, in part:

“As a result of internal investigations into the $14.7 million theft, one City employee has been terminated. Two City employees have been placed on administrative leave with pay pending further investigation.

“Based on the facts and evidence as we know them today, our IT systems were not compromised. This was not the result of an employee clicking a bad link. To accomplish this theft, a fraudster impersonated a legitimate vendor and built misplaced trust with critical employees through a series of emails, documents, and phone calls.

“To be clear, nothing we have learned suggests this was an ‘inside job’. We will not be releasing names, positions, or personal information of the three employees in order to protect their safety. I understand the public’s anger. I am angry, too. The loss of taxpayer dollars to fraud and malfeasance is extremely painful.”

The mayor asked residents to focus their frustration on the people who carried out the scheme.

“I am asking the public to direct your anger at the criminals,” he said. “The people who did this are the same kind of criminals who prey on businesses large and small, public and non-profit entities, individual families and the elderly. This fraud was perpetrated by the same type of criminals who steal people’s life savings.”

Cheriogotis said his administration will continue working with the FBI and the U.S. Secret Service to try to recover the money and to pursue those responsible.

“Our top priorities are putting protections in place to ensure this never happens again and holding the responsible parties accountable,” he said. “We have learned much from our internal investigations, but we must allow the independent investigations to occur unfettered and reserve final judgment once their findings are complete. We are committed to transparency, and at the request of City Councilors, we will be sharing additional details during tomorrow’s Council session.”

How the loss came to light

The city first announced the loss in a news release on the evening of Tuesday, Oct. 20, saying only that Mobile had been “the target of a criminal scheme resulting in the transfer of $14.7 million in city funds to a fraudulent entity.” Council members had been briefed on the loss earlier that day in a closed-door executive session.

At a news conference the following morning, Cheriogotis said the money went out in early October as one payment in a series of large transactions connected to construction of Regions Arena, the roughly $300 million entertainment venue rising on the site of the former Mobile Civic Center downtown. The mayor said he personally learned of the loss on Friday, Oct. 16, and that federal authorities were notified immediately.

He said the loss would be absorbed by a $15 million owner’s contingency built into the arena budget, that construction would continue and that the project is still expected to be completed within budget. He also said the city has a cyber insurance policy that is expected to cover some, but not all, of the loss, and he announced a new rule: any payment large enough to have “two commas” in it, meaning $1 million or more, must now be made by hand-delivered check rather than by wire or other electronic transfer.

At the time, Cheriogotis declined to say whether the city had fallen for a phishing email or an impersonation scheme, whether existing controls were followed, or whether any employee had been disciplined. Monday’s statement answered two of those questions.

A pattern experts call business email compromise

The scheme the mayor described matches a well-known type of fraud called business email compromise, or BEC, in which criminals pose as a trusted vendor, executive or business partner and persuade an organization to send a payment to a bank account they control. A cybersecurity expert interviewed last week said the Mobile case appeared to fit that pattern, and the details in the mayor’s latest statement are consistent with it.

Tim Gallagher, a retired FBI special agent in charge who is now chief security officer at the investigation and security firm Nardello & Co., said the size of Mobile’s loss is extraordinary for a local government.

“I’ve been working this type of violation for many, many years, and that loss figure that you’re telling me, over $14 million for local government far outstrips anything I’ve ever seen in this space before,” Gallagher said.

Gallagher said that in cases he has worked, criminals often gain access to an email system and “just lurk there and just read email traffic, looking for a transaction that’s going to be beyond the ordinary.” When they find one, he said, they quickly substitute an email address they control for the legitimate vendor’s and change the bank account so the money is routed to them.

Scott Augenbaum, a retired FBI agent who now trains organizations on preventing cybercrime, said these losses are often discovered during an audit or when the real vendor calls to say it was never paid. He said the key defense is to stop and independently verify whenever a payment request changes.

“If there is the movement of large sums of money, the changing of a bank account or beneficiary, or the introduction of a new person, we need to pause every time that happens, separate from the situation, and verify,” Augenbaum said.

Evey Owen, a vice president with the Better Business Bureau serving the Mobile area, said scammers are skilled at building trust. “Scammers, they are criminals,” she said. “They’re very smart. This is a tactic that they use to gain our trust. And it can happen to anybody, somebody, you know, a single person or a business and an enterprise of this scale, of this size.”

How large payments were handled before

The former head of the city’s finance department described last week how high-dollar payments were verified while he was in charge. Scott Collins served as Mobile’s executive director of finance from 2024 until April 2026, when Cheriogotis appointed Logan Gewin to replace him.

Collins said that who gets paid, and how, is typically spelled out in a project’s contract. Under the process he described, the project engineer invoices the finance department, and the finance director confirms the invoice by calling the project engineer or meeting in person. Once an invoice is confirmed, either the finance director or the city comptroller could authorize a wire transfer, and each wire came with two-factor authentication to confirm the payment information, he said.

Collins acknowledged that policies may have changed since he left. The city has not said whether that process was in place when the $14.7 million payment was made, who authorized it or how the fraudulent payment instructions were introduced.

Why the council’s role matters

The mayor’s announcement has drawn attention to a provision of state law that limits the mayor’s power over some top city jobs. Under Alabama’s Zoghby Act, which governs Mobile’s form of government, the mayor needs approval from at least five of the seven City Council members to appoint or remove the executive directors of finance, public works and public safety, as well as the police and fire chiefs. The mayor recommends the appointments and removals, but the council must approve them.

The three executive director positions are exempt from the city’s merit system, while the law allows police and fire chiefs to be appointed from outside it. The council confirmed Gewin as executive director of finance on April 14, 2026.

That distinction matters because the mayor cannot permanently remove the finance director without a council vote, and no such vote has taken place. The Zoghby Act does not expressly require council approval to place someone on temporary administrative leave, however.

There is precedent for that path. In April 2024, then-Mayor Sandy Stimpson placed then-Police Chief Paul Prine on paid administrative leave, and the City Council voted to remove Prine about three weeks later.

The administration has not said whether the finance director is among the employees placed on leave, and nothing in the mayor’s statement confirms who the three employees are.

The long-term cost to taxpayers

The loss could ultimately cost Mobile far more than $14.7 million. The arena money came from borrowed funds that the city must repay with interest. Based on the bond’s scheduled payments, the $14.7 million share accounts for an estimated $22.2 million in payments over 20 years, a calculation the city has confirmed is correct.

How much of the money can be recovered remains unknown. Other governments that fell victim to similar schemes have had mixed results:

• Portland, Oregon said $6.7 million was diverted from a water project to a fraud scheme last year. The city recovered all of it.
• Chetek, Wisconsin recovered the full $2.6 million that scammers diverted from a wastewater project in 2024.
• Brunswick County, North Carolina lost more than $4 million in a phishing scam.
• Baltimore, Maryland lost $800,000 to a fake vendor in 2025.

Mobile’s loss is more than twice the amount Portland reported. Experts cautioned that recovery becomes more difficult the longer money is out of reach.

“Unfortunately, by the time you realize it, the money’s already been transferred. Getting the money back is very, very challenging. And since these cyber criminals are located outside the U.S., the chances of putting them in jail is really hard,” Augenbaum said.

Gallagher described how stolen funds typically move. “Because the way these individuals work, these threat actors, they have a couple different hops. It goes from one bank account to another bank account, and then out of the country. And once it’s out of the country, a lot of times it’s outside the reach of U.S. law enforcement,” he said.

Residents want more than personnel moves

Some Mobile residents said Monday’s announcement does not settle their concerns.

“What will it accomplish and what’s after that. Like, sure someone was kinda held accountable, but is it oh, 14 million is gone and we got rid of those people that’s still 14 million dollars,” said Dermyrius Lindsey.

“Everybody needs to be looked at from the ground up and they need to make sure nothing this embarrassing or of this magnitude never happens again,” said Michael Herbeck.

Angela Trigg said the city needs better safeguards. “They need to be doing some kind of training or protections put in place,” she said. Another resident, Robin Wiatt, said, “I think computerization of some of these businesses is just too much.”

What happens next

The City Council’s schedule for Tuesday, Oct. 27, begins with its weekly pre-conference meeting at 9 a.m., followed by the regular meeting at 10:30 a.m. at Government Plaza, 205 Government St. Both meetings are open to the public. Council President C.J. Small has said the full council will question the administration about the loss, and five members of the public signed up in advance to address councilors about it during the public comment period.

Small said last week that “a criminal or criminals posed as an existing vendor” to take the money, and the council issued a joint statement saying it wants to know “what happened, who will be held responsible and what steps will be taken to prevent this from happening again.”

Separately, the FBI and Secret Service investigations continue. The city has said it hired the national law firm Polsinelli, which handles incidents of this type, and a forensic firm to audit both its policies and its books, and that its insurance carriers brought in a separate law firm for an independent review. No arrests or charges have been announced.

The FBI encourages anyone who believes they have been targeted by online or wire fraud to file a report with the bureau’s Internet Crime Complaint Center at ic3.gov.

Key facts

• Amount lost: $14.7 million, in a single payment tied to Regions Arena construction in early October
• Personnel actions: One employee fired; two placed on paid administrative leave pending further investigation
• How it happened, according to the mayor: A fraudster impersonated a legitimate vendor using emails, documents and phone calls; city IT systems were not compromised
• Investigators: FBI and U.S. Secret Service, along with the city’s outside legal and forensic reviews
• Long-term cost: An estimated $22.2 million in bond payments over 20 years
• Next step: Additional details expected at the Mobile City Council’s Tuesday, Oct. 27, meeting

South Alabama News will continue to follow the investigation and will update this story as more information becomes available.