Mobile Fraud Investigation: Council Weighs Its Own Probe as New Details Emerge on $14.7 Million Loss

MOBILE, Ala. — Mobile City Council members said Tuesday they want a Mobile fraud investigation of their own, separate from the federal inquiries and the reviews commissioned by the mayor’s administration, after officials offered their fullest account yet of how the city lost $14.7 million to an impostor and briefly lost nearly $1 million more in an earlier scheme.

The call came over the course of two sessions on Nov. 3: a morning work session where the head of the FBI’s Mobile field office spoke to councilors, and a specially called Finance Committee meeting that afternoon, where City Attorney Robert Shreve responded to questions council members had submitted to Mayor Spiro Cheriogotis’ office. The council also voted Tuesday to create an ad hoc advisory committee on financial transaction security, a separate panel that will have no investigative power.

What the FBI told councilors

Miles Beckner, the special agent in charge of the FBI’s Mobile office, gave the council labels for the two incidents. He said the city was the victim of a business email compromise in August and of a cyber-enabled fraud in October.

“Cyber-enabled fraud is simply just when criminals use the internet or technologies to commit a crime or fraud,” Beckner said. He described a business email compromise as an intrusion that begins when someone clicks a link, allowing a criminal to take over parts of an email account and send messages to vendors or others that appear to come from the legitimate user.

Cyber-enabled fraud is the most common kind of fraud committed worldwide, Beckner said, adding that it generated more than 1 million complaints to federal law enforcement and more than $20 billion in U.S. losses in 2025.

The distinction refines what the public has heard so far. Cheriogotis had previously described the arena scheme as a business email compromise, while Finance Director Logan Gewin has said the August episode was a cyberattack with little in common with the arena case. The mayor has also said the city’s IT systems were not compromised in the arena fraud and that nobody clicked a bad link.

Beckner and Cheriogotis both declined to go further into specifics. The mayor said the city must be careful about what it says on the October case so federal agents can continue their work and possibly recover some of the money.

“It can really affect your investigation in ways you can’t predict,” Cheriogotis said, adding that “by the end of this, we want the public to fully understand detail by detail how this occurred.”

Two incidents, new safeguards

Shreve laid out the August sequence for the committee. City employees’ email was accessed by an outside party, he said, and fraudulent payment instructions arrived Aug. 12. City funds went to a fraudulent entity on Aug. 13 and were recovered Aug. 18. Officials have previously said that payment was just under $1 million, went to a vendor unrelated to the arena and was caught in time for the banks to help claw it back.

Conversations about prevention began right away, Shreve said, and a new protocol took effect Aug. 28.

“That specific protocol changed our existing protocol, and accounts payable was no longer able to approve vendor changes,” he said.

The arena loss followed about five weeks later, though it had begun months earlier. City officials have said someone posing as a representative of B.L. Harbert International, the Regions Arena contractor, first contacted the finance department in late May. Over the following months, according to Gewin, that person traded emails and phone calls with staff, obtained a genuine Harbert invoice and repeatedly asked to change the company’s account information in the city’s system.

Gewin has described the caller as a native English speaker with a “charming” way of talking, and has said the length of the exchange helped the scheme look legitimate once more senior staff became involved. “They could see a two-month conversation,” he said in an interview last week.

On Oct. 2, the city sent the $14.7 million payment meant for Harbert to the account the impostor supplied. The real contractor asked about its money on Oct. 7, officials said at an Oct. 27 council session, and the mayor and Gewin learned of the problem on Oct. 16. The money has not been recovered. Gewin told the council last month that Hurricane Isaias, which made landfall Oct. 8, and a bank holiday the following Monday distracted the people involved during those days. The mayor said then that fraudulent transfers can often be reversed if they are caught within about three days.

Gewin has said the policies adopted after the August incident likely would have stopped the arena scheme had they been in place when the contact began. Because it was already underway, they were not applied to it.

Shreve said the October loss produced a second round of changes. Any change to a vendor’s financial information now needs three levels of approval, including the top finance official.

“All vendor changes, and that’s all of them, in the city of Mobile, require a three-layer approval, triple verified, and that includes the executive director of finance,” he said.

Personnel questions drew far less detail. One finance department employee was fired and two others were placed on paid leave after the October loss. Shreve declined to say whether anyone was disciplined over the August incident. Asked about the three employees tied to the October case, he declined to go into specifics, except to say that some are White and some are Black. Officials have not publicly named them.

Outside of the FBI and the U.S. Secret Service, the city has hired other firms to look into its accounts and cybersecurity, Shreve said. That work includes the national law firm Polsinelli, which the city has retained to examine what happened and help prevent another loss.

Some questions raised after the October disclosure also remain open in public. At the Oct. 27 sessions, Gewin confirmed that the city’s Treasury Department was not involved in the payment but did not say why. He also told the council that the finance department has had six directors since 2021 and about 100% turnover in its accounting and accounts payable functions since 2023. Cheriogotis said that day that the fraud was “not an inside job” and that no one in city government benefited from the money.

Councilors make the case for going further

Several members said the administration’s reviews are not enough.

“From Aug. 12 to mid-October, in roughly a 10-week period of time, we had a million dollars and then $14.7 million that was compromised. That’s just a lot of money,” said District 5 Councilman Beau Fleming. “I just think taking a deeper dive into this is needed at this point because it can’t happen again.”

Council President C.J. Small, who represents District 3, proposed that members recommend people with relevant expertise and have the council’s attorney vet them.

“I’m gonna just ask this Council, let us do our own investigation,” Small said. “I mean, we understand what the administration is doing, but what are we also doing at the same time?”

Councilwoman Samantha Ingram said she wants the focus to be on how city government operates rather than on criminal culpability.

“That’s why we do need an investigation that is more comprehensive and not on a criminal side, but on really looking at the conditions, the situations, and getting to the root causes of some of these human errors,” she said.

Councilwoman Gina Gregory also said she believes it is wise for the council to run what she called a “parallel investigation.”

Residents had pressed for something similar at the Oct. 27 council meeting. Some speakers that day asked for an independent inquiry like the one the council conducted in 2024 during a dispute between then-Police Chief Paul Prine and then-Mayor Sandy Stimpson’s administration. One speaker reminded members that they have subpoena power over city departments.

What comes next

The panel the council approved Tuesday has a more limited assignment. It will consist of seven residents with relevant professional experience and will review the city’s policies, procedures and protocols for financial transactions. It will not have investigative authority.

Its meetings will be open to the public. Members will have six months to deliver a final report to the council, and the committee will dissolve once its findings are submitted.

The $14.7 million is being absorbed by a contingency fund in the arena budget, officials said. Sam Matheny, the project manager, told the committee Tuesday that the $300 million project is still projected to come in under what remains of the budget, at about $281.6 million, and to be ready for its first shows in late March. The mayor has said the city’s cyber insurance will not make up the loss, and has said he cannot promise that future capital projects will be untouched.

The Finance Committee is scheduled to take up the matter again Tuesday, Nov. 17, at 1 p.m. The council has described these committee sessions as working meetings at which no public comment is taken.