Mobile Fraud Timeline Shows Four Months of Missed Warnings Before $14.7 Million Arena Payment Vanished

MOBILE, Ala. — City Hall has now put in writing what many residents suspected for weeks: the $14.7 million that vanished from Mobile’s accounts in October could have been stopped at several points along the way. A detailed Mobile fraud timeline released Wednesday, Nov. 11, by the mayor’s administration traces a scheme that ran for more than four months, from a single message in late May to a misdirected arena payment in early October, and it pairs that chronology with a blunt list of mistakes by city employees.

The document arrives as federal agents pursue a criminal case and as the Mobile City Council prepares to decide next Tuesday whether to open an inquiry of its own.

The City’s Own Verdict: Mistakes at Every Stage

The most striking part of the release may be its conclusions. In its internal review, the city found that employees made multiple errors that allowed the fraud to move forward and slowed its discovery. Among the failures the administration identified:

• Staff accepted banking changes said to come from the contractor without confirming who was actually making the request.
• Employees did not treat repeated changes to the banking instructions as a warning sign.
• Real city payment records were handed to the impostor.
• Once the bank signaled that the money had supposedly reached the contractor, no one pushed the discrepancy up the chain.
• Over four months, employees overlooked small errors and social cues from the criminal that could have exposed the scheme.

The money was owed to BL Harbert International, the Birmingham company serving as general contractor on Regions Arena in downtown Mobile. It came from contingency money, a reserve set aside to cover costs that run beyond the arena’s $300 million budget.

One Finance Department employee has been fired and two others remain on paid administrative leave while the FBI oversees the criminal investigation.

Building Trust One Form at a Time

According to the city’s account, the scheme did not begin with a dramatic demand for money. It began with paperwork.

On May 22, 2026, someone pretending to represent the arena contractor sent an email to the Finance Department. The message framed the request as a routine update to the company’s vendor file and explained that, because of a staffing change, the company could no longer use its normal channel to submit an updated form.

City employees responded the way they would for any business: they sent the standard packet vendors fill out to set up or revise their information. On May 26, the forms came back along with supporting documents listing bogus bank account details. The city changed the vendor record the next day, May 27. No one had verified the request by checking with a known contact at the real company.

The pattern repeated. On June 12, the impostor said the company’s bank details had to change again, this time blaming an internal audit, and sent a fresh set of forms and banking papers. The city updated the vendor file a second time on June 22. Each new round, the city noted, made the exchange look more like an ordinary, ongoing administrative matter, even though the account information kept shifting.

A third change followed in July, during a stretch from July 9 to July 24 in which the impostor also obtained genuine city records. The impostor asked about past payments and whether upcoming payments would go to the accounts already on file. On July 13, more vendor forms led to another update. Then, on July 23, city employees sent the impostor records showing real past transactions between the city and the contractor. The criminal later used those authentic details to appear credible to other city workers.

Why the Bank Became a Hurdle

Changing the vendor file was not enough to redirect arena money, and that distinction pulled more senior people into the conversation. Staff explained to the impostor that arena construction payments moved through a separate banking process, and an edit to the internal vendor file had no effect on the instructions governing those payments.

From that point, the request reached higher-ranking Finance personnel. By late July, senior staff were corresponding with the impostor about upcoming arena payments and how they would be delivered.

City employees forwarded revised payment information to the city’s banking partner in late July, then did so again during August. The bank did not make the change right away. In fact, at least one arena payment made during that stretch still went to the contractor’s genuine account, a sign that the switch had not yet taken effect.

The impostor kept checking in, asking about upcoming payments and whether the switch had gone through. After more back-and-forth, the city sent the information to the bank yet again. On Sept. 24, staff were told the bank had received and applied the new instructions. Those instructions pointed to the fraudster’s account.

The Payment and the Missed Recovery Window

On Oct. 2, the city sent payment instructions for a real arena invoice of roughly $14.7 million. Nothing about the bill itself was fake. The contractor was genuine and the work was genuine. Only the destination account was not, and the money went there.

What followed is the part of the record likely to draw the most scrutiny:

• Oct. 5: The day the money was due to arrive in the contractor’s account, according to the bank.
• Oct. 7: The contractor told the city its payment had not arrived.
• Oct. 8: The city’s bank reported that the funds were supposed to have landed in the contractor’s account on Oct. 5 and supplied a trace number. Staff did not send the issue up for further review.
• Oct. 13: After the project manager followed up, the tracking information was passed along to the contractor, but the matter still was not raised with city leadership.
• Oct. 15: The contractor’s internal team responded.
• Oct. 16: In an email exchange with the contractor, the receiving bank was identified. The company said it had no account there, confirming the fraud. That same day the city began recovery efforts and contacted federal law enforcement.

Fourteen days passed between the transfer and the moment the city knew for certain the money was gone. In fraud cases involving electronic payments, the first few days are often the best chance to freeze or claw back funds before criminals move them elsewhere, which is why delays in reporting can be so costly.

Council Members Want Their Own Answers

Council members received a closed-door briefing on Tuesday, Nov. 10. Afterward, one council member said the timeline made clear there were plenty of chances to uncover the scam before the fraudulent payment went out. He said he was not convinced the administration’s changes go far enough and that he supports an independent review led by the council.

A resolution to launch that review is scheduled for a vote at the council’s meeting next Tuesday, Nov. 17. The council’s own inquiry would be separate from the criminal investigation, which is focused on identifying and prosecuting those responsible.

The mayor has said he has tightened safeguards since the loss and changed the way the city pays large bills.

What City Hall Says It Has Changed

According to the administration, the city has reorganized and tightened the verification and approval steps required before anyone can change a vendor’s banking information or release a payment. It has also changed how large payments are handled.

The city said it continues to work alongside federal agencies and outside experts on three fronts: trying to recover the money, evaluating its financial controls and making further improvements.

How Vendor Impersonation Schemes Work

The scheme described in the timeline fits a well-known pattern often called vendor impersonation or payment redirection fraud, a close cousin of business email compromise. In these cases, criminals pose as a supplier or contractor that an organization already pays, then persuade staff to update the bank account on file. The invoices that follow are real, so the payments look normal, but the money lands in an account the criminals control.

The FBI has for years ranked business email compromise among the costliest forms of cybercrime reported in the United States. Public agencies are attractive targets because they make large, regular payments to well-known contractors whose names and projects are often a matter of public record.

Security professionals generally recommend a few core defenses against this kind of fraud:

• Confirm any request to change payment details by calling the vendor at a phone number already on file, never one supplied in the request itself.
• Require more than one person to approve banking changes and large payments.
• Treat repeated or urgent requests to change accounts as red flags rather than routine paperwork.
• Avoid sending payment histories or other financial records to anyone whose identity has not been independently verified.
• Escalate any report of a missing payment immediately, since speed is critical to recovering funds.

Each of those safeguards corresponds to a step the city now says its employees missed.

What Comes Next

The FBI-led criminal investigation remains open, and the city has not said whether any of the money has been recovered. The fired employee and the two workers on leave have not been publicly identified.

The next key date is Tuesday, Nov. 17, when the City Council is expected to vote on whether to start its own investigation into the loss. Residents can follow council agendas and meeting schedules through the City of Mobile’s website. South AL News will continue to follow the case as investigators and council members seek answers about how a single message in May led to a $14.7 million loss.