California City Loses $913,000 in Sophisticated Phishing Scam Targeting Construction Payment

How the Scam Worked

On February 12, Pittsburg intended to transfer $913,000 to Discovery Builders Inc., the legitimate construction company overseeing the Dream Courts sports facility project. Instead, scammers successfully redirected the payment to their own account by executing a multi-layered attack combining email spoofing and credential theft.

Warning Signs and Identifying Features

This scam employed several sophisticated tactics working in concert:

Email Address Manipulation: The fraudulent email address closely resembled the legitimate Discovery Builders address, with the addition of a single lowercase letter "L." Such minor variations are commonly overlooked during rushed communications.

Credential Compromise: Scammers gained unauthorized access to Sara Bellafronte's email account—an assistant to the city manager—and used it to send messages to city finance personnel. The impersonated official claimed to have verbally confirmed new banking details and instructed the employee to update payment information.

Authority and Urgency: By invoking the apparent authority of a senior city official and presenting updated banking information as already verbally confirmed, the scammers created an impression of legitimacy and reduced scrutiny.

Prevention and Protection Measures

1. Email Address Verification Protocol

• Verify sender email addresses character-by-character, particularly for any communication involving financial transactions.
• Maintain a verified record of legitimate vendor email addresses separate from email systems.
• Be skeptical of minor variations in email addresses, especially when a payment is requested.

2. Multi-Step Payment Authorization

• Implement procedures that require verbal or in-person confirmation for changes to payment information, regardless of email instructions.
• Treat requests to change banking details as high-risk transactions requiring additional verification layers.
• Never rely on email alone to authorize payment routing changes.

3. Email Account Security

• Enforce strong password policies and regular password changes across organizational accounts.
• Implement multi-factor authentication (MFA) on all accounts, especially those with financial access.
• Monitor and log suspicious login activities.

4. Organizational Payment Controls

• Establish pre-defined approval chains for payments that mandate verification through multiple communication channels.
• Separate the authority to request changes from the authority to execute payments.
• Conduct periodic audits of large transactions and payment routing changes.

Investigation and Recovery

The FBI initiated a full investigation, issuing 18 search warrants to examine 116 accounts. Three suspects were identified—two in the United States and one in Nigeria—though no arrests have been publicly announced.

The stolen funds moved through multiple accounts in a complex chain before being partially converted to cryptocurrency. One recipient in Illinois, believing he worked legitimately for "Tyco Alloy Industries," moved approximately $217,000 in cryptocurrency on behalf of what he thought was a legitimate business.

Pittsburg recovered approximately $696,000, but about $218,000 remains unrecovered. The city faces an estimated loss of roughly $100,000 after insurance claims.

Institutional Response

Following the incident, Pittsburg implemented:

• Enhanced payment verification procedures
• Revised financial authorization workflows
• Additional IT security staffing and oversight
• Physical check collection from the construction company, eliminating wire transfers

Reporting Resources

If you suspect you have been targeted by similar fraud:

• FBI: tips.fbi.gov or 1-800-CALL-FBI
• Federal Trade Commission (FTC): reportfraud.ftc.gov
• IC3 (Internet Crime Complaint Center): ic3.gov
• Your local law enforcement agency