SUMMARY: Scammers are mining publicly available land use and permitting filings to send fraudulent invoices that closely imitate legitimate municipal correspondence. The scam targets attorneys, engineers, architects, project owners, and other professionals with contact information appearing in public records.
Before paying any municipal invoice you did not expect, verify it independently with the issuing municipality. Be particularly suspicious of any request to pay “by wire” or where payment is “only accepted by wire.”
The Scheme
We have seen an increasing number of fraudulent invoices targeted at real estate development projects. Multiple applications across various states and municipalities with which we have been involved over the past few months have received one or more fraudulent invoices purporting to be from the municipality for review and administrative fees associated with the project.
The scam is straightforward but effective. The scammers pull contact information for project owners, their attorneys, architects, engineers, and/or other consultants from publicly available applications submitted to municipal planning, zoning, and building departments. They then generate invoices that appear to come from the municipality and send them to the applicant and/or its representatives. The invoices demand payment for a range of fabricated charges, including application review fees, plan review and inspection fees, consultant review fees, public notice and advertising, and other administrative fees. The amounts are often plausible and can be mistaken for legitimate fees.
The Fraudulent Invoices Can Be Convincing
The scammers often include detailed touches to make the invoices appear authentic. Common tactics include:
- Timing of the Invoice. The invoices often arrive at a time of recent action when the applicant may be anticipating receiving a legitimate invoice for review fees. The invoice may come within a short period of time after a filing, a public hearing, or recent action on the application (e.g. a vote or the issuance of the written decision).
- Spoofed email addresses. The sender address is designed to look like it originates from the municipality, often differing from the real address by only a character or a slightly altered domain name.
- Authentic-looking letterhead and seals. Invoices may reproduce the municipality’s official letterhead, logo, or seal.
- Correct municipal addresses. The return address on the invoice may match the actual address of the municipal office.
- Project-specific details. The invoices may reference the correct project name, address, application number, or names of parties involved. It may reference a delay to an upcoming hearing if the invoice is not paid.
- Targeting multiple parties. The email may be sent to multiple contacts listed in connection with the project, including the applicant, attorney, architect, and/or engineer with the hope that one or more will pay the invoice without verifying it is authentic.
Red Flags
Pay particular attention to the following warning:
- Unusual payment methods. Payment in person at the municipality or by check is not permitted. Instead, the invoice directs payment to an account, address, or payment portal you have not used before, or requests payment by wire transfer, gift card, or cryptocurrency.
- Unexpected invoices. You receive an invoice for a fee you did not anticipate or that was not discussed during the application process.
- Urgency or threats. The invoice demands immediate payment and warns of consequences such as project delays, continuance of an upcoming hearing, denial of an application, revocation of the approval, or penalties for late payment.
- Slight irregularities in sender information. The email domain is close to but not exactly the municipality’s domain (e.g. [name of relevant town]planning@usa.com), or the formatting of the letterhead is slightly off from prior legitimate correspondence. The invoice purports come from a generic town address, rather than the specific municipal official(s) with whom you have been dealing.
- Vague or generic descriptions. The line items use general language such as “review fees” or “consultant charges” without specifying the nature of the review or the consultant involved.
Recommended Protective Measures
We recommend that project team members adopt the following practices:
- Verify independently before paying. If you receive an invoice purporting to be from a municipality, do not use any contact information provided on the invoice itself. Instead, contact the municipal department directly using a phone number or email address you have independently verified, such as from the municipality’s official website or from prior legitimate correspondence.
- Establish internal controls. Require that any invoice received in connection with a development project be routed through a designated point of contact who can confirm whether the charge is expected. Accounts payable and bookkeeping staff should be specifically trained on this threat.
- Inspect email headers carefully. Look beyond the display name of the sender and examine the actual email address and domain. Spoofed emails frequently use domains that closely resemble the legitimate domain but contain subtle differences.
- Coordinate across the project team. Make sure that all parties involved in a project from owners, attorneys, engineers, to architects and other consultants are aware of this scam and communicate with one another about any invoices received. If one team member receives a suspicious invoice, it is likely others have as well.
- Report suspected fraud. If you receive a fraudulent invoice, report it to the municipality being impersonated. You can also provide the information to FBI’s Internet Crime Complaint Center (IC3) at ic3.gov, and the Federal Trade Commission at reportfraud.ftc.gov.
If you have any questions about this alert, please contact the author, Brian S. Grossman.